feat(httpapi): harden control plane and speed up prefix refresh

Очередь job получила lease и fencing, телеметрия и прогресс deploy сохраняются, ревизия пишет manifest входов. Обновление префиксов не переписывает неизменённый снимок, большие наборы идут через COPY, а устаревшая ревизия не попадает в deploy. Бандл ноды кэшируется, prune и постановка job больше не держат горячий путь.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/nodedispatch/bird.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"evobgp/internal/birdfmt"
+	"evobgp/internal/httpclient"
 	"evobgp/internal/store"
 )
 
@@ -52,11 +53,16 @@ func FetchBirdProtocols(ctx context.Context, sp *store.Speaker, opts Options) Bi
 		return res
 	}
 	defer func() { _ = resp.Body.Close() }()
-	b, _ := io.ReadAll(resp.Body)
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<10))
 		res.Error = fmt.Sprintf("HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(b)))
 		return res
 	}
+	b, err := httpclient.ReadResponseBody(resp, 8<<20)
+	if err != nil {
+		res.Error = err.Error()
+		return res
+	}
 	var out struct {
 		Sessions []birdfmt.BGPSession `json:"sessions"`
 	}

internal/nodedispatch/dispatch.go

@@ -20,6 +20,7 @@ type Result struct {
 	SpeakerID         string `json:"speaker_id"`
 	Endpoint          string `json:"endpoint,omitempty"`
 	Status            string `json:"status"`
+	Confirmation      string `json:"confirmation,omitempty"`
 	AppliedRevisionID string `json:"applied_revision_id,omitempty"`
 	Error             string `json:"error,omitempty"`
 }
@@ -62,12 +63,13 @@ func Enabled() bool {
 
 // WakeSpeaker POSTs /v1/agent/sync to a replica agent (HTTPS via Traefik).
 func WakeSpeaker(ctx context.Context, sp *store.Speaker, opts Options) Result {
-	res := Result{SpeakerID: sp.ID}
+	res := Result{}
 	if sp == nil {
 		res.Status = "error"
 		res.Error = "nil speaker"
 		return res
 	}
+	res.SpeakerID = sp.ID
 	meta := store.ParseSpeakerMeta(sp.MetaJSON)
 	url := store.AgentSyncURL(meta)
 	if url == "" {
@@ -117,13 +119,31 @@ func WakeSpeaker(ctx context.Context, sp *store.Speaker, opts Options) Result {
 		_ = resp.Body.Close()
 		if resp.StatusCode >= 200 && resp.StatusCode < 300 {
 			var out struct {
+				OK                *bool  `json:"ok"`
 				AppliedRevisionID string `json:"applied_revision_id"`
+				Error             string `json:"error"`
+			}
+			if len(bytes.TrimSpace(b)) > 0 {
+				if err := json.Unmarshal(b, &out); err != nil {
+					res.Status = "error"
+					res.Error = "invalid agent sync response"
+					return res
+				}
+			}
+			if (out.OK != nil && !*out.OK) || strings.TrimSpace(out.Error) != "" {
+				res.Status = "error"
+				res.Error = strings.TrimSpace(out.Error)
+				if res.Error == "" {
+					res.Error = "agent sync reported failure"
+				}
+				return res
 			}
-			_ = json.Unmarshal(b, &out)
 			res.Status = "ok"
 			res.AppliedRevisionID = strings.TrimSpace(out.AppliedRevisionID)
-			if res.AppliedRevisionID == "" {
-				res.AppliedRevisionID = strings.TrimSpace(opts.RevisionID)
+			if res.AppliedRevisionID != "" {
+				res.Confirmation = "agent_reported"
+			} else {
+				res.Confirmation = "unconfirmed"
 			}
 			return res
 		}

internal/nodedispatch/health.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"strings"
 
+	"evobgp/internal/httpclient"
 	"evobgp/internal/store"
 )
 
@@ -43,12 +44,16 @@ func FetchAgentHealth(ctx context.Context, sp *store.Speaker, opts Options) Agen
 		return AgentHealthResult{Error: err.Error()}
 	}
 	defer func() { _ = resp.Body.Close() }()
-	b, _ := io.ReadAll(resp.Body)
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<10))
 		return AgentHealthResult{
 			Error: fmt.Sprintf("HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(b))),
 		}
 	}
+	b, err := httpclient.ReadResponseBody(resp, 64<<10)
+	if err != nil {
+		return AgentHealthResult{Error: err.Error()}
+	}
 	var out struct {
 		OK                    bool   `json:"ok"`
 		LastAppliedRevisionID string `json:"last_applied_revision_id"`

internal/nodedispatch/legacy_agent_binary_test.go

@@ -0,0 +1,223 @@
+package nodedispatch_test
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"evobgp/internal/bundle"
+	"evobgp/internal/nodedispatch"
+	"evobgp/internal/store"
+)
+
+func TestMain(m *testing.M) {
+	if os.Getenv("EVOBGP_TEST_LEGACY_BIRD_HELPER") != "1" {
+		os.Exit(m.Run())
+	}
+	args := os.Args[1:]
+	log, err := os.OpenFile(os.Getenv("EVOBGP_TEST_BIRD_LOG"), os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
+	if err != nil {
+		os.Exit(2)
+	}
+	_, _ = fmt.Fprintln(log, strings.Join(args, " "))
+	_ = log.Close()
+	switch {
+	case len(args) == 3 && args[0] == "-c" && args[2] == "-p":
+		if _, err := os.Stat(args[1]); err == nil {
+			os.Exit(0)
+		}
+	case len(args) == 3 && args[0] == "-s" && args[2] == "configure":
+		os.Exit(0)
+	case len(args) == 5 && args[0] == "-s" && strings.Join(args[2:], " ") == "show protocols all":
+		fmt.Println("peer_test BGP master up 2026-01-01 Established")
+		os.Exit(0)
+	}
+	os.Exit(2)
+}
+
+// TestLegacyAgentBinaryCurrentDispatch runs the historical agent as a separate
+// process. All network traffic stays on loopback and BIRD executables are fakes.
+func TestLegacyAgentBinaryCurrentDispatch(t *testing.T) {
+	binary := os.Getenv("EVOBGP_TEST_LEGACY_AGENT_BIN")
+	if binary == "" {
+		t.Skip("EVOBGP_TEST_LEGACY_AGENT_BIN not set")
+	}
+	binary, err := filepath.Abs(binary)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(binary); err != nil {
+		t.Fatal(err)
+	}
+	const speakerID = "legacy-speaker"
+	const revisionID = "legacy-revision"
+	const nodeToken = "local-node-token"
+	const agentSecret = "local-agent-secret"
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	archive, err := bundle.BuildGzippedTar(revisionID, speakerID, map[string]string{
+		"bird.conf": "router id 192.0.2.1;\n",
+	}, priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var bundleGets atomic.Int32
+	controlPlane := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "Bearer "+nodeToken {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		switch r.URL.Path {
+		case "/v1/speakers/" + speakerID + "/bundle/" + revisionID:
+			bundleGets.Add(1)
+			w.Header().Set("Content-Type", "application/gzip")
+			_, _ = w.Write(archive)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer controlPlane.Close()
+
+	root := t.TempDir()
+	logPath := filepath.Join(root, "bird-invocations")
+	helper, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	agentAddr := listener.Addr().String()
+	_ = listener.Close()
+	outputPath := filepath.Join(root, "agent.log")
+	output, err := os.Create(outputPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = output.Close() }()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	cmd := exec.CommandContext(ctx, binary, "-listen", agentAddr, "serve")
+	cmd.Stdout, cmd.Stderr = output, output
+	cmd.Env = append(os.Environ(),
+		"EVOBGP_AGENT_SECRET="+agentSecret,
+		"EVOBGP_CONTROL_PLANE_URL="+controlPlane.URL,
+		"EVOBGP_NODE_TOKEN="+nodeToken,
+		"EVOBGP_SPEAKER_ID="+speakerID,
+		"EVOBGP_BUNDLE_PUBKEY_BASE64="+base64.StdEncoding.EncodeToString(pub),
+		"EVOBGP_BIRD_EXTRACT_DIR="+filepath.Join(root, "extract"),
+		"EVOBGP_BIRD_BIN="+helper,
+		"EVOBGP_BIRDC_BIN="+helper,
+		"EVOBGP_BIRDC_SOCKET="+filepath.Join(root, "fake.ctl"),
+		"EVOBGP_TEST_LEGACY_BIRD_HELPER=1",
+		"EVOBGP_TEST_BIRD_LOG="+logPath,
+		"TMPDIR="+root,
+		"TMP="+root,
+		"TEMP="+root,
+	)
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		cancel()
+		_ = cmd.Wait()
+	}()
+
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	// Under -race each helper process can spend a second flushing race output at
+	// exit. Sync executes parse-check and configure before returning its ACK.
+	client := &http.Client{Timeout: 10 * time.Second, Transport: legacyAgentTransport{addr: agentAddr, base: transport}}
+	defer transport.CloseIdleConnections()
+	sp := &store.Speaker{ID: speakerID, Role: "replica", MetaJSON: store.SpeakerMetaJSON(store.SpeakerMeta{
+		AgentDomain: "legacy-agent.example.test", AgentSecret: agentSecret,
+	})}
+	deadline := time.Now().Add(10 * time.Second)
+	for {
+		health := nodedispatch.FetchAgentHealth(context.Background(), sp, nodedispatch.Options{HTTPClient: client})
+		if health.OK {
+			if health.LastAppliedRevisionID != "" {
+				t.Fatalf("initial health has applied revision: %+v", health)
+			}
+			break
+		}
+		if time.Now().After(deadline) {
+			log, _ := os.ReadFile(outputPath)
+			t.Fatalf("legacy agent did not become healthy: %+v; output: %s", health, log)
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+
+	// The historical agent must enforce the bearer token before reaching sync.
+	badReq, err := http.NewRequest(http.MethodPost, "https://legacy-agent.example.test/v1/agent/sync", strings.NewReader(`{"revision_id":"legacy-revision"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	badReq.Header.Set("Authorization", "Bearer wrong-secret")
+	badResp, err := client.Do(badReq)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = badResp.Body.Close()
+	if badResp.StatusCode != http.StatusUnauthorized || bundleGets.Load() != 0 {
+		t.Fatalf("unauthorized sync: status=%d bundle_gets=%d", badResp.StatusCode, bundleGets.Load())
+	}
+
+	result := nodedispatch.WakeSpeaker(context.Background(), sp, nodedispatch.Options{
+		HTTPClient: client, MaxRetries: 1, RevisionID: revisionID,
+	})
+	if result.Status != "ok" || result.Confirmation != "agent_reported" || result.AppliedRevisionID != revisionID {
+		log, _ := os.ReadFile(outputPath)
+		t.Fatalf("current dispatch to legacy agent: %+v; output: %s", result, log)
+	}
+	if bundleGets.Load() != 1 {
+		t.Fatalf("signed bundle gets = %d, want 1", bundleGets.Load())
+	}
+	health := nodedispatch.FetchAgentHealth(context.Background(), sp, nodedispatch.Options{HTTPClient: client})
+	if !health.OK || health.LastAppliedRevisionID != revisionID || health.LastSyncAt == "" {
+		t.Fatalf("post-sync legacy health: %+v", health)
+	}
+	protocols := nodedispatch.FetchBirdProtocols(context.Background(), sp, nodedispatch.Options{HTTPClient: client})
+	if protocols.Error != "" || len(protocols.Sessions) != 1 || protocols.Sessions[0].State != "Established" {
+		t.Fatalf("legacy bird protocols: %+v", protocols)
+	}
+	mainConfig, err := os.ReadFile(filepath.Join(root, "extract", "bird.conf"))
+	if err != nil || string(mainConfig) != "router id 192.0.2.1;\n" {
+		t.Fatalf("extracted signed bundle: content=%q err=%v", mainConfig, err)
+	}
+	invocations, err := os.ReadFile(logPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantParse := fmt.Sprintf("-c %s -p", filepath.Join(root, "extract", "bird.conf"))
+	if !strings.Contains(string(invocations), wantParse) || !strings.Contains(string(invocations), "-s "+filepath.Join(root, "fake.ctl")+" configure") {
+		t.Fatalf("legacy agent did not parse-check and configure via stand-ins: %s", invocations)
+	}
+}
+
+type legacyAgentTransport struct {
+	addr string
+	base http.RoundTripper
+}
+
+func (tr legacyAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	copyReq := req.Clone(req.Context())
+	copyReq.URL.Scheme = "http"
+	copyReq.URL.Host = tr.addr
+	copyReq.Host = tr.addr
+	return tr.base.RoundTrip(copyReq)
+}

internal/nodedispatch/legacy_compatibility_test.go

@@ -0,0 +1,106 @@
+package nodedispatch_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"reflect"
+	"strings"
+	"testing"
+
+	"evobgp/internal/nodedispatch"
+	"evobgp/internal/store"
+)
+
+type legacyRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f legacyRoundTripFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
+
+func TestLegacyCompatibilityAgentSync(t *testing.T) {
+	for _, tc := range []struct {
+		name, response, wantApplied string
+		status                      int
+	}{
+		{"legacy bare success", `{"ok":true}`, "", http.StatusOK},
+		{"legacy empty no-content", "", "", http.StatusNoContent},
+		{"legacy explicit revision", `{"ok":true,"applied_revision_id":"revision-1"}`, "revision-1", http.StatusOK},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var gotAuth, gotType string
+			var gotBody map[string]json.RawMessage
+			client := &http.Client{Transport: legacyRoundTripFunc(func(r *http.Request) (*http.Response, error) {
+				if r.Method != http.MethodPost || r.URL.Path != "/v1/agent/sync" {
+					t.Errorf("unexpected sync request: %s %s", r.Method, r.URL)
+				}
+				gotAuth, gotType = r.Header.Get("Authorization"), r.Header.Get("Content-Type")
+				body, _ := io.ReadAll(r.Body)
+				if err := json.Unmarshal(body, &gotBody); err != nil {
+					t.Errorf("sync JSON: %v", err)
+				}
+				return &http.Response{StatusCode: tc.status, Body: io.NopCloser(strings.NewReader(tc.response)), Header: make(http.Header)}, nil
+			})}
+			sp := &store.Speaker{ID: "speaker-1", Role: "replica", MetaJSON: store.SpeakerMetaJSON(store.SpeakerMeta{
+				AgentDomain: "agent.example.test", AgentSecret: "legacy-secret",
+			})}
+			got := nodedispatch.WakeSpeaker(context.Background(), sp, nodedispatch.Options{HTTPClient: client, MaxRetries: 1, RevisionID: "revision-1"})
+			if got.Status != "ok" || got.AppliedRevisionID != tc.wantApplied {
+				t.Fatalf("sync result: %+v", got)
+			}
+			wantConfirmation := "unconfirmed"
+			if tc.wantApplied != "" {
+				wantConfirmation = "agent_reported"
+			}
+			if got.Confirmation != wantConfirmation {
+				t.Fatalf("confirmation = %q, want %q", got.Confirmation, wantConfirmation)
+			}
+			if gotAuth != "Bearer legacy-secret" || gotType != "application/json" {
+				t.Fatalf("legacy headers: authorization=%q content-type=%q", gotAuth, gotType)
+			}
+			if !reflect.DeepEqual(gotBody, map[string]json.RawMessage{"revision_id": json.RawMessage(`"revision-1"`)}) {
+				t.Fatalf("unexpected fields sent to strict legacy decoder: %s", gotBody)
+			}
+		})
+	}
+}
+
+func TestAgentSyncRejectsMalformedSuccess(t *testing.T) {
+	for _, response := range []string{`{"ok":false}`, `{"ok":true`, `{"ok":false,"applied_revision_id":"revision-1"}`} {
+		t.Run(response, func(t *testing.T) {
+			client := &http.Client{Transport: legacyRoundTripFunc(func(*http.Request) (*http.Response, error) {
+				return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(response)), Header: make(http.Header)}, nil
+			})}
+			sp := &store.Speaker{ID: "speaker-1", Role: "replica", MetaJSON: store.SpeakerMetaJSON(store.SpeakerMeta{AgentDomain: "agent.example.test", AgentSecret: "secret"})}
+			got := nodedispatch.WakeSpeaker(context.Background(), sp, nodedispatch.Options{HTTPClient: client, MaxRetries: 1, RevisionID: "revision-1"})
+			if got.Status != "error" || got.AppliedRevisionID != "" {
+				t.Fatalf("invalid 2xx response accepted: %+v", got)
+			}
+		})
+	}
+}
+
+func TestLegacyCompatibilityAgentHealthMissingNewFields(t *testing.T) {
+	for _, tc := range []struct {
+		name, body, wantRevision, wantSync string
+	}{
+		{"bare legacy health", `{"ok":true}`, "", ""},
+		{"revision without time", `{"ok":true,"last_applied_revision_id":"revision-1"}`, "revision-1", ""},
+		{"revision with time", `{"ok":true,"last_applied_revision_id":"revision-1","last_sync_at":"2026-10-26T00:00:00Z"}`, "revision-1", "2026-10-26T00:00:00Z"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			client := &http.Client{Transport: legacyRoundTripFunc(func(r *http.Request) (*http.Response, error) {
+				if r.Method != http.MethodGet || r.URL.Path != "/v1/agent/health" || r.Header.Get("Authorization") != "Bearer legacy-secret" {
+					t.Errorf("unexpected health request: %s %s", r.Method, r.URL)
+				}
+				return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(tc.body)), Header: make(http.Header)}, nil
+			})}
+			sp := &store.Speaker{ID: "speaker-1", MetaJSON: store.SpeakerMetaJSON(store.SpeakerMeta{
+				AgentDomain: "agent.example.test", AgentSecret: "legacy-secret",
+			})}
+			got := nodedispatch.FetchAgentHealth(context.Background(), sp, nodedispatch.Options{HTTPClient: client})
+			if !got.OK || got.Error != "" || got.LastAppliedRevisionID != tc.wantRevision || got.LastSyncAt != tc.wantSync {
+				t.Fatalf("legacy health: %+v", got)
+			}
+		})
+	}
+}

internal/nodedispatch/telemetry_limits_test.go

@@ -0,0 +1,80 @@
+package nodedispatch_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"evobgp/internal/nodedispatch"
+	"evobgp/internal/store"
+)
+
+type telemetryTestBody struct {
+	io.Reader
+	read   int
+	closed bool
+}
+
+func (b *telemetryTestBody) Read(p []byte) (int, error) {
+	n, err := b.Reader.Read(p)
+	b.read += n
+	return n, err
+}
+func (b *telemetryTestBody) Close() error { b.closed = true; return nil }
+
+type telemetryErrorReader struct{}
+
+func (telemetryErrorReader) Read([]byte) (int, error) { return 0, errors.New("injected body failure") }
+
+func TestAgentTelemetryCompleteBodyLimits(t *testing.T) {
+	sp := &store.Speaker{ID: "legacy", Role: "replica", MetaJSON: store.SpeakerMetaJSON(store.SpeakerMeta{AgentDomain: "agent.example.test", AgentSecret: "secret"})}
+	for _, tc := range []struct {
+		name, prefix string
+		limit        int
+		call         func(nodedispatch.Options) string
+	}{
+		{"health", `{"ok":true}`, 64 << 10, func(opts nodedispatch.Options) string {
+			return nodedispatch.FetchAgentHealth(context.Background(), sp, opts).Error
+		}},
+		{"protocols", `{"sessions":[]}`, 8 << 20, func(opts nodedispatch.Options) string {
+			return nodedispatch.FetchBirdProtocols(context.Background(), sp, opts).Error
+		}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			for _, known := range []bool{true, false} {
+				for _, extra := range []int{0, 1} {
+					data := tc.prefix + strings.Repeat(" ", tc.limit-len(tc.prefix)+extra)
+					body := &telemetryTestBody{Reader: strings.NewReader(data)}
+					client := &http.Client{Transport: legacyRoundTripFunc(func(*http.Request) (*http.Response, error) {
+						length := int64(-1)
+						if known {
+							length = int64(len(data))
+						}
+						return &http.Response{StatusCode: 200, ContentLength: length, Body: body, Header: make(http.Header)}, nil
+					})}
+					err := tc.call(nodedispatch.Options{HTTPClient: client})
+					if (extra == 0 && err != "") || (extra == 1 && err == "") || body.read > tc.limit+1 || !body.closed {
+						t.Fatalf("known=%v extra=%d read=%d closed=%v error=%s", known, extra, body.read, body.closed, err)
+					}
+				}
+			}
+			for _, status := range []int{200, 400} {
+				reader := io.MultiReader(strings.NewReader(tc.prefix), telemetryErrorReader{})
+				if status == 400 {
+					reader = io.MultiReader(strings.NewReader(strings.Repeat("x", 16000)))
+				}
+				body := &telemetryTestBody{Reader: reader}
+				client := &http.Client{Transport: legacyRoundTripFunc(func(*http.Request) (*http.Response, error) {
+					return &http.Response{StatusCode: status, ContentLength: -1, Body: body, Header: make(http.Header)}, nil
+				})}
+				err := tc.call(nodedispatch.Options{HTTPClient: client})
+				if err == "" || !body.closed || (status == 400 && body.read > 4<<10) {
+					t.Fatalf("status=%d read=%d closed=%v error=%s", status, body.read, body.closed, err)
+				}
+			}
+		})
+	}
+}