CP-311905: VM.update_secureboot_certificates_on_boot idempotent

Signed-off-by: Chunjie Zhu <chunjie.zhu@cloud.com>

Author: chunjiez

ocaml/tests/test_vm.ml

@@ -237,8 +237,7 @@ module VMUpdateSecurebootCertificatesOnBoot = Generic.MakeStateful (struct
   module Io = struct
     type input_t = [`ok | `update_available | `update_on_boot] * bool
 
-    type output_t =
-      ([`ok | `update_available | `update_on_boot], string * string list) result
+    type output_t = [`ok | `update_available | `update_on_boot]
 
     let string_of_state = function
       | `ok ->
@@ -251,14 +250,7 @@ module VMUpdateSecurebootCertificatesOnBoot = Generic.MakeStateful (struct
     let string_of_input_t (state, mark) =
       Printf.sprintf "(%s, mark=%b)" (string_of_state state) mark
 
-    let string_of_error (code, args) =
-      Printf.sprintf "%s(%s)" code (String.concat ", " args)
-
-    let string_of_output_t = function
-      | Ok state ->
-          Printf.sprintf "Ok %s" (string_of_state state)
-      | Error err ->
-          Printf.sprintf "Error %s" (string_of_error err)
+    let string_of_output_t = string_of_state
   end
 
   module State = Test_state.XapiDb
@@ -273,34 +265,21 @@ module VMUpdateSecurebootCertificatesOnBoot = Generic.MakeStateful (struct
     let self =
       List.nth (Db.VM.get_by_name_label ~__context ~label:name_label) 0
     in
-    try
-      Xapi_vm.update_secureboot_certificates_on_boot ~__context ~self ~mark ;
-      Ok (Db.VM.get_secureboot_certificates_state ~__context ~self)
-    with Api_errors.Server_error (code, args) -> Error (code, args)
+    Xapi_vm.update_secureboot_certificates_on_boot ~__context ~self ~mark ;
+    Db.VM.get_secureboot_certificates_state ~__context ~self
 
   let tests =
     `QuickAndAutoDocumented
       [
-        ((`update_available, true), Ok `update_on_boot)
-      ; ((`update_on_boot, false), Ok `update_available)
-      ; ( (`ok, true)
-        , Error
-            ( Api_errors.operation_not_allowed
-            , [
-                "Cannot set update_on_boot: VM.secureboot_certificates_state \
-                 is not update_available"
-              ]
-            )
-        )
-      ; ( (`ok, false)
-        , Error
-            ( Api_errors.operation_not_allowed
-            , [
-                "Cannot clear update_on_boot: VM.secureboot_certificates_state \
-                 is not update_on_boot"
-              ]
-            )
-        )
+        (* transitions *)
+        ((`update_available, true), `update_on_boot)
+      ; ((`update_on_boot, false), `update_available)
+        (* idempotent: already in desired state *)
+      ; ((`update_on_boot, true), `update_on_boot)
+      ; ((`update_available, false), `update_available)
+        (* irrelevant states: no-op, no exception *)
+      ; ((`ok, true), `ok)
+      ; ((`ok, false), `ok)
       ]
 end)
 

ocaml/xapi/xapi_vm.ml

@@ -1763,26 +1763,12 @@ let update_secureboot_certificates_on_boot ~__context ~self ~mark =
   | false, `update_on_boot ->
       Db.VM.set_secureboot_certificates_state ~__context ~self
         ~value:`update_available
-  | true, _ ->
-      raise
-        (Api_errors.Server_error
-           ( Api_errors.operation_not_allowed
-           , [
-               "Cannot set update_on_boot: VM.secureboot_certificates_state is \
-                not update_available"
-             ]
-           )
-        )
-  | false, _ ->
-      raise
-        (Api_errors.Server_error
-           ( Api_errors.operation_not_allowed
-           , [
-               "Cannot clear update_on_boot: VM.secureboot_certificates_state \
-                is not update_on_boot"
-             ]
-           )
-        )
+  | true, `update_on_boot ->
+      () (* already marked for update on boot — idempotent *)
+  | false, `update_available ->
+      () (* already cleared — idempotent *)
+  | _, _ ->
+      () (* irrelevant state — no-op *)
 
 let sysprep ~__context ~self ~unattend ~timeout =
   let uuid = Db.VM.get_uuid ~__context ~self in