Files
meshcore-analyzer/cmd/server/notify_source_test.go
T
efitenandClaude Opus 5.5 de364a8bb6 feat: mail notifications for watched nodes (user management part E) (#2140)
Part E of #2128: a logged-in user watches nodes and gets one mail when a
watched node goes offline, comes back, or reports a low battery. Admins
can add instance events: a new foreign node, and an observer going
offline or back. This covers the per-user mail part of #775.

Stacked on #2139 (part D, which builds on #2138). Review the commits
after that branch.

## The situation

A sysop learns that a repeater went silent, or that its battery is
running down, only by opening CoreScope. #775 asks for notifications.
Accounts (part A) now give a verified address to mail and a mailer with
delivery status.

## What this PR adds

**Events.** They use the instance thresholds, so a mail does not
disagree with the node page:
- `node.offline`: silent for the role's `healthThresholds` window. Last
heard comes from the packet store, and repeaters and rooms count relayed
traffic (#1598).
- `node.battery`: advert telemetry below `batteryThresholds.lowMv`,
recovered at `lowMv + 100`.
- Admins only: `foreign.new` (once per node) and `observer.offline`.

**Store.** Schema v5 with `notification_prefs`, `notification_watches`
and `notification_state`.

**Server** (only with `userManagement.notifications.enabled`)
- A notifier next to the janitor, every `intervalMinutes` (5). The
evaluator is a pure function of watches, prefs, stored states and node
snapshots.
- No burst after a restart or a new watch: a subject's first evaluation
stores its state without mailing. The loop waits for the startup load.
While ingest is stale (newest packet older than 30 minutes) the offline
checks pause, and after recovery they wait one silent window.
- One mail per user per check. Limits: 20 per user and 100 per instance
per rolling 24 hours, 50 watches per user. A change over a limit is
recorded and never mailed later.
- Every mail has a one-click unsubscribe (`List-Unsubscribe` and
`List-Unsubscribe-Post`). The GET only redirects to a confirm page, so
link scanners cannot unsubscribe anyone. Node names are cleaned of
control and bidi characters before they go into a mail.
- Routes: `GET`/`PUT /api/account/notifications`, `PUT`/`DELETE
/api/account/notifications/watches/{pubkey}`, `POST
/api/account/notifications/watch-my-nodes` (copies the synced "my nodes"
list), `GET`/`POST /api/notifications/unsubscribe`. `mailer.Message`
gains `Headers`.

**Frontend.** A "Notify me" toggle on the node pages, a Notifications
section on the account page (`#/account?section=notifications`), an
unsubscribe page, and the notification mail count on the admin overview.

Spec:
[`docs/specs/2026-10-07-node-notifications-design.md`](https://github.com/efiten/CoreScope/blob/feat/notifications/docs/specs/2026-10-07-node-notifications-design.md).

## Performance

Each check reads watches, prefs and states from `users.db` (one query
each), the watched nodes from the analyzer DB in chunks of 500, and
last-heard times from the packet store.

| Measurement | Result |
|---|---|
| One check on our staging instance, 130,000 packets in memory, 1
watcher | 6.9 ms, of which 0.93 ms holding the store read lock |
| Evaluator benchmark, 100 users with 50 watches each, 2,000 nodes |
1.75 ms |

No work is added to ingest, broadcast or any request path.

## Verification

- `internal/users` and `internal/mailer` with `-race`; the `cmd/server`
suite plus `-race` on the notifier tests; 74 new Go tests. The same
Windows-only failure as noted in #2138 applies.
- `sh test-all.sh` exits 0; the XSS gate in diff mode passes.
- User-management E2E: 26 of 26 steps locally. With notifications off
the new steps fail, so they do test the flag.
- On our staging and production instance since 7 October 2026.

## Not in this PR

- Other channels (Discord, Telegram, webhooks). Detection is separate
from delivery, so one can be added.
- The topology, RF and anomaly alerts of #775.
- If the whole server starts after a feed outage that already ended, the
grace window is unknown and a watcher can get one wrong offline mail.
The user guide says so.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 22:02:39 +02:00

152 lines
5.4 KiB
Go

package main
import (
"fmt"
"testing"
"time"
)
func TestDBNotifyNodes(t *testing.T) {
db := setupTestDB(t)
for _, q := range []string{
fmt.Sprintf(`INSERT INTO nodes (public_key, name, role, last_seen, battery_mv, foreign_advert) VALUES ('%s', 'Alpha', 'repeater', '2026-10-07T11:00:00Z', 3712, 0)`, evPkA),
fmt.Sprintf(`INSERT INTO nodes (public_key, name, role, last_seen, foreign_advert) VALUES ('%s', NULL, 'companion', NULL, 0)`, evPkB),
fmt.Sprintf(`INSERT INTO nodes (public_key, name, role, last_seen, foreign_advert) VALUES ('%s', 'Foxtrot', 'repeater', '2026-10-07T10:00:00Z', 1)`, evPkF),
} {
if _, err := db.conn.Exec(q); err != nil {
t.Fatal(err)
}
}
got, err := db.NotifyNodes([]string{evPkA, evPkB, evPkG}, false)
if err != nil {
t.Fatal(err)
}
a, b := got[evPkA], got[evPkB]
if len(got) != 2 || a.Pubkey != evPkA || a.Name != "Alpha" || a.Role != "repeater" || a.LastSeen != "2026-10-07T11:00:00Z" ||
a.BatteryMv == nil || *a.BatteryMv != 3712 || a.Foreign {
t.Fatalf("NotifyNodes = %+v", got)
}
if b.Name != "" || b.LastSeen != "" || b.BatteryMv != nil {
t.Fatalf("NULL columns = %+v", b)
}
got, err = db.NotifyNodes([]string{evPkA}, true)
if err != nil || len(got) != 2 || !got[evPkF].Foreign || got[evPkF].Name != "Foxtrot" {
t.Fatalf("with foreign = %+v, %v", got, err)
}
if got, err := db.NotifyNodes(nil, false); err != nil || len(got) != 0 {
t.Fatalf("no keys = %+v, %v", got, err)
}
}
func TestDBNotifyNodesChunksLongLists(t *testing.T) {
db := setupTestDB(t)
keys := make([]string, 0, 1200)
for i := 0; i < 1200; i++ {
keys = append(keys, fmt.Sprintf("%064x", i))
}
for _, i := range []int{3, 600, 1199} {
if _, err := db.conn.Exec(`INSERT INTO nodes (public_key, role) VALUES (?, 'companion')`, keys[i]); err != nil {
t.Fatal(err)
}
}
got, err := db.NotifyNodes(keys, false)
if err != nil || len(got) != 3 {
t.Fatalf("1200 keys over %d-key chunks = %d nodes, %v; want 3", notifyNodeChunk, len(got), err)
}
}
func TestPacketStoreLastHeardMap(t *testing.T) {
s := &PacketStore{byNode: map[string][]*StoreTx{
evPkA: {{FirstSeen: "2026-10-07T10:00:00Z"}, {FirstSeen: "2026-10-07T11:30:00.000Z"}, nil, {FirstSeen: "2026-10-07T09:00:00Z"}},
evPkB: {{FirstSeen: "not a time"}},
}}
got, lock := s.LastHeardMap([]string{evPkA, evPkB, evPkF})
if len(got) != 1 || !got[evPkA].Equal(time.Date(2026, 10, 7, 11, 30, 0, 0, time.UTC)) {
t.Fatalf("LastHeardMap = %v", got)
}
if lock < 0 || lock > time.Second {
t.Fatalf("lock time = %v", lock)
}
}
// 5,000 watched nodes with 20 packets each, the spec's upper figure. Quote
// the result in the PR: this runs under the store's read lock.
func BenchmarkLastHeardMap(b *testing.B) {
s := &PacketStore{byNode: map[string][]*StoreTx{}}
keys := make([]string, 0, 5000)
for i := 0; i < 5000; i++ {
pk := fmt.Sprintf("%064x", i)
keys = append(keys, pk)
for j := 0; j < 20; j++ {
s.byNode[pk] = append(s.byNode[pk], &StoreTx{FirstSeen: evNow.Add(-time.Duration(j) * time.Minute).Format(time.RFC3339)})
}
}
b.ResetTimer()
for i := 0; i < b.N; i++ {
s.LastHeardMap(keys)
}
}
func TestRelayTimes(t *testing.T) {
m := map[string]RepeaterRelayInfo{
evPkA: {LastRelayed: "2026-10-07T11:00:00Z"},
evPkB: {},
}
got := relayTimes(m, []string{evPkA, evPkB, evPkF})
if len(got) != 1 || !got[evPkA].Equal(time.Date(2026, 10, 7, 11, 0, 0, 0, time.UTC)) {
t.Fatalf("relayTimes = %v", got)
}
}
func TestNotifyObserversFrom(t *testing.T) {
name, seen := "Roof", "2026-10-07T11:00:00Z"
got := notifyObserversFrom([]Observer{{ID: "OBS1", Name: &name, LastSeen: &seen}, {ID: "OBS2"}})
if len(got) != 2 || got[0] != (notifyObserver{ID: "OBS1", Name: "Roof", LastSeen: seen}) || got[1] != (notifyObserver{ID: "OBS2"}) {
t.Fatalf("notifyObserversFrom = %+v", got)
}
}
func TestServerNotifySourceWithoutStore(t *testing.T) {
src := serverNotifySource{s: &Server{cfg: &Config{}}}
if heard, lock := src.lastHeard([]string{evPkA}); len(heard) != 0 || lock != 0 || len(src.lastRelayed([]string{evPkA})) != 0 {
t.Fatal("a server without a packet store reported times")
}
if src.lowBatteryMv() != 3300 || src.health().InfraSilentHours != 72 {
t.Fatal("defaults not taken from the config")
}
}
// The startup load (hot window plus background fill) must be finished, not
// only /api/healthz readiness: readiness can be reached while the newest
// packets are still loading, which would mail "offline" then "back online".
func TestServerNotifySourceReadyWaitsForTheStartupLoad(t *testing.T) {
readiness.Store(1)
defer readiness.Store(0)
store := &PacketStore{clockSkew: &ClockSkewEngine{}}
src := serverNotifySource{s: &Server{cfg: &Config{}, store: store}}
if src.ready() {
t.Fatal("ready before the startup load finished")
}
store.signalStartupLoadDone()
if !src.ready() {
t.Fatal("not ready after readiness and the startup load")
}
readiness.Store(0)
if src.ready() {
t.Fatal("ready without readiness")
}
if (serverNotifySource{s: &Server{cfg: &Config{}}}).ready() {
t.Fatal("ready without a packet store")
}
}
func TestPacketStoreNewestFirstSeen(t *testing.T) {
if got := (&PacketStore{}).NewestFirstSeen(); !got.IsZero() {
t.Fatalf("empty store = %v", got)
}
s := &PacketStore{packets: []*StoreTx{{FirstSeen: "2026-10-07T10:00:00Z"}, {FirstSeen: "2026-10-07T11:30:00.000Z"}}}
if got := s.NewestFirstSeen(); !got.Equal(time.Date(2026, 10, 7, 11, 30, 0, 0, time.UTC)) {
t.Fatalf("NewestFirstSeen = %v", got)
}
}