fix(ui): исключить конфликты восстановления Firewall

tests/e2e/firewall-history-lock.spec.ts

@@ -0,0 +1,75 @@
+import { test, expect } from "@playwright/test"
+
+test("Firewall: восстановление удерживает общий замок до обновления правил и истории", async ({ page }) => {
+  let attempts = 0
+  let revisionsReads = 0
+  let writes = 0
+  let release: (() => void) | undefined
+  let releaseRead: (() => void) | undefined
+  let releaseHistory: (() => void) | undefined
+  const gate = new Promise<void>(resolve => { release = resolve })
+  const readGate = new Promise<void>(resolve => { releaseRead = resolve })
+  const historyGate = new Promise<void>(resolve => { releaseHistory = resolve })
+  const rule = { id: "rule-1", rosId: "*R/1", serverId: "1", serverName: "Роутер", family: "ip", table: "filter", chain: "forward", action: "accept", proto: "tcp", src: "", dst: "", port: "443", iface: "", comment: "Правило тест", enabled: true, hits: 1 }
+  await page.route("**/health", route => route.fulfill({ json: { ok: true } }))
+  await page.route("**/api/**", async route => {
+    const path = new URL(route.request().url()).pathname
+    if (path.endsWith("/restore")) {
+      attempts++
+      expect(decodeURIComponent(path)).toBe("/api/firewall/revisions/rev/1/restore")
+      expect(route.request().postDataJSON()).toEqual({ serverId: "1" })
+      if (attempts === 1) { await gate; return route.fulfill({ status: 403, json: { error: "Восстановление запрещено тест" } }) }
+      return route.fulfill({ json: { ok: true } })
+    }
+    if (route.request().method() !== "GET") { writes++; return route.fulfill({ json: { ok: true } }) }
+    if (path === "/api/firewall/all" && attempts === 2) await readGate
+    if (path.endsWith("/revisions")) {
+      revisionsReads++
+      if (revisionsReads === 2) await historyGate
+    }
+    return route.fulfill({ json: path === "/api/auth/config" ? { required: false }
+      : path === "/api/firewall/all" ? { rules: [rule], addressLists: [] }
+      : path.endsWith("/revisions") ? { revisions: [{ id: "rev/1", serverId: "1", section: "firewall", source: "apply", fingerprint: "fixture", createdAt: "2026-09-29T00:00:00Z", note: null, itemCount: 1 }] }
+      : path === "/api/servers" ? [{ id: 1, name: "Роутер", host: "192.0.2.1", type: "exit-node", enabled: true, country: "RU", status: "online" }] : {} })
+  })
+  await page.goto("/firewall?server=1")
+  await expect(page.locator("tr[data-row-id]")).toHaveCount(1)
+  await page.getByRole("button", { name: "История", exact: true }).click()
+  const sheet = page.getByRole("dialog")
+  await sheet.getByRole("button", { name: "Откатить", exact: true }).click()
+  const dialog = page.getByRole("alertdialog")
+  const restore = dialog.getByRole("button", { name: "Откатить", exact: true })
+  await restore.evaluate(button => { (button as HTMLButtonElement).click(); (button as HTMLButtonElement).click() })
+  await expect.poll(() => attempts).toBe(1)
+  const locked = async () => {
+    await expect(page.locator("tr[data-row-id]").getByRole("switch", { includeHidden: true })).toBeDisabled()
+    await expect(page.getByRole("button", { name: "Обновить", exact: true, includeHidden: true })).toBeDisabled()
+    await expect(page.getByRole("button", { name: "История", exact: true, includeHidden: true })).toBeDisabled()
+    await expect(dialog.getByRole("button", { name: "Отмена" })).toBeDisabled()
+  }
+  await locked()
+  // Проверяем защиту обработчика открытия формы даже при программном клике за модальным слоем.
+  await page.getByRole("button", { name: "Новое правило", exact: true, includeHidden: true }).evaluate(button => (button as HTMLButtonElement).click())
+  expect(writes).toBe(0)
+  await page.keyboard.press("Escape")
+  await expect(dialog).toBeVisible()
+  release!()
+  await expect(dialog.getByRole("alert").filter({ hasText: "Восстановление запрещено тест" })).toBeVisible()
+  await expect(page.locator("tr[data-row-id]").getByRole("switch", { includeHidden: true })).toBeEnabled()
+  await restore.click()
+  await expect.poll(() => attempts).toBe(2)
+  await locked()
+  releaseRead!()
+  await expect.poll(() => revisionsReads).toBe(2)
+  await locked()
+  releaseHistory!()
+  await expect(dialog).toHaveCount(0)
+  await page.keyboard.press("Escape")
+  await expect(sheet).toHaveCount(0)
+  await expect(page.getByRole("button", { name: "Обновить", exact: true })).toBeEnabled()
+  await page.getByRole("button", { name: "Действия: forward accept", exact: true }).click()
+  await page.getByRole("menuitem", { name: "Редактировать", exact: true }).click()
+  await page.getByRole("dialog").getByRole("button", { name: "Сохранить", exact: true }).click()
+  await expect.poll(() => writes).toBe(1)
+  await expect(page.getByRole("dialog")).toHaveCount(0)
+})

tests/e2e/firewall-move.spec.ts

@@ -47,6 +47,8 @@ for (const direction of ["down", "up"] as const) {
     await expect.poll(() => attempts).toBe(1)
     const waiting = page.getByRole("status").filter({ hasText: "Ожидание перемещения правила" })
     await expect(waiting).toBeVisible()
+    await expect(page.getByRole("button", { name: "История", exact: true })).toBeDisabled()
+    await expect(page.getByRole("button", { name: "Обновить", exact: true })).toBeDisabled()
     await expect(page.getByRole("button", { name: "Перетащите для изменения порядка строк", exact: true })).toHaveCount(0)
     for (const toggle of await rows.getByRole("switch").all()) await expect(toggle).toBeDisabled()
     await rows.first().getByRole("button", { name: "Действия: forward accept", exact: true }).click()