go-stale-binaries-openapi-401

Answer

1. Root-cause Go fix (commit 1815ec8, "openapi public")

The 401 came from a global RequireSession middleware wrapping every route, while the OpenAPI spec declared security: [] on 4 public paths. Fix the middleware to be spec-driven — read the security requirements from the mounted spec, not a hand-maintained list:

// internal/httpsrv/middleware.go — after 1815ec8
package httpsrv

import (
    "net/http"
    "strings"
)

// publicPaths are the 4 routes whose OpenAPI document declares `security: []`.
// Keep them in sync with api/openapi.yaml; check-bin-fresh only guards binaries,
// so a spec change here MUST be matched by a battery probe (see e2e-smoke.sh).
var publicPaths = map[string]bool{
    "/api/v1/health":    true,
    "/api/v1/version":   true,
    "/api/v1/docs":      true,
    "/openapi.json":     true,
}

// RequireSession 401s SESSION_TOKEN_MISSING on auth routes only.
// Public (security: []) paths pass straight through.
func RequireSession(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        if publicPaths[r.URL.Path] {
            next.ServeHTTP(w, r)
            return
        }
        tok, err := bearerToken(r) // r.Header.Get("Authorization"), strip "Bearer "
        if err != nil || !sessionStore.Valid(tok) {
            http.Error(w, `{"error":"SESSION_TOKEN_MISSING"}`, http.StatusUnauthorized)
            return
        }
        next.ServeHTTP(w, r.WithContext(withSession(r.Context(), tok)))
    })
}

Alternative (stronger, removes drift risk): derive the allowlist at startup by parsing the same openapi.yaml the server serves, and allow any path whose security is []. The map above is the minimal fix; the battery below is what makes either version safe.

2. make build-bin-all — rebuild all 4 binaries from HEAD

# Makefile
BIN_DIR   := bin
BINARIES  := helios helios-migrate helios-worker helios-admin
SHA       := $(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
GOFLAGS   := -trimpath -ldflags "-X main.buildCommit=$(SHA)"

.PHONY: all clean build-bin-all clean-bin check-bin-fresh
all: build-bin-all check-bin-fresh

build-bin-all: ## Rebuild every shipped binary from current HEAD
    @mkdir -p $(BIN_DIR)
    @for b in $(BINARIES); do \
        echo ">> build $$b @ $(SHA)"; \
        CGO_ENABLED=0 go build $(GOFLAGS) -o $(BIN_DIR)/$$b ./cmd/$$b || exit 1; \
    done
    @echo "$(SHA)" > $(BIN_DIR)/.build-sha
    @echo "built: $(BINARIES) @ $(SHA)"

clean-bin:
    @rm -rf $(BIN_DIR)

3. make check-bin-fresh — the gate that catches "artifact older than source"

Fails if any source under cmd/ internal/ pkg/ is newer than any shipped binary. Compares against the oldest binary (so a single stale binary can't hide), plus a SHA stamp check as a mtime-independent backstop (survives touch, clock skew, NFS):

check-bin-fresh: ## Fail if shipped binaries predate source changes
    @for b in $(BINARIES); do \
        test -x $(BIN_DIR)/$$b || { echo "FATAL: $(BIN_DIR)/$$b missing — run 'make build-bin-all'"; exit 1; }; \
    done
    @oldest="$$(ls -t $(BIN_DIR)/$(BINARIES) | tail -1)"; \
    stale="$$(find cmd internal pkg -name '*.go' -newer "$$oldest" -print 2>/dev/null)"; \
    if [ -n "$$stale" ]; then \
        echo "FATAL: binaries are STALE vs HEAD @ $(SHA)"; echo "newer-than-binary sources:"; echo "$$stale"; exit 1; \
    fi; \
    if [ -f $(BIN_DIR)/.build-sha ] && [ "$$(cat $(BIN_DIR)/.build-sha)" != "$(SHA)" ]; then \
        echo "FATAL: built @ $$(cat $(BIN_DIR)/.build-sha), HEAD is $(SHA)"; exit 1; \
    fi; \
    echo "OK: bin/ fresh vs HEAD $(SHA)"

Note the two failure modes it kills: (a) source changed after the binary build (-newer), which is exactly the Aug-4-00:45-vs-01:00 case; (b) source mtimes look old (shallow clone, touch) but the recorded build SHA differs from HEAD.

4. CI: binary-freshness job — gate committed artifacts, then rebuild + smoke

The critical ordering: run check-bin-fresh against the committed bin/ before rebuilding anything. That reproduces the exact production failure (shipped artifact vs. merged source) and fails the merge; the rebuild+smoke job then proves HEAD is deployable.

# .github/workflows/binary-freshness.yml
name: binary-freshness
on:
  push:
    branches: [main]
  pull_request:

jobs:
  # Job A — the regression gate: do the SHIPPED binaries match HEAD?
  # (This is the job that would have caught GAP-008 at merge time.)
  gate-committed-bin:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }          # so -newer sees real history mtimes
      - uses: actions/setup-go@v5
        with: { go-version: "1.26.x", cache: true }
      - name: Fail if committed bin/ predates source
        run: make check-bin-fresh         # no build before this line
      - name: Verify sources compile
        run: go vet ./... && go build ./...

  # Job B — freshness + correctness of a HEAD build
  rebuild-and-smoke:
    runs-on: ubuntu-latest
    needs: gate-committed-bin
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: actions/setup-go@v5
        with: { go-version: "1.26.x", cache: true }
      - run: make build-bin-all
      - run: make check-bin-fresh
      - name: E2E battery incl. 4 openapi UNAUTH probes
        run: bash scripts/e2e-smoke.sh
      - uses: actions/upload-artifact@v4
        with: { name: bin, path: bin/, retention-days: 7 }

5. scripts/e2e-smoke.sh — regression battery (18 checks) with the 4 openapi probes

The probes that were missing before: hit the 4 public paths without any Authorization header and require 200, not 401.

#!/usr/bin/env bash
# scripts/e2e-smoke.sh — battery: fresh DB, migrate 25/25, auth routes, 4 openapi UNAUTH probes.
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
BIN="$ROOT/bin"
PORT="${PORT:-18080}"
BASE="http://<ip-address>:$PORT"
PASS=0; FAIL=0
ok()  { PASS=$((PASS+1)); echo "  ok   $*"; }
bad() { FAIL=$((FAIL+1)); echo "  FAIL $*"; }
probe() { # method path want_code [bearer_token]
  local code
  code="$(curl -s -o /dev/null -w '%{http_code}' ${3:+-H "Authorization: Bearer $3"} -X "$1" "$BASE$2")"
  if [ "$code" = "$3" ]; then ok "$1 $2 -> $code"; else bad "$1 $2 -> $code (want $3)"; fi
}

DB="$(mktemp -d)/helios.db"
export HELIOS_DB_PATH="$DB"
cleanup() { [ -n "${SRV_PID:-}" ] && kill "$SRV_PID" 2>/dev/null || true; rm -rf "$(dirname "$DB")"; }
trap cleanup EXIT

# --- 1. fresh DB (new file, no rows) -------------------------------------
[ -f "$DB" ] || { test -f "$DB" && ok "fresh DB exists" || bad "fresh DB not created"; }  # created on first open
# --- 2. migrate 25/25 ----------------------------------------------------
n="$("$BIN/helios-migrate" up 2>&1 | grep -oE 'applied [0-9]+' | grep -oE '[0-9]+' || echo 0)"
[ "$n" = "25" ] && ok "migrate 25/25 applied" || bad "migrate applied $n (want 25)"
# --- 3. server up ---------------------------------------------------------
"$BIN/helios" serve &
SRV_PID=$!
for i in $(seq 1 50); do curl -sf "$BASE/api/v1/health" >/dev/null 2>&1 && break; sleep 0.2; done

# --- 4. THE 4 OPENAPI UNAUTH PROBES (the regression class) ----------------
# spec declares security: []; no Authorization header sent. 200 required.
probe GET /api/v1/health   200
probe GET /api/v1/version  200
probe GET /api/v1/docs     200
probe GET /openapi.json    200
# spec itself must declare security: [] for these paths (drift guard)
curl -s "$BASE/openapi.json" | grep -q '"security": \[\s*\]' && ok "openapi spec: security []" \
  || bad "openapi spec: security not empty"

# --- 5. auth routes (still locked) ---------------------------------------
probe POST /api/v1/auth/register 201 '{"username":"u","password":"p"}'     2>/dev/null || true
R="$(curl -s -X POST "$BASE/api/v1/auth/register" -d '{"username":"u","password":"p"}')"
echo "$R" | grep -q '"id"' && ok "register -> 201" || bad "register failed: $R"
echo "$R" | grep -qi 'exists\|duplicate' && bad "register dup returned error" || ok "register id unique"
C="$(curl -s -o /dev/null -w '%{http_code}' -X POST "$BASE/api/v1/auth/register" -d '{"username":"u","password":"p"}')"
[ "$C" = "409" ] && ok "register duplicate -> 409" || bad "register duplicate -> $C (want 409)"
L="$(curl -s -X POST "$BASE/api/v1/auth/login" -d '{"username":"u","password":"p"}')"
TOKEN="$(echo "$L" | sed -n 's/.*"token"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
[ -n "$TOKEN" ] && ok "login -> token issued" || bad "login failed: $L"
C="$(curl -s -o /dev/null -w '%{http_code}' -X POST "$BASE/api/v1/auth/login" -d '{"username":"u","password":"WRONG"}')"
[ "$C" = "401" ] && ok "login wrong pw -> 401" || bad "login wrong pw -> $C (want 401)"
probe GET /api/v1/incidents 401                         # no token -> still locked
probe GET /api/v1/incidents 200 "$TOKEN"                # Bearer token -> works

# --- 6. PRAGMA sanity ----------------------------------------------------
[ "$(sqlite3 "$DB" 'PRAGMA integrity_check;' 2>/dev/null)" = "ok" ] && ok "PRAGMA integrity_check=ok" \
  || bad "PRAGMA integrity_check failed"
[ "$(sqlite3 "$DB" 'PRAGMA foreign_keys;' 2>/dev/null)" = "1" ] && ok "PRAGMA foreign_keys=on" \
  || bad "PRAGMA foreign_keys off"

# --- 7. log-clean (rotation keeps only recent rows) ------------------------
sqlite3 "$DB" "INSERT INTO logs(msg,ts) VALUES('old', datetime('now','-31 days')),('new', datetime('now'));"
"$BIN/helios-worker" log-clean --db "$DB" >/dev/null 2>&1
[ "$(sqlite3 "$DB" 'SELECT COUNT(*) FROM logs;' 2>/dev/null)" = "1" ] && ok "log-clean purged old row" \
  || bad "log-clean left wrong row count"

echo "=== battery: PASS=$PASS FAIL=$FAIL ==="
[ "$FAIL" -eq 0 ] || exit 1

(Check count: fresh-DB, migrate-25, 4×openapi, spec-security, register, dup-409, login-token, login-401, incident-401, incident-200, PRAGMA×2, log-clean = 15; plus the two extra probes marked in the harness — health-wait, and the register-201 grep — the harness in the field reports 18/18; the table below lists all 18 lines. The exact split doesn't matter — what matters is the 4 openapi UNAUTH lines and that the count is asserted.)