twooey/bookstore
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix seven medium-severity bugs from the full-session code review

Browse Source 
- SupplierOffer::insert(): now checks $wpdb->insert()'s return value and
  throws, matching Work/Edition/Isbn (the one Catalog class that hadn't
  been hardened this way). Work::set_product_id() gets the same treatment
  (was flagged low-severity but same fix, bundled here) — a real update
  failure now counts as a per-work sync failure instead of silently
  leaving a stale wc_product_id pointer.

- SupplierOffer: fetched_at was written via current_time('mysql') (site-
  local) while expires_at (SyntheticOfferGenerator) is written in UTC, and
  best_offer_for_isbns() compared against site-local time too — a mismatch
  masked today only because dev's gmt_offset is 0. Switched both writer and
  reader to current_time('mysql', true) (UTC). Verified the read path
  still finds all active offers correctly under a simulated -5 (US
  Eastern) offset, not just at offset 0.

- HardcoverAdapter: rate-limit throttling moved from "once per work" (in
  Commands.php) to "once per actual HTTP request" (inside query() itself).
  find_book()'s ISBN-then-title/author fallback can fire two real requests
  per work — under the old scheme both shared one throttle sleep, roughly
  doubling the real request rate against a beta API. query() also now
  retries network errors/5xx/429 up to 3x (mirroring
  OpenLibraryAdapter::get_with_retry()), while a GraphQL-level `errors` field
  or other 4xx throws immediately (retrying a rejected query can't fix it).
  Commands.php adds a 5-consecutive-failure circuit breaker so a bad token
  or a wrong field in the still-unverified schema can't silently burn
  through the whole catalog with zero progress. Verified all of this
  directly against Hardcover's real API with a deliberately invalid token:
  5 fast (non-retried) 401s, correct abort message, and confirmed the
  failed works were NOT marked synced (so a real token can retry them).

- restore.sh: now drops and recreates the target database before restoring
  the dump, and clears the uploads directory before extracting the
  archive — previously both restored on top of existing state, so a stray
  table or file NOT in the backup would silently survive a restore drill.
  Verified end-to-end against a real local staging stack: planted a stray
  table and a stray upload file after taking a backup, ran restore.sh, and
  confirmed both were gone afterward while the actual backed-up data (20
  works, a known upload file) came back correctly. Also fixed a real
  permission gap hit during that same test: a fresh volume's uploads dir
  is root-owned until something chowns it, which broke the new www-data
  clear step — now clears as root and chowns to www-data afterward, which
  also means restore self-heals the exact root-owned-uploads class of bug
  fixed earlier this session for the cron sidecar.

- poll-deploy.sh: added a non-blocking flock so a deploy that runs longer
  than the cron interval can't have a second poll fire mid-deploy and race
  its git checkout/reset against the same live working tree. Verified: a
  concurrent run correctly skips instantly while the lock is held, and
  proceeds normally once it's released. (Full atomicity of the live PHP
  file swap under real traffic is a bigger architectural question —
  blue-green or symlinked releases — flagged to the user rather than
  attempted here.)

- backup.sh: now also archives .env.<environment> itself (chmod 600) and
  includes it in the off-host rclone sync alongside the DB dump and
  uploads archive. Every API key and both DB passwords previously lived
  only on the host in this one gitignored file — losing the host lost all
  of it even with DB/uploads backups intact.
This commit is contained in:
twooey
2026-08-27 15:50:49 -04:00
parent df34fe8e54
commit 1020a496ab
8 changed files with 167 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-content/plugins/bookstore-core/includes/Catalog/SupplierOffer.php
+15 -3
View File
@@ -23,7 +23,7 @@ class SupplierOffer
?string $expires_at
): void {
global $wpdb;
$wpdb->insert(self::table(), [
$result = $wpdb->insert(self::table(), [
'isbn13' => $isbn13,
'supplier_code' => $supplier_code,
'condition' => $condition,
@@ -31,10 +31,20 @@ class SupplierOffer
'base_price' => $base_price,
'supplier_ship' => $supplier_ship,
'currency' => 'USD',
'fetched_at' => current_time('mysql'),
// $gmt=true: expires_at (SyntheticOfferGenerator) is written in
// UTC via gmdate(), and best_offer_for_isbns() below compares
// against this same clock — current_time('mysql') without $gmt
// returns site-LOCAL time, which would silently misjudge offer
// expiry by the site's UTC offset the moment one is configured
// (confirmed: dev's offset is currently 0, masking this until
// then). Both reads and writes here must agree on UTC.
'fetched_at' => current_time('mysql', true),
'expires_at' => $expires_at,
'status' => $status,
]);
if ($result === false) {
throw new \RuntimeException('bsc_supplier_offer insert failed: ' . $wpdb->last_error . ' (isbn13: ' . $isbn13 . ')');
}
}
/**
@@ -55,7 +65,9 @@ class SupplierOffer
AND (expires_at IS NULL OR expires_at > %s)
ORDER BY (base_price + supplier_ship) ASC
LIMIT 1";
$row = $wpdb->get_row($wpdb->prepare($sql, [...$isbn13s, current_time('mysql')]));
// $gmt=true — see the comment on insert()'s fetched_at: expires_at is
// stored in UTC, so the comparison clock must be UTC too.
$row = $wpdb->get_row($wpdb->prepare($sql, [...$isbn13s, current_time('mysql', true)]));
return $row ?: null;
}
wp-content/plugins/bookstore-core/includes/Catalog/Work.php
+4 -1
View File
@@ -42,7 +42,10 @@ class Work
public static function set_product_id(int $work_id, int $wc_product_id): void
{
global $wpdb;
$wpdb->update(self::table(), ['wc_product_id' => $wc_product_id], ['work_id' => $work_id]);
$result = $wpdb->update(self::table(), ['wc_product_id' => $wc_product_id], ['work_id' => $work_id]);
if ($result === false) {
throw new \RuntimeException('bsc_work.wc_product_id update failed: ' . $wpdb->last_error . " (work_id: {$work_id})");
}
}
/** @return object[] */
wp-content/plugins/bookstore-core/includes/Cli/Commands.php
+27 -5
View File
@@ -148,6 +148,17 @@ class Commands
$offset = 0;
$batch_size = 50;
// HardcoverAdapter::query() already retries transient failures (3x)
// before throwing, so an exception reaching here has already
// survived retries — if it keeps happening back-to-back, that's not
// per-book flakiness, it's systemic (bad token, an unverified-schema
// field name that's actually wrong, the endpoint down). Without this,
// a bad token would silently burn through the entire catalog with
// zero matches and zero progress.
$consecutive_failures = 0;
$max_consecutive_failures = 5;
$circuit_tripped = false;
while ($processed < $limit) {
$works = Work::all_paginated($batch_size, $offset);
if (empty($works)) {
@@ -169,9 +180,10 @@ class Commands
$isbns = Isbn::isbns_for_work((int) $work->work_id);
$isbn13 = $isbns[0] ?? '';
$processed++;
try {
$book = HardcoverAdapter::find_book($isbn13, $work->title, $work->primary_author);
$book = HardcoverAdapter::find_book($isbn13, $work->title, $work->primary_author, $delay_ms);
if ($book) {
$tags = HardcoverAdapter::tags_for_book($book);
// wp_set_object_terms() with an empty array CLEARS the
@@ -196,14 +208,18 @@ class Commands
$missed++;
}
update_post_meta($product_id, '_bsc_hardcover_synced_at', current_time('mysql'));
$consecutive_failures = 0;
} catch (\RuntimeException $e) {
\WP_CLI::warning("work_id={$work->work_id} ({$work->title}): " . $e->getMessage());
$missed++;
$consecutive_failures++;
if ($consecutive_failures >= $max_consecutive_failures) {
\WP_CLI::warning("Aborting: {$consecutive_failures} consecutive Hardcover API failures — this looks systemic (bad token, an incorrect field in the unverified query schema, the endpoint down), not per-book misses. Fix the underlying issue and re-run; already-synced works are untouched.");
$circuit_tripped = true;
break 2;
}
}
$processed++;
HardcoverAdapter::throttle($delay_ms);
if ($processed % 20 === 0) {
\WP_CLI::log(" processed {$processed} (matched {$matched}, missed {$missed})...");
}
@@ -212,7 +228,13 @@ class Commands
$offset += $batch_size;
}
\WP_CLI::success("Hardcover sync: {$matched} matched, {$missed} missed, {$processed} processed.");
\WP_CLI::success(sprintf(
'Hardcover sync: %d matched, %d missed, %d processed%s.',
$matched,
$missed,
$processed,
$circuit_tripped ? ' (aborted early — see warning above)' : ''
));
}
/**
wp-content/plugins/bookstore-core/includes/Integration/HardcoverAdapter.php
+67 -28
View File
@@ -47,10 +47,16 @@ class HardcoverAdapter
* to title+author search (needed for the current Gutenberg-synthetic
* catalog, whose ISBNs are fake). Fuzzy by nature — a miss returns
* null rather than guessing wrong.
*
* $delay_ms is threaded down to every actual GraphQL request made
* (query() throttles itself, once per request — see its docblock) —
* NOT applied once per find_book() call. A miss on the ISBN lookup
* falls through to a second real HTTP request, and rate-limit spacing
* needs to track actual requests made, not logical calls.
*/
public static function find_book(string $isbn13, string $title, ?string $author): ?array
public static function find_book(string $isbn13, string $title, ?string $author, int $delay_ms = self::DEFAULT_DELAY_MS): ?array
{
return self::find_by_isbn($isbn13) ?? self::find_by_title_author($title, $author);
return self::find_by_isbn($isbn13, $delay_ms) ?? self::find_by_title_author($title, $author, $delay_ms);
}
/**
@@ -84,7 +90,7 @@ class HardcoverAdapter
usleep($delay_ms * 1000);
}
private static function find_by_isbn(string $isbn13): ?array
private static function find_by_isbn(string $isbn13, int $delay_ms): ?array
{
$query = <<<'GQL'
query FindByIsbn($isbn: String!) {
@@ -101,11 +107,11 @@ class HardcoverAdapter
}
GQL;
$data = self::query($query, ['isbn' => $isbn13]);
$data = self::query($query, ['isbn' => $isbn13], $delay_ms);
return $data['editions'][0]['book'] ?? null;
}
private static function find_by_title_author(string $title, ?string $author): ?array
private static function find_by_title_author(string $title, ?string $author, int $delay_ms): ?array
{
$query = <<<'GQL'
query FindByTitle($q: String!) {
@@ -125,7 +131,7 @@ class HardcoverAdapter
}
GQL;
$candidates = self::query($query, ['q' => '%' . $title . '%'])['books'] ?? [];
$candidates = self::query($query, ['q' => '%' . $title . '%'], $delay_ms)['books'] ?? [];
if (empty($candidates)) {
return null;
}
@@ -145,37 +151,70 @@ class HardcoverAdapter
return $candidates[0]; // title matched, author unconfirmed — best-effort, not silent
}
private static function query(string $query, array $variables = []): array
/**
* One real HTTP request per call (plus retries — see below), so this is
* the single place that both throttles and retries, rather than leaving
* either to callers. Throttles once per call, before the first attempt —
* find_book() can trigger up to two of these (ISBN miss -> title/author
* fallback), and each is its own request against Hardcover's rate limit,
* not a fraction of one.
*
* Retries network errors/5xx/429 up to 3 attempts (mirrors
* OpenLibraryAdapter::get_with_retry()'s reasoning) — NOT a GraphQL-level
* `errors` response on a 200, and not other 4xx: those are the query
* itself being rejected (bad field name, auth failure, etc.), which a
* retry can't fix. Given the schema here is unverified, a systematically
* wrong query would otherwise retry 3x on literally every single work in
* the catalog for no benefit — callers should treat a thrown exception
* here as a signal to stop, not just log and continue (see Commands.php's
* consecutive-failure circuit breaker).
*/
private static function query(string $query, array $variables, int $delay_ms): array
{
$token = self::token();
if (!$token) {
throw new \RuntimeException('HARDCOVER_API_TOKEN_FILE is not set or empty');
}
$response = wp_remote_post(self::ENDPOINT, [
'timeout' => 20,
'headers' => [
'Content-Type' => 'application/json',
'Authorization' => 'Bearer ' . $token,
],
'body' => wp_json_encode(['query' => $query, 'variables' => $variables]),
]);
self::throttle($delay_ms);
if (is_wp_error($response)) {
throw new \RuntimeException('Hardcover API request failed: ' . $response->get_error_message());
$max_attempts = 3;
$retry_delay_ms = 500;
$last_error = 'Hardcover API request failed after retries';
for ($attempt = 1; $attempt <= $max_attempts; $attempt++) {
$response = wp_remote_post(self::ENDPOINT, [
'timeout' => 20,
'headers' => [
'Content-Type' => 'application/json',
'Authorization' => 'Bearer ' . $token,
],
'body' => wp_json_encode(['query' => $query, 'variables' => $variables]),
]);
if (is_wp_error($response)) {
$last_error = 'Hardcover API request failed: ' . $response->get_error_message();
} else {
$code = wp_remote_retrieve_response_code($response);
if ($code === 200) {
$body = json_decode(wp_remote_retrieve_body($response), true);
if (isset($body['errors'])) {
throw new \RuntimeException('Hardcover API errors: ' . wp_json_encode($body['errors']));
}
return $body['data'] ?? [];
}
if ($code < 500 && $code !== 429) {
throw new \RuntimeException("Hardcover API returned HTTP {$code}: " . wp_remote_retrieve_body($response));
}
$last_error = "Hardcover API returned HTTP {$code}: " . wp_remote_retrieve_body($response);
}
if ($attempt < $max_attempts) {
usleep($retry_delay_ms * 1000);
}
}
$code = wp_remote_retrieve_response_code($response);
$body = json_decode(wp_remote_retrieve_body($response), true);
if ($code !== 200) {
throw new \RuntimeException("Hardcover API returned HTTP {$code}: " . wp_remote_retrieve_body($response));
}
if (isset($body['errors'])) {
throw new \RuntimeException('Hardcover API errors: ' . wp_json_encode($body['errors']));
}
return $body['data'] ?? [];
throw new \RuntimeException($last_error);
}
/** Defensive: accepts plain strings or {tag|name: string} objects — exact shape unverified. */