🐛 fix(config): propagate reconcile errors

`build_state` discarded repository reconciliation errors, so the server could
expose a configured route without its persisted identity.

Propagate the storage error before `build_state` publishes application state.
Nodes without write access keep skipping repository reconciliation.

Author: gaborbernat

crates/peryx/src/config/repository_migration.rs

@@ -1,7 +1,7 @@
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use peryx_identity::UserId;
-use peryx_storage::meta::{DesiredRepository, MetaStore};
+use peryx_storage::meta::{DesiredRepository, MetaStore, ReconcileRepositoryError};
 
 use super::IndexConfig;
 
@@ -27,17 +27,19 @@ fn desired(config: &IndexConfig) -> DesiredRepository {
     }
 }
 
-/// Give every configured index a persisted repository record.
+/// Persist repository identities before the server exposes configured routes.
 ///
-/// Each index reconciles by route: a new route mints a record, an existing route reuses its id, so a
-/// restart adds nothing and a later rename never re-homes a reference. Unchanged configuration bumps
-/// no version. A route the store cannot hold as a repository, an over-long one for example, leaves
-/// the batch unwritten and logs rather than failing an otherwise healthy boot.
-pub fn reconcile_configured_repositories(meta: &MetaStore, configs: &[IndexConfig]) {
+/// Route matching keeps IDs stable and advances versions only when a stored definition changes.
+///
+/// # Errors
+/// Returns an error when validation or persistence prevents the atomic batch.
+pub fn reconcile_configured_repositories(
+    meta: &MetaStore,
+    configs: &[IndexConfig],
+) -> Result<(), ReconcileRepositoryError> {
     let desired: Vec<DesiredRepository> = configs.iter().map(desired).collect();
-    if let Err(error) = meta.reconcile_repositories(&desired, &system_actor(), unix_now()) {
-        tracing::warn!(%error, "could not assign stable ids to configured repositories");
-    }
+    meta.reconcile_repositories(&desired, &system_actor(), unix_now())
+        .map(drop)
 }
 
 #[cfg(test)]

crates/peryx/src/server.rs

@@ -223,7 +223,7 @@ fn build_state_with_active_backend_and_plugins(
     }
     attach_policy_decision_recorders(&meta, &mut indexes, read_only)?;
     if !read_only {
-        crate::config::reconcile_configured_repositories(&meta, &configs);
+        persist_configured_repositories(&meta, &configs)?;
     }
     let ecosystem_settings = build_index_settings_with_plugins(&configs, plugins)?;
     let webhooks = build_webhooks(&configs, plugins)?;
@@ -257,6 +257,19 @@ fn build_state_with_active_backend_and_plugins(
     Ok(Arc::new(state))
 }
 
+fn persist_configured_repositories(meta: &MetaStore, configs: &[IndexConfig]) -> anyhow::Result<()> {
+    crate::config::reconcile_configured_repositories(meta, configs).with_context(|| {
+        format!(
+            "persist configured repositories [{}]",
+            configs
+                .iter()
+                .map(|config| config.route.as_str())
+                .collect::<Vec<_>>()
+                .join(", ")
+        )
+    })
+}
+
 fn resolve_signing_key(config: &Config) -> anyhow::Result<Option<String>> {
     const MIN_BYTES: usize = 32;
     let Some(source) = &config.auth.signing_key else {

crates/peryx/tests/unit/config/repository_migration/tests.rs

@@ -24,13 +24,13 @@ fn test_reconcile_assigns_stable_ids_idempotently_across_boots() {
     let dir = tempfile::tempdir().unwrap();
     let store = MetaStore::open(dir.path().join("peryx.redb")).unwrap();
 
-    reconcile_configured_repositories(&store, &config.indexes);
+    reconcile_configured_repositories(&store, &config.indexes).unwrap();
     let first_boot = routes_to_id_and_version(&store);
 
     assert_eq!(first_boot.len(), config.indexes.len());
     assert!(first_boot.values().all(|(id, version)| !id.is_empty() && *version == 1));
 
-    reconcile_configured_repositories(&store, &config.indexes);
+    reconcile_configured_repositories(&store, &config.indexes).unwrap();
 
     assert_eq!(routes_to_id_and_version(&store), first_boot);
 }
@@ -45,10 +45,10 @@ fn test_reconcile_renames_default_virtual_indexes_without_changing_ids() {
         .name = "root/pypi".to_owned();
     let dir = tempfile::tempdir().unwrap();
     let store = MetaStore::open(dir.path().join("peryx.redb")).unwrap();
-    reconcile_configured_repositories(&store, &old.indexes);
+    reconcile_configured_repositories(&store, &old.indexes).unwrap();
     let previous = store.repository_by_route("root/pypi").unwrap().unwrap();
 
-    reconcile_configured_repositories(&store, &Config::default().indexes);
+    reconcile_configured_repositories(&store, &Config::default().indexes).unwrap();
     let current = store.repository_by_route("root/pypi").unwrap().unwrap();
 
     assert_eq!(current.id, previous.id);
@@ -63,7 +63,8 @@ fn test_reconcile_writes_nothing_when_a_route_cannot_be_a_repository() {
     let dir = tempfile::tempdir().unwrap();
     let store = MetaStore::open(dir.path().join("peryx.redb")).unwrap();
 
-    reconcile_configured_repositories(&store, &config.indexes);
+    let error = reconcile_configured_repositories(&store, &config.indexes).unwrap_err();
 
+    assert_eq!(error.to_string(), "repository route exceeds 512 bytes");
     assert!(routes_to_id_and_version(&store).is_empty());
 }

crates/peryx/tests/unit/tests/server_tests.rs

@@ -401,6 +401,90 @@ fn test_build_state_opens_configured_data_dir() {
     assert!(dir.path().join("peryx.redb").exists());
 }
 
+#[test]
+fn test_build_state_reports_configured_repository_persistence_failure() {
+    let dir = tempfile::tempdir().unwrap();
+    let config = config_with_corrupt_repository(&dir);
+
+    let error = build_state(&config)
+        .err()
+        .expect("expected repository persistence error");
+
+    assert_eq!(
+        error.to_string(),
+        format!("persist configured repositories [{}]", config.indexes[0].route)
+    );
+}
+
+#[test]
+fn test_build_state_read_only_skips_repository_reconciliation() {
+    let dir = tempfile::tempdir().unwrap();
+    let mut config = config_with_corrupt_repository(&dir);
+    config.read_only = true;
+
+    let state = build_state(&config).unwrap();
+
+    assert_eq!(state.serving.indexes[0].route, config.indexes[0].route);
+}
+
+#[test]
+fn test_build_state_preserves_configured_repository_identity() {
+    let dir = tempfile::tempdir().unwrap();
+    let config = Config {
+        data_dir: dir.path().to_path_buf(),
+        ..neutral_config()
+    };
+    let first = build_state(&config).unwrap();
+    let first_repositories = routes_to_id_and_version(&first.serving.meta);
+    drop(first);
+
+    let second = build_state(&config).unwrap();
+
+    assert_eq!(
+        (routes_to_id_and_version(&second.serving.meta), first_repositories.len()),
+        (first_repositories, config.indexes.len())
+    );
+}
+
+fn config_with_corrupt_repository(dir: &tempfile::TempDir) -> Config {
+    let mut config = Config {
+        data_dir: dir.path().to_path_buf(),
+        ..neutral_config()
+    };
+    config.indexes.truncate(1);
+    let state = build_state(&config).unwrap();
+    let repository = state
+        .serving
+        .meta
+        .repository_by_route(&config.indexes[0].route)
+        .unwrap()
+        .unwrap();
+    drop(state);
+    let database = redb::Database::open(dir.path().join("peryx.redb")).unwrap();
+    let transaction = database.begin_write().unwrap();
+    {
+        let mut repositories = transaction
+            .open_table(redb::TableDefinition::<&str, &[u8]>::new("repository"))
+            .unwrap();
+        repositories.insert(repository.id.as_str(), b"{".as_slice()).unwrap();
+    }
+    transaction.commit().unwrap();
+    config
+}
+
+fn routes_to_id_and_version(store: &MetaStore) -> std::collections::BTreeMap<String, (String, u64)> {
+    store
+        .list_repositories(&peryx_storage::meta::RepositoryQuery {
+            limit: 100,
+            ..peryx_storage::meta::RepositoryQuery::default()
+        })
+        .unwrap()
+        .repositories
+        .into_iter()
+        .map(|record| (record.route, (record.id.as_str().to_owned(), record.version)))
+        .collect()
+}
+
 #[test]
 fn test_build_state_repairs_abandoned_quota_before_admission() {
     let dir = tempfile::tempdir().unwrap();