danvics/zerobyte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(agent-backups): validate agent ownership

Browse source
This commit is contained in:
Nicolas Meienberger 2026-06-03 17:28:25 +02:00
parent a279129ad8
commit be3182793d
No known key found for this signature in database
2 changed files with 40 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
app/server/modules/agents/__tests__/agents-manager.events.test.ts
View file

@ -106,6 +106,41 @@ test("backup progress is delivered to the running backup callback", async () =>
await stopAgentController();
});
test("backup events from agents that do not own the active run are ignored", async () => {
resetAgentRuntime();
controllerMock.sendBackup.mockImplementation(() => Effect.succeed(true));
const { agentManager, startAgentController, stopAgentController } = await import("../agents-manager");
await startAgentController();
const resultPromise = agentManager.runBackup("local", {
scheduleId: 42,
payload: backupPayload,
signal: new AbortController().signal,
onProgress: vi.fn(),
});
controllerMock.onEvent?.({
type: "backup.completed",
agentId: "remote",
agentName: "Remote Agent",
payload: { jobId: "job-1", scheduleId: "schedule-1", exitCode: 0, result: null },
});
controllerMock.onEvent?.({
type: "backup.completed",
agentId: "local",
agentName: "Local Agent",
payload: { jobId: "job-1", scheduleId: "schedule-1", exitCode: 0, result: null },
});
await expect(resultPromise).resolves.toEqual({
status: "completed",
exitCode: 0,
result: null,
warningDetails: null,
});
await stopAgentController();
});
test("backup failed and cancelled events resolve the matching running backup", async () => {
resetAgentRuntime();
controllerMock.sendBackup.mockImplementation(() => Effect.succeed(true));

5
app/server/modules/agents/agents-manager.ts
View file

@ -152,6 +152,11 @@ const getActiveBackupRun = (jobId: string, scheduleId: string, eventName: string
return null;
}
if (activeBackupRun.agentId !== agentId) {
logger.warn(`Ignoring ${eventName} for job ${jobId} from unexpected agent ${agentId}`);
return null;
}
return activeBackupRun;
};