fix runtime smoke sudo-owned outputs

Author: marcofortina

docs/plugins/generated.md

@@ -2631,6 +2631,8 @@ Run SQLite queries or statements from the controller.
 | `output` | no | `string` | `rows` | Database output format: rows, scalar, json or none. |
 | `fetch` | no | `string` | `all` | Database fetch mode: all, one or none. |
 | `commit` | no | `boolean` | `True` | Commit the database transaction on success; false rolls it back. |
+| `path` | no | `path` |  | Remote or local path, depending on the plugin. |
+| `database` | no | `path` |  | SQLite database path or database name, depending on the plugin. |
 
 Result fields:
 

src/automax/plugins/backup.py

@@ -22,6 +22,8 @@ def _checksum_cmd(path: str, params: Dict[str, Any]) -> str:
         return "true"
     if checksum != "sha256":
         raise PluginValidationError("checksum must be sha256 or none")
+    if bool(params.get("sudo", True)):
+        return f"sudo -n sha256sum {quote(path)} | sudo -n tee {quote(path + '.sha256')} >/dev/null"
     return f"sha256sum {quote(path)} > {quote(path + '.sha256')}"
 
 
@@ -111,7 +113,7 @@ def manual_commands(self, params: Dict[str, Any], context: ExecutionContext) ->
         sudo = _sudo(params)
         commands = [f"test -e {quote(src)}"]
         if bool(params.get("backup", True)):
-            commands.append(f"test ! -e {quote(dest)} || {sudo}cp -a {quote(dest)} {quote(dest + str(params.get('backup_suffix', '.pre-restore')))}")
+            commands.append(f"if test -e {quote(dest)}; then {sudo}cp -a {quote(dest)} {quote(dest + str(params.get('backup_suffix', '.pre-restore')))}; fi")
         if bool(params.get("archive", False)):
             commands.extend([f"{sudo}mkdir -p {quote(dest)}", f"{sudo}tar -xf {quote(src)} -C {quote(dest)}"])
         else:
@@ -179,7 +181,8 @@ def manual_commands(self, params: Dict[str, Any], context: ExecutionContext) ->
         find_paths = " ".join(quote(str(item)) for item in paths)
         checksum_command = ""
         if bool(params.get("content_checksums", True)):
-            checksum_command = " | while IFS= read -r file; do sha256sum \"$file\"; done"
+            checksum_tool = f"{sudo}sha256sum"
+            checksum_command = f" | while IFS= read -r file; do {checksum_tool} \"$file\"; done"
         manifest_cmd = (
             f"cd {quote(root)} && "
             f"find {find_paths} -type f -print | LC_ALL=C sort{checksum_command}"

src/automax/plugins/db/sqlite.py

@@ -19,6 +19,7 @@ class DbSqliteQueryPlugin(DatabaseQueryPlugin):
 
     name = "db.sqlite.query"
     description = "Run SQLite queries or statements from the controller."
+    optional_params = DatabaseQueryPlugin.optional_params + ("path", "database")
 
     def validate(self, params: Dict[str, Any]) -> None:
         super().validate(params)

src/automax/plugins/manual_preview.py

@@ -116,7 +116,8 @@ def fallback_manual_commands(plugin_name: str, params: Dict[str, Any], context:
     if plugin_name.startswith("db.") and plugin_name.endswith(".query"):
         conn = _db_connection(params)
         if plugin_name == "db.sqlite.query":
-            return [f"sqlite3 {_q(conn.get('path', params.get('path', 'database.sqlite')))} '{_db_query(params)};'"]
+            database = conn.get("path") or conn.get("database") or params.get("path") or params.get("database") or "database.sqlite"
+            return [f"sqlite3 {_q(database)} '{_db_query(params)};'"]
         if plugin_name == "db.postgres.query":
             return [f"PGPASSWORD=*** psql -h {_q(conn.get('host', 'localhost'))} -U {_q(conn.get('user', 'postgres'))} -d {_q(conn.get('database', 'postgres'))} -c '{_db_query(params)};'"]
         if plugin_name == "db.mysql.query":

src/automax/plugins/metadata.py

@@ -131,6 +131,7 @@
     "untrusted": {"type": "path", "description": "Untrusted intermediate certificate chain file."},
     "ca_file": {"type": "path", "description": "CA bundle file path."},
     "config": {"type": "path", "description": "OpenSSL configuration file path."},
+    "database": {"type": "path", "description": "SQLite database path or database name, depending on the plugin."},
     "command": {"type": "string", "description": "Command line to execute."},
     "comment": {"type": "string", "description": "User account comment or GECOS field."},
     "commit": {"type": "boolean", "default": True, "description": "Commit the database transaction on success; false rolls it back."},

src/automax/plugins/ssh_ops.py

@@ -206,9 +206,10 @@ def manual_commands(self, params: Dict[str, Any], context: ExecutionContext) ->
         command = f"{_sudo(params)}ssh-keygen -y -f {quote(params['path'])}"
         if not params.get("dest"):
             return [command]
-        redirect = ">" if bool(params.get("overwrite", False)) else ">"
         guard = "" if bool(params.get("overwrite", False)) else f"test ! -e {quote(params['dest'])} && "
-        return [f"{guard}{command} {redirect} {quote(params['dest'])}"]
+        if bool(params.get("sudo", True)):
+            return [f"{guard}{command} | sudo -n tee {quote(params['dest'])} >/dev/null"]
+        return [f"{guard}{command} > {quote(params['dest'])}"]
 
     def execute(self, params: Dict[str, Any], context: ExecutionContext) -> PluginResult:
         rc, out, err = exec_remote(context, self.manual_commands(params, context)[0])

tests/test_next_engine.py

@@ -744,6 +744,7 @@ def test_sqlite_database_plugin_executes_transactional_statements(tmp_path: Path
     assert select.ok, select.stderr
     assert select.data["scalar"] == "automax"
     assert select.stdout == "automax"
+    assert plugin.manual_commands({"database": str(database), "query": "SELECT 1"}, context)[0].startswith(f"sqlite3 {database}")
 
 
 def test_database_plugins_validate_job_yaml(tmp_path: Path):
@@ -4233,6 +4234,9 @@ def test_ssh_security_plugins_render_manual_commands():
 
     assert "ssh-keygen -lf" in registry.get("ssh.fingerprint").manual_commands({"path": "/tmp/id.pub", "sudo": False}, context)[0]
     assert "ssh-keygen -y" in registry.get("ssh.public_key").manual_commands({"path": "/tmp/id", "sudo": False}, context)[0]
+    sudo_public_key = registry.get("ssh.public_key").manual_commands({"path": "/tmp/id", "dest": "/root/id.pub"}, context)[0]
+    assert "ssh-keygen -y" in sudo_public_key
+    assert "| sudo -n tee /root/id.pub >/dev/null" in sudo_public_key
     assert "ssh-keygen -A" in registry.get("ssh.host_keygen").manual_commands({"sudo": False}, context)[0]
     assert "authorized_keys" in registry.get("ssh.authorized_key_absent").manual_commands({"user": "deploy", "key": "ssh-ed25519 AAA demo", "sudo": False}, context)[0]
     assert "sshd -t" in registry.get("sshd.validate").manual_commands({}, context)[0]
@@ -4353,6 +4357,14 @@ def test_backup_completeness_plugins_render_manual_commands():
     assert "find . -type f" in manifest
     assert "tee /var/backups/manifest.txt" in manifest
 
+    sudo_manifest = registry.get("backup.manifest").manual_commands({"root": "/var/backups", "dest": "/var/backups/manifest.txt"}, context)[0]
+    assert "sudo -n sha256sum" in sudo_manifest
+    assert "sudo -n tee /var/backups/manifest.txt.sha256 >/dev/null" in sudo_manifest
+
+    restore = registry.get("backup.restore").manual_commands({"src": "/var/backups/file.txt", "dest": "/srv/file.txt", "confirm": True}, context)[0]
+    assert "if test -e /srv/file.txt; then sudo -n cp -a /srv/file.txt /srv/file.txt.pre-restore; fi" in restore
+    assert "sudo -n cp -a /var/backups/file.txt /srv/file.txt" in restore
+
     try:
         registry.get("backup.prune").manual_commands({"path": "/var/backups", "keep": 7}, context)
     except PluginValidationError as exc: