Remediate the 2026-09-03 feature-test findings

tests/test_plugins/test_backups.py

@@ -1525,3 +1525,142 @@ def test_secret_name_matching_covers_the_usual_spellings():
         assert issecretname(name), name
     for name in ('FtpUser', 'FMSHost', 'Retries', 'Passive'):
         assert not issecretname(name), name
+
+
+# --- "current" is per source chain, not per kind -----------------------------
+#
+# NTLARS settings describe a MACHINE but are read off the controlling PC, so a
+# machine with two reporting PCs has two independent chains of the same kind.
+# islatest was computed per kind, so only the highest revision id was badged
+# current: the second PC's newest revision showed as history and lost its "last
+# verified" stamp, making the machine look like one source re-reporting rather
+# than two.
+
+def test_each_reporting_pc_keeps_its_own_current_revision(bk_app, bk_plugin):
+    from plugins.backups.api.routes import _summary
+    from plugins.backups.models import BackupRevision
+
+    with bk_app.app_context():
+        # Two PCs reporting the same machine, each twice.
+        bk_plugin.apply_collector_payload(_payload())
+        changed = CONFIGUREDREG.replace('"Cnc"=""', '"Cnc"="OKUMA"')
+        bk_plugin.apply_collector_payload(_payload(reg=changed))
+        bk_plugin.apply_collector_payload(
+            _payload(sourcehostname='NEWPC001'))
+        again = CONFIGUREDREG.replace('"Cnc"=""', '"Cnc"="MAZAK"')
+        bk_plugin.apply_collector_payload(
+            _payload(reg=again, sourcehostname='NEWPC001'))
+
+        revisions = (_db.session.query(BackupRevision)
+                     .order_by(BackupRevision.backuprevisionid.desc()).all())
+        assert len(revisions) >= 4
+
+        # Mirror what the listing route does.
+        seen = set()
+        current = {}
+        for revision in revisions:
+            chain = (revision.backupkind,
+                     (revision.sourcehostname or '').strip().lower())
+            if chain not in seen:
+                seen.add(chain)
+                current[revision.sourcehostname] = revision.backuprevisionid
+
+        assert set(current) == {'GGBX0NH3ESF', 'NEWPC001'}, \
+            'each reporting PC has a current revision of its own'
+        assert _summary(revisions[0], islatest=True)['islatest'] is True
+
+
+# --- a diff has to be about ONE asset ---------------------------------------
+#
+# ?against=<id> accepted any revision id. Pointing it at another asset's
+# revision rendered that asset's configuration values as the "before" side of
+# this asset's history: a diff that reads as a change on this machine while
+# describing a different one. The default (no ?against) has always been
+# asset-scoped; only the explicit form was not.
+
+def _bk_admin_headers(bk_app):
+    """An admin in the BACKUPS app's own database.
+
+    The shared `client` fixture talks to the session app, which is a different
+    database entirely - a revision created through bk_plugin is invisible to
+    it, which is why a route test has to be driven from this app.
+    """
+    from werkzeug.security import generate_password_hash
+
+    from shopdb.core.models import Permission, Role, User
+
+    with bk_app.app_context():
+        Permission.seed()
+        user = User.query.filter_by(username='bkadmin').first()
+        if user is None:
+            admin = Role.query.filter_by(rolename='admin').first()
+            if admin is None:
+                admin = Role(rolename='admin', description='Admin')
+                _db.session.add(admin)
+                _db.session.flush()
+            admin.permissions = Permission.query.all()
+            user = User(username='bkadmin', email='bkadmin@test.local',
+                        passwordhash=generate_password_hash('bkpass123'),
+                        isactive=True)
+            user.roles = [admin]
+            _db.session.add(user)
+            _db.session.commit()
+
+    client = bk_app.test_client()
+    login = client.post('/api/auth/login',
+                        json={'username': 'bkadmin', 'password': 'bkpass123'})
+    assert login.status_code == 200, login.get_json()
+    token = login.get_json()['data']['access_token']
+    return client, {'Authorization': 'Bearer %s' % token}
+
+
+def test_a_diff_against_another_assets_revision_is_refused(bk_app, bk_plugin):
+    from shopdb.core.models import Asset, AssetType
+    from plugins.backups.models import BackupRevision
+
+    with bk_app.app_context():
+        bk_plugin.apply_collector_payload(_payload())
+        mine = (_db.session.query(BackupRevision)
+                .order_by(BackupRevision.backuprevisionid.desc()).first())
+
+        # A revision belonging to a different asset entirely.
+        assettype = AssetType.query.first() or AssetType(assettype='machine')
+        _db.session.add(assettype)
+        _db.session.flush()
+        other_asset = Asset(assetnumber='OTHER-ASSET-1',
+                            assettypeid=assettype.assettypeid)
+        _db.session.add(other_asset)
+        _db.session.flush()
+        theirs = BackupRevision(assetid=other_asset.assetid,
+                                backupkind=mine.backupkind,
+                                storagebackend='shopdb',
+                                contenthash='a' * 64)
+        theirs.payload = {'schema': ntlars.SCHEMA, 'keys': []}
+        _db.session.add(theirs)
+        _db.session.commit()
+        mineid, theirsid = mine.backuprevisionid, theirs.backuprevisionid
+
+    client, headers = _bk_admin_headers(bk_app)
+    refused = client.get('/api/backups/revisions/%d/diff?against=%d'
+                         % (mineid, theirsid), headers=headers)
+    assert refused.status_code == 400, refused.get_json()
+    assert 'different asset' in refused.get_json()['data']['error']['message']
+
+
+def test_a_diff_against_a_sibling_revision_still_works(bk_app, bk_plugin):
+    """Scoping it must not break the case the feature exists for."""
+    from plugins.backups.models import BackupRevision
+
+    with bk_app.app_context():
+        bk_plugin.apply_collector_payload(_payload())
+        changed = CONFIGUREDREG.replace('"Cnc"=""', '"Cnc"="OKUMA"')
+        bk_plugin.apply_collector_payload(_payload(reg=changed))
+        _db.session.commit()
+        rows = (_db.session.query(BackupRevision)
+                .order_by(BackupRevision.backuprevisionid.desc()).limit(2).all())
+        newer, older = rows[0].backuprevisionid, rows[1].backuprevisionid
+
+    client, headers = _bk_admin_headers(bk_app)
+    allowed = client.get('/api/backups/revisions/%d/diff?against=%d'
+                         % (newer, older), headers=headers)
+    assert allowed.status_code == 200, allowed.get_json()