Two independent adversarial reviews (codex CLI + a 6-dimension verification workflow) of the delivery-hardening branch surfaced ~40 findings; this closes the confirmed correctness/security/deploy blockers plus a codex re-review pass. edge: - geometry: track_displacement per-second threshold recalibrated (0.02->0.25, env-tunable via MOTION_THR, validated finite/positive); confidence-filter keypoints with a bbox-center fallback so hallucinated points don't fake motion - fall: low-confidence frames no longer cancel an active FALLING/FALLEN incident (freeze + reset recovery timer so recovery needs a fresh confident streak); baseline height only seeded from trusted frames - queue: PostClient.send() returns a tri-state SendResult; only definite 4xx count toward the poison drop cap, so a network outage (incl. 408/425/429/5xx) never deletes queued safety events; legacy rows persist their minted uuid - config: reject placeholder / http / short DEVICE_SECRET at startup - zones: warn+skip legacy pixel-space polygons that would silently match nothing cloud: - zone endpoints wired into P3-2b site-scope (cross-site read/write/delete closed) + role gate on list; catch narrowed so DB faults surface as 500 - snapshot purge keeps the DB row when unlink() fails (no untrackable PIPA orphan) - ingest dedup path re-stores missing snapshots (+ short-write guard); UNIQUE (event_id, content_hash) makes recovery idempotent under retry/race - event list cursor carries full-precision occurred_at (no float rounding at the page boundary); string keyset end-to-end - SiteScope '' fails closed (only NULL is global); dashboard fetches full page cap - runnable migration (site/event_uuid + backfill ordering + indexes); rate-limit reap fails open deploy: - offline bundle hashes EVERY file (fatal on missing/failed/injected; models in SBOM; arch in tarball name; REQUIRE_SIGNATURE option) - installer verifies before any mutation, Hailo arch preflight before install, atomic src swap, backend reconcile preserves a working operator choice - systemd DeviceAllow=char-dma_heap (the /dev/dma_heap/ dir form was inert) Verified: edge pytest 165 passed / 2 skipped; cloud phpunit 109 passed / 4 skipped; deploy scripts bash -n clean. Reviewed by codex twice (findings + fixes) with the second-pass findings folded in.
102 lines
6.4 KiB
PHP
102 lines
6.4 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests\Support;
|
|
use App\Repository\{DeviceRepository, NonceRepository, RateLimiterRepository,
|
|
EventRepository, SnapshotRepository, UserRepository, ZoneRepository,
|
|
ThresholdRepository, AuditRepository};
|
|
|
|
final class InMemoryDeviceRepository implements DeviceRepository {
|
|
public array $heartbeats = [];
|
|
public function __construct(private array $secrets = [], private array $versions = [],
|
|
private array $sites = []) {}
|
|
public function secretFor(string $d): ?string { return $this->secrets[$d] ?? null; }
|
|
public function siteFor(string $d): ?string { return $this->sites[$d] ?? null; }
|
|
public function touchHeartbeat(string $d, array $m): void { $this->heartbeats[$d] = $m; }
|
|
public function configVersion(string $d): int { return $this->versions[$d] ?? 1; }
|
|
}
|
|
final class InMemoryNonceRepository implements NonceRepository {
|
|
public array $store = [];
|
|
public function seen(string $n): bool { return isset($this->store[$n]); }
|
|
public function remember(string $n, int $exp): void { $this->store[$n] = $exp; }
|
|
}
|
|
final class InMemoryRateLimiter implements RateLimiterRepository {
|
|
public array $counts = [];
|
|
public function hit(string $k, int $w): int { $key = "$k:$w"; return $this->counts[$key] = ($this->counts[$key] ?? 0) + 1; }
|
|
}
|
|
final class InMemoryEventRepository implements EventRepository {
|
|
public array $rows = []; private int $seq = 0;
|
|
public function insert(array $e): int { $id = ++$this->seq; $this->rows[$id] = $e + ['event_id' => $id, 'acknowledged_by' => null]; return $id; }
|
|
public function idByUuid(string $uuid): ?int {
|
|
foreach ($this->rows as $id => $r) if (($r['event_uuid'] ?? null) === $uuid) return (int)$id;
|
|
return null;
|
|
}
|
|
public function recent(int $limit, ?string $sev): array {
|
|
$r = array_reverse($this->rows, true);
|
|
if ($sev !== null) $r = array_filter($r, fn($x) => $x['severity'] === $sev);
|
|
return array_slice(array_values($r), 0, $limit);
|
|
}
|
|
public function page(int $limit, ?string $sev, ?string $beforeTs, ?int $beforeId, ?string $site = null): array {
|
|
$r = array_values($this->rows);
|
|
if ($sev !== null) $r = array_filter($r, fn($x) => $x['severity'] === $sev);
|
|
if ($site !== null) $r = array_filter($r, fn($x) => ($x['site'] ?? null) === $site);
|
|
// (occurred_at DESC, event_id DESC); events inserted without occurred_at sort as 0.
|
|
usort($r, fn($a, $b) => [$b['occurred_at'] ?? 0, $b['event_id']] <=> [$a['occurred_at'] ?? 0, $a['event_id']]);
|
|
if ($beforeTs !== null && $beforeId !== null) {
|
|
$bt = (float)$beforeTs; // cursor carries occurred_at as a string; compare numerically
|
|
$r = array_filter($r, fn($x) => ($x['occurred_at'] ?? 0) < $bt
|
|
|| (($x['occurred_at'] ?? 0) == $bt && $x['event_id'] < $beforeId));
|
|
}
|
|
return array_slice(array_values($r), 0, $limit);
|
|
}
|
|
public function find(int $id): ?array { return $this->rows[$id] ?? null; }
|
|
public function acknowledge(int $id, string $u): bool { if (!isset($this->rows[$id])) return false; $this->rows[$id]['acknowledged_by'] = $u; return true; }
|
|
}
|
|
final class InMemorySnapshotRepository implements SnapshotRepository {
|
|
public array $rows = []; public array $paths = []; public array $created = [];
|
|
public function add(int $e, string $uuid, string $hash): void {
|
|
// Mirror the DB's UNIQUE (event_id, content_hash): a re-sent event's identical bytes
|
|
// collide instead of duplicating, so the dedup recovery path is idempotent.
|
|
foreach ($this->rows[$e] ?? [] as $r) { if ($r['content_hash'] === $hash) return; }
|
|
$this->rows[$e][] = ['file_uuid' => $uuid, 'content_hash' => $hash]; $this->paths[$uuid] = "/tmp/$uuid.jpg"; $this->created[$uuid] = time();
|
|
}
|
|
public function forEvent(int $e): array { return $this->rows[$e] ?? []; }
|
|
public function pathByUuid(string $u): ?string { return $this->paths[$u] ?? null; }
|
|
public function eventIdByUuid(string $u): ?int {
|
|
foreach ($this->rows as $e => $list) foreach ($list as $r) if ($r['file_uuid'] === $u) return (int)$e;
|
|
return null;
|
|
}
|
|
public function purgeOlderThan(int $cutoff): int {
|
|
$n = 0;
|
|
foreach ($this->created as $uuid => $ts) {
|
|
if ($ts >= $cutoff) continue;
|
|
unset($this->created[$uuid], $this->paths[$uuid]);
|
|
foreach ($this->rows as $e => $list) {
|
|
$this->rows[$e] = array_values(array_filter($list, fn($r) => $r['file_uuid'] !== $uuid));
|
|
}
|
|
$n++;
|
|
}
|
|
return $n;
|
|
}
|
|
}
|
|
final class InMemoryUserRepository implements UserRepository {
|
|
public function __construct(public array $users = []) {}
|
|
public function byUsername(string $u): ?array { return $this->users[$u] ?? null; }
|
|
public function recordFailure(int $id, int $lock): void { foreach ($this->users as &$row) if ($row['id'] === $id) { $row['failed_attempts'] = ($row['failed_attempts'] ?? 0) + 1; $row['locked_until'] = $lock; } }
|
|
public function clearFailures(int $id): void { foreach ($this->users as &$row) if ($row['id'] === $id) { $row['failed_attempts'] = 0; $row['locked_until'] = 0; } }
|
|
}
|
|
final class InMemoryZoneRepository implements ZoneRepository {
|
|
public array $zones = []; private int $seq = 0;
|
|
public function forDevice(string $d): array { return array_values(array_filter($this->zones, fn($z) => ($z['device_id'] ?? '') === $d)); }
|
|
public function forCamera(string $c): array { return array_values(array_filter($this->zones, fn($z) => $z['camera_id'] === $c)); }
|
|
public function find(string $id): ?array { return $this->zones[$id] ?? null; }
|
|
public function save(array $z): string { $id = $z['zone_id'] ?? ('z' . (++$this->seq)); $this->zones[$id] = $z + ['zone_id' => $id]; return $id; }
|
|
public function delete(string $id): bool { if (!isset($this->zones[$id])) return false; unset($this->zones[$id]); return true; }
|
|
}
|
|
final class InMemoryThresholdRepository implements ThresholdRepository {
|
|
public function __construct(private array $data = []) {}
|
|
public function forDevice(string $d): array { return $this->data[$d] ?? []; }
|
|
}
|
|
final class InMemoryAuditRepository implements AuditRepository {
|
|
public array $log = [];
|
|
public function append(string $a, string $act, string $t, array $b, array $af): void { $this->log[] = compact('a', 'act', 't', 'b', 'af'); }
|
|
}
|