feat(grzctl): confirm before updating submission from error state (#357)

Resolves #318

fix(grz-db): allow empty author private key passphrases

Author: Travis Wrightsman

packages/grz-db/src/grz_db/models/author.py

@@ -21,7 +21,7 @@ def private_key(self) -> Ed25519PrivateKey:
         from cryptography.hazmat.primitives.serialization import load_ssh_private_key
 
         passphrase = self.private_key_passphrase
-        if passphrase:
+        if passphrase is not None:
             passphrase_callback = lambda: passphrase
         else:
             passphrase_callback = partial(getpass, prompt=f"Passphrase for GRZ DB author ({self.name}'s) private key: ")

packages/grzctl/src/grzctl/commands/db.py

@@ -378,8 +378,9 @@ def add(ctx: click.Context, submission_id: str):
 @click.argument("submission_id", type=str)
 @click.argument("state_str", metavar="STATE", type=click.Choice(SubmissionStateEnum.list(), case_sensitive=False))
 @click.option("--data", "data_json", type=str, default=None, help='Additional JSON data (e.g., \'{"k":"v"}\').')
+@click.option("--ignore-error-state/--confirm-error-state")
 @click.pass_context
-def update(ctx: click.Context, submission_id: str, state_str: str, data_json: str | None):
+def update(ctx: click.Context, submission_id: str, state_str: str, data_json: str | None, ignore_error_state: bool):  # noqa: C901
     """Update a submission to the given state. Optionally accepts additional JSON data to associate with the log entry."""
     db = ctx.obj["db_url"]
     db_service = get_submission_db_instance(db, author=ctx.obj["author"])
@@ -397,6 +398,23 @@ def update(ctx: click.Context, submission_id: str, state_str: str, data_json: st
             console_err.print(f"[red]Error: Invalid JSON string for --data: {data_json}[/red]")
             raise click.Abort() from e
     try:
+        submission = db_service.get_submission(submission_id)
+        if not submission:
+            raise SubmissionNotFoundError(submission_id)
+        latest_state = submission.get_latest_state()
+        latest_state_is_error = latest_state is not None and latest_state.state == SubmissionStateEnum.ERROR
+        if (
+            latest_state_is_error
+            and not ignore_error_state
+            and not click.confirm(
+                f"Submission is currently in an 'Error' state. Are you sure you want to set it to '{state_enum}'?",
+                default=False,
+                show_default=True,
+            )
+        ):
+            console_err.print(f"[yellow]Not modifying state of errored submission '{submission_id}'.[/yellow]")
+            ctx.exit()
+
         new_state_log = db_service.update_submission_state(submission_id, state_enum, parsed_data)
         console_err.print(
             f"[green]Submission '{submission_id}' updated to state '{new_state_log.state.value}'. Log ID: {new_state_log.id}[/green]"
@@ -408,6 +426,9 @@ def update(ctx: click.Context, submission_id: str, state_str: str, data_json: st
         console_err.print(f"[red]Error: {e}[/red]")
         console_err.print(f"You might need to add it first: grz-cli db submission add {submission_id}")
         raise click.Abort() from e
+    except click.exceptions.Exit as e:
+        if e.exit_code != 0:
+            raise e
     except Exception as e:
         console_err.print(f"[red]An unexpected error occurred: {e}[/red]")
         traceback.print_exc()

packages/grzctl/tests/cli/test_db.py

@@ -44,7 +44,11 @@ def blank_database_config(tmp_path: Path) -> DbConfig:
     return DbConfig(
         db={
             "database_url": "sqlite:///" + str((tmp_path / "submission.db.sqlite").resolve()),
-            "author": {"name": "alice", "private_key_path": str(private_key_path.resolve())},
+            "author": {
+                "name": "alice",
+                "private_key_path": str(private_key_path.resolve()),
+                "private_key_passphrase": "",
+            },
             "known_public_keys": str(public_key_path.resolve()),
         }
     )
@@ -157,3 +161,31 @@ def test_populate_redacted(tmp_path: Path, blank_database_config_path: Path):
             [*args_common, "submission", "populate", submission_id, str(metadata_path), "--no-confirm"],
             catch_exceptions=False,
         )
+
+
+def test_update_error_confirm(blank_database_config_path: Path):
+    """Database should confirm before updating a submission from an Error state."""
+    args_common = ["db", "--config-file", blank_database_config_path]
+    metadata = GrzSubmissionMetadata.model_validate_json(
+        (importlib.resources.files(test_resources) / "metadata.json").read_text()
+    )
+
+    runner = click.testing.CliRunner()
+    cli = grzctl.cli.build_cli()
+    result_add = runner.invoke(cli, [*args_common, "submission", "add", metadata.submission_id])
+    assert result_add.exit_code == 0, result_add.stderr
+
+    result_update1 = runner.invoke(cli, [*args_common, "submission", "update", metadata.submission_id, "Error"])
+    assert result_update1.exit_code == 0, result_update1.output
+
+    result_update2 = runner.invoke(cli, [*args_common, "submission", "update", metadata.submission_id, "Validated"])
+    assert result_update2.exit_code != 0, result_update2.output
+    assert (
+        "Submission is currently in an 'Error' state. Are you sure you want to set it to 'Validated'?"
+        in result_update2.output
+    )
+
+    result_update3 = runner.invoke(
+        cli, [*args_common, "submission", "update", "--ignore-error-state", metadata.submission_id, "Validated"]
+    )
+    assert result_update3.exit_code == 0, result_update3.output