Analytics: compare two finished runs

New page /analytics/compare and API GET /admin/analytics/compare (+ /lists/{group}): the administrator picks an old (A) and a new (B) run; the report shows the new addresses (only in B), the ones that left (only in A) and the common ones whose membership in the seven indicators (pass, partial, fail, egress https any/all, ingress ssh any/all) differs, with a "what changed" summary per address; the dynamics of each indicator (delta = new - left + entered - exited) and a verdict transition matrix. Every number opens a list with CSV. Cancelled addresses are not part of a run. The list dialog moved to a shared analytics-dialog.js and template; /analytics got a "compare with another run" button. Docs, plan and summary in docs/changes/. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-04 10:26:37 +03:00
1 parent 2f038f8362
commit 068c10ea1c
@@ -148,6 +148,188 @@ func TestAnalyticsListProxyAndCSV(t *testing.T) {
 	}
 }

+// compareWith is the minimal comparison JSON the page needs; new is a marker
+// that tells the pairs of runs apart in the page source.
+func compareWith(newAddrs string) string {
+	return `{"runs":{"base":{"id":1,"rechecked":0,"addresses":6440},"target":{"id":2,"rechecked":0,"addresses":900}},` +
+		`"groups":{"new":` + newAddrs + `,"left":2,"common":3,"changed":1,"same":2},"indicators":[],` +
+		`"transitions":{"verdicts":["pass","partial","fail"],"matrix":[[0,0,0],[0,0,0],[0,0,0]],"new":[0,0,0],"left":[0,0,0]},"cancelled":{"base":0,"target":0}}`
+}
+
+// compareFake is analyticsFake with the comparisons of runs 1 and 2 (run 3 is open).
+func compareFake(t *testing.T) (*fakeControlAPI, *httptest.Server) {
+	t.Helper()
+	fake, ts := analyticsFake(t)
+	fake.compares = map[string]string{"1-2": compareWith("111"), "2-1": compareWith("222")}
+	fake.compareLists = map[string]string{
+		"1-2/changed":          `{"group":"changed","columns":["Адрес","Подсеть"],"rows":[["1.2.3.4","1.2.3.0/24"]]}`,
+		"1-2/new/verdict_pass": `{"group":"new","indicator":"verdict_pass","columns":["Адрес"],"rows":[["5.6.7.8"]]}`,
+	}
+	return fake, ts
+}
+
+func compareRequests(fake *fakeControlAPI) []string {
+	var out []string
+	for _, r := range fake.analyticsReqs {
+		if strings.Contains(r, "/compare") {
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
+// By default B is the newest finished run and A the one before it; the open
+// run is not offered; the page asks control-api for that pair only.
+func TestAnalyticsComparePageDefaultPair(t *testing.T) {
+	fake, ts := compareFake(t)
+
+	page := get(t, ts, "/analytics/compare")
+	for _, want := range []string{
+		`id="an-base"`, `id="an-target"`, `id="an-swap"`, `id="analytics-data"`, `"new":111`,
+		`<option value="1" selected>`, `<option value="2" selected>`, // A is run 1, B is run 2
+		`id="an-dlg"`, `/static/analytics-dialog.js`, `/static/analytics-compare.js`,
+		"6\u00a0440 адр. · 30% pass",
+	} {
+		if !strings.Contains(page, want) {
+			t.Fatalf("expected %q in the page, got:\n%s", want, page)
+		}
+	}
+	if strings.Count(page, `<option value="1" selected>`) != 1 || strings.Count(page, `<option value="2" selected>`) != 1 {
+		t.Fatalf("one run is chosen in each list:\n%s", page)
+	}
+	if strings.Contains(page, `value="3"`) {
+		t.Fatalf("an open run must not be offered:\n%s", page)
+	}
+	if got := compareRequests(fake); len(got) != 1 || !strings.Contains(got[0], "base=1") || !strings.Contains(got[0], "target=2") {
+		t.Fatalf("expected one request for base=1&target=2, got %v", got)
+	}
+}
+
+// The pair in the address: both ends, only the new one (the base is the run
+// before it), only the old one (the target is the newest other run).
+func TestAnalyticsComparePageExplicitPair(t *testing.T) {
+	fake, ts := compareFake(t)
+
+	page := get(t, ts, "/analytics/compare?base=2&target=1")
+	if !strings.Contains(page, `"new":222`) || !strings.Contains(page, `<option value="2" selected>`) {
+		t.Fatalf("swapped pair:\n%s", page)
+	}
+	if page = get(t, ts, "/analytics/compare?target=2"); !strings.Contains(page, `"new":111`) {
+		t.Fatalf("only target=2 must compare with run 1:\n%s", page)
+	}
+	if page = get(t, ts, "/analytics/compare?base=2"); !strings.Contains(page, `"new":222`) {
+		t.Fatalf("only base=2 must compare with the newest other run, 1:\n%s", page)
+	}
+	if page = get(t, ts, "/analytics/compare?target=1"); strings.Contains(page, `id="analytics-data"`) ||
+		!strings.Contains(page, "нет второго запуска") {
+		t.Fatalf("run 1 is the oldest, nothing to compare it with:\n%s", page)
+	}
+	if got := compareRequests(fake); len(got) != 3 {
+		t.Fatalf("the refused pair must not reach control-api, got %v", got)
+	}
+}
+
+func TestAnalyticsComparePageWarnings(t *testing.T) {
+	fake, ts := compareFake(t)
+	for _, c := range []struct{ query, want string }{
+		{"base=1&target=1", "Выберите два разных запуска"},
+		{"base=99&target=1", "Запуск 99 не найден или ещё не завершён"},
+		// the open run
+		{"base=1&target=3", "Запуск 3 не найден или ещё не завершён"},
+		{"base=abc&target=1", "Неверный номер запуска"},
+		{"base=0&target=1", "Неверный номер запуска"},
+	} {
+		page := get(t, ts, "/analytics/compare?"+c.query)
+		if !strings.Contains(page, c.want) || strings.Contains(page, `id="analytics-data"`) || !strings.Contains(page, `id="an-base"`) {
+			t.Fatalf("%s: expected the warning %q and the run lists without data, got:\n%s", c.query, c.want, page)
+		}
+	}
+	if got := compareRequests(fake); len(got) != 0 {
+		t.Fatalf("a bad pair must not reach control-api, got %v", got)
+	}
+
+	// Fewer than two finished runs: nothing to compare.
+	fake, caURL := newFakeControlAPI(t)
+	fake.runs = []analyticsRun{fakeRun(3, "open", 120, 40), fakeRun(1, "finalized", 6440, 1962)}
+	page := get(t, newTestServer(t, caURL), "/analytics/compare")
+	if !strings.Contains(page, "минимум два завершённых запуска") || strings.Contains(page, `id="an-base"`) {
+		t.Fatalf("expected the empty state, got:\n%s", page)
+	}
+}
+
+func TestAnalyticsCompareListProxyAndCSV(t *testing.T) {
+	_, ts := compareFake(t)
+	fetch := func(path string) (int, http.Header, string) {
+		t.Helper()
+		resp, err := http.Get(ts.URL + path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		body, _ := io.ReadAll(resp.Body)
+		resp.Body.Close()
+		return resp.StatusCode, resp.Header, string(body)
+	}
+
+	code, _, body := fetch("/analytics/compare/lists/changed?base=1&target=2")
+	if code != http.StatusOK || !strings.Contains(body, `"1.2.3.4"`) {
+		t.Fatalf("list: %d %s", code, body)
+	}
+	// The indicator and the verdicts travel to control-api.
+	code, _, body = fetch("/analytics/compare/lists/new?base=1&target=2&indicator=verdict_pass")
+	if code != http.StatusOK || !strings.Contains(body, `"5.6.7.8"`) {
+		t.Fatalf("list with an indicator: %d %s", code, body)
+	}
+	code, header, body := fetch("/analytics/compare/csv/changed?base=1&target=2")
+	if code != http.StatusOK || !strings.HasPrefix(header.Get("Content-Type"), "text/csv") ||
+		!strings.Contains(header.Get("Content-Disposition"), `attachment; filename="compare_changed_run1-2.csv"`) {
+		t.Fatalf("csv: %d %v %s", code, header, body)
+	}
+
+	for _, c := range []struct {
+		path string
+		want int
+	}{
+		// no runs
+		{"/analytics/compare/lists/changed", http.StatusBadRequest},
+		{"/analytics/compare/lists/changed?base=1", http.StatusBadRequest},
+		{"/analytics/compare/csv/changed?base=abc&target=2", http.StatusBadRequest},
+		// control-api says unknown list
+		{"/analytics/compare/lists/nonsense?base=1&target=2", http.StatusNotFound},
+		{"/analytics/compare/csv/nonsense?base=1&target=2", http.StatusNotFound},
+	} {
+		if code, _, _ := fetch(c.path); code != c.want {
+			t.Errorf("%s: %d, want %d", c.path, code, c.want)
+		}
+	}
+}
+
+// The single-run page after the dialog moved to analytics-dialog.js: it still
+// carries the dialog, loads the shared script before its own, offers the
+// comparison, and both scripts are served.
+func TestAnalyticsPageUsesSharedDialog(t *testing.T) {
+	_, ts := analyticsFake(t)
+
+	page := get(t, ts, "/analytics")
+	iDialog, iPage := strings.Index(page, "/static/analytics-dialog.js"), strings.Index(page, "/static/analytics.js")
+	if iDialog < 0 || iPage < 0 || iDialog > iPage {
+		t.Fatalf("analytics-dialog.js must come before analytics.js (%d, %d):\n%s", iDialog, iPage, page)
+	}
+	for _, want := range []string{`id="an-dlg"`, `id="an-dlg-tbl"`, `id="an-dlg-csv"`, `id="an-tip"`, `href="/analytics/compare?target=2"`} {
+		if !strings.Contains(page, want) {
+			t.Fatalf("expected %q in the page, got:\n%s", want, page)
+		}
+	}
+	for path, want := range map[string]string{
+		"/static/analytics-dialog.js":  "window.AnalyticsDialog =",
+		"/static/analytics.js":         "window.AnalyticsDialog",
+		"/static/analytics-compare.js": "window.AnalyticsDialog",
+	} {
+		if body := get(t, ts, path); !strings.Contains(body, want) {
+			t.Errorf("%s does not contain %q", path, want)
+		}
+	}
+}
+
 // The sidebar: no window-chrome dots next to the logo, the Analytics entry,
 // and the link state, theme toggle and logout above the navigation.
 func TestSidebarSessionBlockOnTop(t *testing.T) {
@@ -232,3 +414,15 @@ func TestRegistryDrillDownFromAnalytics(t *testing.T) {
 		t.Fatalf("a malformed subnet must be ignored: %q", last)
 	}
 }
+
+// The filter of a comparison list goes to control-api as it is.
+func TestAnalyticsCompareListPath(t *testing.T) {
+	got := analyticsCompareListPath(1, 2, "common", compareFilter{Indicator: "verdict_pass", From: "partial", To: "pass"}, true)
+	want := "/api/v1/admin/analytics/compare/lists/common?base=1&format=csv&from=partial&indicator=verdict_pass&target=2&to=pass"
+	if got != want {
+		t.Errorf("path = %q, want %q", got, want)
+	}
+	if got := analyticsCompareListPath(3, 4, "new", compareFilter{}, false); got != "/api/v1/admin/analytics/compare/lists/new?base=3&target=4" {
+		t.Errorf("path = %q", got)
+	}
+}