add DeployDirtyAccounts function and corresponding tests for account deployment and dirty flag management

Author: ToeiRei

internal/core/deploy_dirty_facade.go

@@ -0,0 +1,34 @@
+// Copyright (c) 2025 ToeiRei
+// Keymaster - SSH key management system
+// This source code is licensed under the MIT license found in the LICENSE file.
+
+package core
+
+import (
+	"context"
+	"fmt"
+)
+
+// DeployDirtyAccounts fetches all active accounts from the store, selects
+// accounts marked `IsDirty`, deploys to each using the provided DeployerManager,
+// and clears the `is_dirty` flag for accounts that deployed successfully.
+// It returns the per-account DeployResult slice and an error if fetching
+// accounts failed.
+func DeployDirtyAccounts(ctx context.Context, st Store, dm DeployerManager, rep Reporter) ([]DeployResult, error) {
+	accounts, err := st.GetAllActiveAccounts()
+	if err != nil {
+		return nil, fmt.Errorf("get accounts: %w", err)
+	}
+
+	dirty := DirtyAccounts(accounts)
+	results := make([]DeployResult, 0, len(dirty))
+	for _, acc := range dirty {
+		err := dm.DeployForAccount(acc, false)
+		results = append(results, DeployResult{Account: acc, Error: err})
+		if err == nil {
+			// Best-effort: clear is_dirty; log/store error ignored for now
+			_ = st.UpdateAccountIsDirty(acc.ID, false)
+		}
+	}
+	return results, nil
+}

internal/core/deploy_dirty_facade_test.go

@@ -0,0 +1,84 @@
+// Copyright (c) 2025 ToeiRei
+// Keymaster - SSH key management system
+// This source code is licensed under the MIT license found in the LICENSE file.
+
+package core
+
+import (
+	"context"
+	"testing"
+
+	"github.com/toeirei/keymaster/internal/model"
+)
+
+type fakeStoreForDirty struct {
+	accounts []model.Account
+	cleared  []int
+}
+
+func (f *fakeStoreForDirty) GetAllActiveAccounts() ([]model.Account, error) { return f.accounts, nil }
+func (f *fakeStoreForDirty) UpdateAccountIsDirty(id int, dirty bool) error {
+	if !dirty {
+		f.cleared = append(f.cleared, id)
+	}
+	return nil
+}
+
+// implement remaining Store methods as no-ops to satisfy interface
+func (f *fakeStoreForDirty) GetAccounts() ([]model.Account, error)     { return nil, nil }
+func (f *fakeStoreForDirty) GetAllAccounts() ([]model.Account, error)  { return nil, nil }
+func (f *fakeStoreForDirty) GetAccount(id int) (*model.Account, error) { return nil, nil }
+func (f *fakeStoreForDirty) AddAccount(username, hostname, label, tags string) (int, error) {
+	return 0, nil
+}
+func (f *fakeStoreForDirty) DeleteAccount(accountID int) error                         { return nil }
+func (f *fakeStoreForDirty) AssignKeyToAccount(keyID, accountID int) error             { return nil }
+func (f *fakeStoreForDirty) CreateSystemKey(publicKey, privateKey string) (int, error) { return 0, nil }
+func (f *fakeStoreForDirty) RotateSystemKey(publicKey, privateKey string) (int, error) { return 0, nil }
+func (f *fakeStoreForDirty) GetActiveSystemKey() (*model.SystemKey, error)             { return nil, nil }
+func (f *fakeStoreForDirty) AddKnownHostKey(hostname, key string) error                { return nil }
+func (f *fakeStoreForDirty) ExportDataForBackup() (*model.BackupData, error)           { return nil, nil }
+func (f *fakeStoreForDirty) ImportDataFromBackup(*model.BackupData) error              { return nil }
+func (f *fakeStoreForDirty) IntegrateDataFromBackup(*model.BackupData) error           { return nil }
+
+type fakeDMForDirty struct{ called []int }
+
+func (f *fakeDMForDirty) DeployForAccount(account model.Account, keepFile bool) error {
+	f.called = append(f.called, account.ID)
+	return nil
+}
+func (f *fakeDMForDirty) AuditSerial(account model.Account) error { return nil }
+func (f *fakeDMForDirty) AuditStrict(account model.Account) error { return nil }
+func (f *fakeDMForDirty) DecommissionAccount(account model.Account, systemPrivateKey string, options interface{}) (DecommissionResult, error) {
+	return DecommissionResult{}, nil
+}
+func (f *fakeDMForDirty) BulkDecommissionAccounts(accounts []model.Account, systemPrivateKey string, options interface{}) ([]DecommissionResult, error) {
+	return nil, nil
+}
+func (f *fakeDMForDirty) CanonicalizeHostPort(host string) string                   { return host }
+func (f *fakeDMForDirty) ParseHostPort(host string) (string, string, error)         { return host, "22", nil }
+func (f *fakeDMForDirty) GetRemoteHostKey(host string) (string, error)              { return "", nil }
+func (f *fakeDMForDirty) FetchAuthorizedKeys(account model.Account) ([]byte, error) { return nil, nil }
+func (f *fakeDMForDirty) ImportRemoteKeys(account model.Account) ([]model.PublicKey, int, string, error) {
+	return nil, 0, "", nil
+}
+func (f *fakeDMForDirty) IsPassphraseRequired(err error) bool { return false }
+
+func TestDeployDirtyAccounts_ClearsOnSuccess(t *testing.T) {
+	st := &fakeStoreForDirty{accounts: []model.Account{{ID: 1, IsDirty: false}, {ID: 2, IsDirty: true}, {ID: 3, IsDirty: true}}}
+	dm := &fakeDMForDirty{}
+
+	res, err := DeployDirtyAccounts(context.Background(), st, dm, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(res) != 2 {
+		t.Fatalf("expected 2 results, got %d", len(res))
+	}
+	if len(dm.called) != 2 || dm.called[0] != 2 || dm.called[1] != 3 {
+		t.Fatalf("unexpected deploy calls: %v", dm.called)
+	}
+	if len(st.cleared) != 2 {
+		t.Fatalf("expected 2 cleared flags, got %d", len(st.cleared))
+	}
+}

internal/core/interfaces.go

@@ -26,6 +26,9 @@ type Store interface {
 	DeleteAccount(accountID int) error
 	AssignKeyToAccount(keyID, accountID int) error
 
+	// UpdateAccountIsDirty sets or clears the is_dirty flag for an account.
+	UpdateAccountIsDirty(id int, dirty bool) error
+
 	// System key helpers
 	CreateSystemKey(publicKey, privateKey string) (int, error)
 	RotateSystemKey(publicKey, privateKey string) (int, error)