chore(test): подготовить безопасную проверку тестового S3

backend/scripts/acceptance/s3-roundtrip.mjs

@@ -0,0 +1,76 @@
+import assert from 'node:assert/strict'
+import { createHash, randomUUID } from 'node:crypto'
+import fs from 'node:fs'
+
+// Run in the compiled test backend image. Never upload a device configuration here.
+async function main() {
+const endpoint = new URL(process.env.MMAPP_TEST_S3_ENDPOINT ?? '')
+assert.equal(endpoint.protocol, 'https:', 'Verified HTTPS endpoint required')
+assert(!endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash, 'Endpoint must not contain credentials or query parameters')
+assert.equal(process.env.MMAPP_TEST_S3_OWNED_SCOPE, 'yes', 'Explicit bucket/prefix authorization required')
+const bucket = process.env.MMAPP_TEST_S3_BUCKET
+assert(bucket && bucket.trim() === bucket, 'Explicit bucket required')
+const accessKeyId = process.env.MMAPP_TEST_S3_ACCESS_KEY, secretAccessKey = process.env.MMAPP_TEST_S3_SECRET_KEY
+assert(accessKeyId && secretAccessKey, 'Explicit test credentials required')
+const region = process.env.MMAPP_TEST_S3_REGION
+assert(region, 'Explicit region required')
+const pathStyle = process.env.MMAPP_TEST_S3_PATH_STYLE
+assert(['true', 'false'].includes(pathStyle), 'Explicit path-style choice required')
+const prefix = 'mmapp-acceptance/' + randomUUID()
+const keys = [prefix + '/probe-1.rsc', prefix + '/probe-2.rsc']
+if (process.env.MMAPP_TEST_S3_DRY_RUN === 'true') {
+  console.log(JSON.stringify({ dryRun: true, networkRequests: 0, plannedKeys: keys, deviceConfigurationUploads: 0 }))
+} else {
+  assert.equal(process.env.MMAPP_TEST_S3_RUN, 'confirmed', 'Explicit live execution required')
+  const output = process.env.MMAPP_TEST_REPORT
+  assert(output, 'Explicit report path required')
+  const { createS3ClientFromConfig, s3PutObject, s3GetObject, s3ListObjects, s3DeleteObject } = await import('/app/backend/dist/services/s3-backup-client.js')
+  const client = createS3ClientFromConfig({ endpoint: endpoint.toString(), region, bucket, prefix, accessKeyId, secretAccessKey, forcePathStyle: pathStyle === 'true' })
+  const report = { startedAt: new Date().toISOString(), scope: 'Compiled application S3 client; harmless synthetic bodies; dedicated UUID prefix', prefix, passed: false, checks: [], cleanup: [], deviceConfigurationUploads: 0, bounds: ['No application backup jobs, SQL catalog, native restore or UI acceptance', 'Cleanup covers current objects; retained versions/delete markers/retention policies are not inspected'] }
+  const attempted = []
+  report.plannedKeys = keys
+  report.attemptedKeys = attempted
+  const save = () => fs.writeFileSync(output, JSON.stringify(report, null, 2) + '\n')
+  const failure = error => ({ name: /^[\w:.-]+$/.test(error.name) ? error.name : 'Error', httpStatus: error.$metadata?.httpStatusCode ?? null })
+  const sha = bytes => createHash('sha256').update(bytes).digest('hex')
+  save()
+  try {
+    // An empty namespace is checked before recording ownership or attempting a write.
+    assert.equal((await s3ListObjects(client, bucket, prefix)).length, 0, 'Namespace already contains objects; no writes allowed')
+    report.checks.push({ operation: 'empty-prefix-preflight', passed: true }); save()
+    for (const key of keys) {
+      const body = Buffer.from('# MikroTik Manager owned S3 roundtrip probe\n# ' + key + '\n')
+      attempted.push(key); save()
+      await s3PutObject(client, bucket, key, body)
+      const received = await s3GetObject(client, bucket, key)
+      assert.equal(sha(received), sha(body), 'Object content mismatch')
+      report.checks.push({ operation: 'put-get-content', key, bytes: received.length, passed: true }); save()
+    }
+    const listed = (await s3ListObjects(client, bucket, prefix)).map(row => row.key).sort()
+    assert.deepEqual(listed, [...keys].sort(), 'Unexpected listing in owned namespace')
+    report.checks.push({ operation: 'list-exact-owned-keys', passed: true })
+    report.passed = true
+  } catch (error) { report.failure = failure(error) }
+  finally {
+    for (const key of attempted) {
+      try { await s3DeleteObject(client, bucket, key); report.cleanup.push({ key, acknowledged: true }) }
+      catch (error) { report.cleanup.push({ key, acknowledged: false, failure: failure(error) }); report.passed = false }
+    }
+    if (attempted.length) {
+      try {
+        const remaining = (await s3ListObjects(client, bucket, prefix)).filter(row => attempted.includes(row.key)).length
+        report.currentOwnedObjectsRemaining = remaining
+        if (remaining) report.passed = false
+      } catch (error) { report.cleanupReadbackFailure = failure(error); report.passed = false }
+    }
+    report.completedAt = new Date().toISOString(); save(); client.destroy()
+  }
+  console.log(JSON.stringify({ passed: report.passed, checks: report.checks.length, attemptedObjects: attempted.length, currentOwnedObjectsRemaining: report.currentOwnedObjectsRemaining ?? null }))
+  if (!report.passed) process.exitCode = 1
+}
+}
+await main().catch(error => {
+  const name = /^[\w:.-]+$/.test(error.name) ? error.name : 'Error'
+  console.error('S3_ACCEPTANCE_FAILED: ' + name)
+  process.exitCode = 1
+})