coverband 6.2.2 → 7.0.0.rc.2

data/lib/coverband/configuration.rb

@@ -5,13 +5,23 @@ module Coverband
   # Configuration parsing and options for the coverband gem.
   ###
   class Configuration
+    def self.add_tracker_flag(name, default: false)
+      name = name.to_sym
+      attr_accessor name
+      dynamic_flag_defaults[name] = default
+    end
+
+    def self.dynamic_flag_defaults
+      @dynamic_flag_defaults ||= {}
+    end
+
     attr_accessor :root_paths, :root,
       :verbose,
-      :reporter, :redis_namespace, :redis_ttl,
+      :redis_namespace, :redis_ttl,
       :background_reporting_enabled,
-      :test_env, :web_enable_clear, :gem_details, :web_debug, :report_on_exit,
-      :use_oneshot_lines_coverage, :simulate_oneshot_lines_coverage,
-      :view_tracker, :defer_eager_loading_data,
+      :test_env, :web_enable_clear, :web_debug, :report_on_exit,
+      :use_oneshot_lines_coverage,
+      :track_views, :view_tracker, :defer_eager_loading_data,
       :track_routes, :track_redirect_routes, :route_tracker,
       :track_translations, :translations_tracker,
       :track_query_bursts, :query_burst_tracker,
@@ -19,20 +29,42 @@ module Coverband
       :trackers, :csp_policy, :hide_settings,
       :mcp_enabled
 
-    attr_writer :logger, :s3_region, :s3_bucket, :s3_access_key_id,
-      :s3_secret_access_key, :password, :api_key, :service_url, :coverband_timeout, :service_dev_mode,
-      :service_test_mode, :process_type, :track_views, :redis_url,
+    attr_writer :logger, :password, :redis_url,
       :background_reporting_sleep_seconds, :reporting_wiggle,
       :send_deferred_eager_loading_data, :paged_reporting, :mcp_allowed_environments, :mcp_password
 
-    attr_reader :track_gems, :ignore
+    attr_reader :ignore
+
+    HOSTED_SERVICE_REMOVED = "coverband.io is no longer maintained and support for it was removed. " \
+      "Delete the setting and configure a store, see Upgrading to 7.0 in the README"
+
+    # Settings removed in 7.0. Assigning one logs how to upgrade rather than
+    # raising NoMethodError from the app's config file during boot.
+    REMOVED_SETTINGS = {
+      reporter: "it has had no effect since Coverband 5.0. Delete the setting",
+      api_key: HOSTED_SERVICE_REMOVED,
+      service_url: HOSTED_SERVICE_REMOVED,
+      coverband_timeout: HOSTED_SERVICE_REMOVED,
+      service_dev_mode: HOSTED_SERVICE_REMOVED,
+      service_test_mode: HOSTED_SERVICE_REMOVED,
+      process_type: HOSTED_SERVICE_REMOVED,
+      s3_region: "the S3 report upload was removed earlier and this setting did nothing. Delete the setting",
+      s3_bucket: "the S3 report upload was removed earlier and this setting did nothing. Delete the setting",
+      s3_access_key_id: "the S3 report upload was removed earlier and this setting did nothing. Delete the setting",
+      s3_secret_access_key: "the S3 report upload was removed earlier and this setting did nothing. Delete the setting",
+      track_gems: "gem tracking was removed earlier and this setting did nothing. Delete the setting",
+      gem_details: "gem tracking was removed earlier and this setting did nothing. Delete the setting",
+      simulate_oneshot_lines_coverage: "it had no production effect. Delete the setting"
+    }.freeze
+
+    REMOVED_SETTINGS.each do |name, fix|
+      define_method(:"#{name}=") do |_value|
+        logger.warn "Coverband: config.#{name} was removed in 7.0 and is ignored, #{fix}"
+      end
+    end
 
-    #####
-    # TODO: This is is brittle and not a great solution to avoid deploy time
-    # actions polluting the 'runtime' metrics
-    #
-    # * Perhaps detect heroku deployment ENV var opposed to tasks?
-    #####
+    # Tasks that load application code for deployment or maintenance should not
+    # contribute to production runtime coverage.
     IGNORE_TASKS = ["coverband:clear",
       "coverband:coverage",
       "coverband:coverage_server",
@@ -67,7 +99,6 @@ module Coverband
       @ignore = IGNORE_DEFAULTS.map { |ignore_str| Regexp.new(ignore_str) }
       @search_paths = TRACKED_DEFAULT_PATHS.dup
       @verbose = false
-      @reporter = "scov"
       @logger = nil
       @store = nil
       @background_reporting_enabled = true
@@ -90,7 +121,6 @@ module Coverband
       @web_debug = false
       @report_on_exit = true
       @use_oneshot_lines_coverage = ENV["ONESHOT"] || false
-      @simulate_oneshot_lines_coverage = false # this is being deprecated
       @current_root = nil
       @all_root_paths = nil
       @all_root_patterns = nil
@@ -103,56 +133,39 @@ module Coverband
       @mcp_password = nil
       @mcp_allowed_environments = %w[development test]
 
-      # coverband service settings
-      @api_key = nil
-      @service_url = nil
-      @coverband_timeout = nil
-      @service_dev_mode = nil
-      @service_test_mode = nil
-      @process_type = nil
-
       @redis_url = nil
       @redis_namespace = nil
       @redis_ttl = 2_592_000 # in seconds. Default is 30 days.
       @reporting_wiggle = nil
 
       @trackers = []
-
-      # TODO: these are deprecated
-      @s3_region = nil
-      @s3_bucket = nil
-      @s3_access_key_id = nil
-      @s3_secret_access_key = nil
-      @track_gems = false
-      @gem_details = false
+      @registered_trackers = {}
+      self.class.dynamic_flag_defaults.each do |name, default|
+        instance_variable_set(:"@#{name}", default)
+      end
     end
 
     def railtie!
-      if Coverband.configuration.track_routes
-        Coverband.configuration.route_tracker = Coverband::Collectors::RouteTracker.new
-        trackers << Coverband.configuration.route_tracker
-      end
-
-      if Coverband.configuration.track_translations
-        Coverband.configuration.translations_tracker = Coverband::Collectors::TranslationTracker.new
-        trackers << Coverband.configuration.translations_tracker
-      end
-
-      if Coverband.configuration.track_views
-        Coverband.configuration.view_tracker = if Coverband.coverband_service?
-          Coverband::Collectors::ViewTrackerService.new
-        else
-          Coverband::Collectors::ViewTracker.new
+      unless store.supports_trackers?
+        if Coverband::Collectors::TrackerRegistry.registry.any? { |_name, entry| entry.enabled_proc.call(self) }
+          logger.info "Coverband: #{store.class.name} does not support tracking, " \
+            "view/route/translation/query burst trackers are disabled. " \
+            "Coverband::Adapters::ActiveSupportCacheStore supports tracking on any ActiveSupport::Cache store."
         end
-        trackers << Coverband.configuration.view_tracker
+        return
       end
 
-      if Coverband.configuration.track_query_bursts
-        Coverband.configuration.query_burst_tracker = Coverband::Collectors::QueryBurstTracker.new
-        trackers << Coverband.configuration.query_burst_tracker
+      Coverband::Collectors::TrackerRegistry.each do |entry|
+        next unless entry.enabled_proc.call(self)
+
+        tracker = build_tracker(entry)
+        setter = :"#{entry.name}="
+        public_send(setter, tracker) if respond_to?(setter)
+        registered_trackers[entry.name] = tracker
+        trackers << tracker
       end
       trackers.each { |tracker| tracker.railtie! }
-    rescue Redis::CannotConnectError => e
+    rescue *Coverband.redis_connection_errors => e
       Coverband.configuration.logger.info "Redis is not available (#{e}), Coverband not configured"
       Coverband.configuration.logger.info "If this is a setup task like assets:precompile feel free to ignore"
     end
@@ -170,6 +183,13 @@ module Coverband
       route_tracker
     end
 
+    # Look up an initialized tracker by its registered name. Bundled trackers
+    # also have their own accessor, trackers registered by an app or gem only
+    # have this.
+    def tracker_for(name)
+      registered_trackers[name.to_sym]
+    end
+
     def password
       @password || ENV["COVERBAND_PASSWORD"]
     end
@@ -195,13 +215,14 @@ module Coverband
       @mcp_allowed_environments || %w[development test]
     end
 
-    # The adjustments here either protect the redis or service from being overloaded
+    # The adjustments here protect the store from being overloaded
     # the tradeoff being the delay in when reporting data is available
     # if running your own redis increasing this number reduces load on the redis CPU
     def background_reporting_sleep_seconds
-      @background_reporting_sleep_seconds ||= if service?
-        # default to 10m for service
-        (Coverband.configuration.coverband_env == "production") ? 600 : 60
+      @background_reporting_sleep_seconds ||= if store.is_a?(Coverband::Adapters::ActiveSupportCacheStore)
+        # every report rewrites a whole document, and a cache backed store is
+        # the one most likely to be shared with the host application
+        600
       elsif store.is_a?(Coverband::Adapters::HashRedisStore)
         # Default to 5 minutes if using the hash redis store
         300
@@ -215,20 +236,18 @@ module Coverband
     end
 
     def store
-      @store ||= if service?
-        if ENV["COVERBAND_REDIS_URL"]
-          raise "invalid configuration: unclear default store coverband expects either api_key or redis_url"
-        end
-
-        require "coverband/adapters/web_service_store"
-        Coverband::Adapters::WebServiceStore.new(service_url)
+      @store ||= if !Coverband.redis_available?
+        logger.warn "Coverband: no store configured and the redis gem is not installed, so coverage is not being recorded"
+        logger.warn "Coverband: add `gem \"redis\"` to your Gemfile to use the default Redis store, or configure one: config.store = Coverband::Adapters::ActiveSupportCacheStore.new { Rails.cache }"
+        require "coverband/adapters/null_store"
+        Coverband::Adapters::NullStore.new
       else
         begin
           # Redis gem automatically enables TLS when the scheme is 'rediss://'
           # For serverless ElastiCache or other TLS-required Redis instances, use:
           #   REDIS_URL=rediss://your-endpoint:6379
           Coverband::Adapters::RedisStore.new(Redis.new(url: redis_url), redis_store_options)
-        rescue Redis::CannotConnectError => error
+        rescue *Coverband.redis_connection_errors => error
           logger.info "Redis is not available (#{error}), defaulting to NullStore"
           logger.info "If this is intended, please explicitly configure your store: config.store = Coverband::Adapters::FileStore.new('log/coverage')"
           require "coverband/adapters/null_store"
@@ -239,24 +258,10 @@ module Coverband
 
     def store=(store)
       raise "Pass in an instance of Coverband::Adapters" unless store.is_a?(Coverband::Adapters::Base)
-      if api_key && store.class.to_s != "Coverband::Adapters::WebServiceStore"
-        raise "invalid configuration: only coverband service expects an API Key"
-      end
-      if ENV["COVERBAND_REDIS_URL"] &&
-          defined?(::Coverband::Adapters::WebServiceStore) &&
-          store.instance_of?(::Coverband::Adapters::WebServiceStore)
-        raise "invalid configuration: coverband service shouldn't have redis url set"
-      end
 
       @store = store
     end
 
-    def track_views
-      return false if service_disabled_dev_test_env?
-
-      @track_views
-    end
-
     ###
     # Search Paths
     ###
@@ -295,7 +300,7 @@ module Coverband
       @all_root_patterns ||= all_root_paths.map { |path| /^#{path}/ }.freeze
     end
 
-    SKIPPED_SETTINGS = %w[@s3_secret_access_key @store @api_key @password @mcp_password]
+    SKIPPED_SETTINGS = %w[@store @password @mcp_password]
     def to_h
       instance_variables
         .each_with_object({}) do |var, hash|
@@ -307,38 +312,10 @@ module Coverband
       @redis_url ||= ENV["COVERBAND_REDIS_URL"] || ENV["REDIS_URL"]
     end
 
-    def api_key
-      @api_key ||= ENV["COVERBAND_API_KEY"]
-    end
-
-    def service_url
-      @service_url ||= ENV["COVERBAND_URL"] || "https://coverband.io"
-    end
-
     def coverband_env
       ENV["RACK_ENV"] || ENV["RAILS_ENV"] || ((defined?(Rails) && Rails.respond_to?(:env)) ? Rails.env : "unknown")
     end
 
-    def coverband_timeout
-      @coverband_timeout ||= (coverband_env == "development") ? 5 : 2
-    end
-
-    def service_dev_mode
-      @service_dev_mode ||= ENV["COVERBAND_ENABLE_DEV_MODE"] || false
-    end
-
-    def service_test_mode
-      @service_test_mode ||= ENV["COVERBAND_ENABLE_TEST_MODE"] || false
-    end
-
-    def process_type
-      @process_type ||= ENV["PROCESS_TYPE"] || "unknown"
-    end
-
-    def service?
-      Coverband.coverband_service? || !api_key.nil?
-    end
-
     def defer_eager_loading_data?
       @defer_eager_loading_data
     end
@@ -351,35 +328,22 @@ module Coverband
       !!@paged_reporting
     end
 
-    def service_disabled_dev_test_env?
-      return false unless service?
-
-      (coverband_env == "test" && !Coverband.configuration.service_test_mode) ||
-        (coverband_env == "development" && !Coverband.configuration.service_dev_mode)
-    end
-
-    def s3_bucket
-      puts "deprecated, s3 is no longer support"
-    end
-
-    def s3_region
-      puts "deprecated, s3 is no longer support"
-    end
-
-    def s3_access_key_id
-      puts "deprecated, s3 is no longer support"
-    end
+    private
 
-    def s3_secret_access_key
-      puts "deprecated, s3 is no longer support"
+    def registered_trackers
+      @registered_trackers ||= {}
     end
 
-    def track_gems=(_value)
-      puts "gem tracking is deprecated, setting this will be ignored & eventually removed"
+    def build_tracker(entry)
+      tracker = if entry.tracker_class.respond_to?(:call)
+        entry.tracker_class.call
+      else
+        entry.tracker_class.new
+      end
+      Coverband::Collectors::TrackerRegistry.validate_report_route!(entry.name, tracker.class)
+      tracker
     end
 
-    private
-
     def redis_store_options
       {ttl: Coverband.configuration.redis_ttl,
        redis_namespace: Coverband.configuration.redis_namespace}

data/lib/coverband/mcp/http_handler.rb

@@ -93,7 +93,7 @@ module Coverband
         return false unless token
 
         # Compare with configured MCP password
-        token == mcp_password
+        Rack::Utils.secure_compare(mcp_password.to_s, token)
       end
 
       def transport

data/lib/coverband/mcp/server.rb

@@ -7,6 +7,7 @@ require_relative "tools/get_dead_methods"
 require_relative "tools/get_view_tracker_data"
 require_relative "tools/get_route_tracker_data"
 require_relative "tools/get_translation_tracker_data"
+require_relative "tools/get_storage_health"
 
 module Coverband
   module MCP
@@ -66,6 +67,7 @@ module Coverband
             - get_view_tracker_data
             - get_route_tracker_data
             - get_translation_tracker_data
+            - get_storage_health
 
           For Claude Desktop, configure with:
             {
@@ -108,7 +110,8 @@ module Coverband
           Tools::GetDeadMethods,
           Tools::GetViewTrackerData,
           Tools::GetRouteTrackerData,
-          Tools::GetTranslationTrackerData
+          Tools::GetTranslationTrackerData,
+          Tools::GetStorageHealth
         ]
       end
     end

data/lib/coverband/mcp/tools/get_storage_health.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Coverband
+  module MCP
+    module Tools
+      class GetStorageHealth < ::MCP::Tool
+        description "Get Coverband's observed coverage and tracker storage protocol state, " \
+                    "including stalled writes and recorded data loss. This is not an active backend probe."
+
+        input_schema(
+          properties: {}
+        )
+
+        def self.call(server_context:, **)
+          ::MCP::Tool::Response.new([{
+            type: "text",
+            text: JSON.pretty_generate(Coverband.storage_health)
+          }])
+        rescue => e
+          ::MCP::Tool::Response.new([{
+            type: "text",
+            text: "Error getting storage health: #{e.message}"
+          }])
+        end
+      end
+    end
+  end
+end

data/lib/coverband/reporters/base.rb

@@ -84,8 +84,6 @@ module Coverband
         # basically because paths on machines or deployed hosts could be different, so
         # two different keys could point to the same filename or `line_key`
         # this happens when deployment has a dynamic path or the path change during deployment (hot code reload)
-        # TODO: think we are filtering based on ignore while sending to the store
-        # and as we also pull it out here
         ###
         def get_current_scov_data_imp(store, roots, options = {})
           scov_style_report = {}

data/lib/coverband/reporters/html_report.rb

@@ -9,14 +9,13 @@ module Coverband
       def initialize(store, options = {})
         self.page = options.fetch(:page) { nil }
         self.open_report = options.fetch(:open_report) { true }
-        # TODO: refactor notice out to top level of web only
         self.notice = options.fetch(:notice) { nil }
         self.base_path = options.fetch(:base_path) { "./" }
         self.filename = options.fetch(:filename) { nil }
 
         coverband_reports = Coverband::Reporters::Base.report(store, options)
-        # NOTE: at the moment the optimization around paging and filenames only works for hash redis store
-        self.filtered_report_files = if (page || filename) && store.is_a?(Coverband::Adapters::HashRedisStore)
+        # paging and filename optimization only exists on stores that declare it
+        self.filtered_report_files = if (page || filename) && store.supports_paged_reports?
           coverband_reports
         else
           self.class.fix_reports(coverband_reports)

data/lib/coverband/reporters/json_report.rb

@@ -85,7 +85,8 @@ module Coverband
 
         data = {
           **coverage_totals(source_files),
-          files: coverage_files(result, source_files)
+          files: coverage_files(result, source_files),
+          storage_health: Coverband.storage_health(coverage: store)
         }
 
         if as_report
@@ -114,7 +115,6 @@ module Coverband
           data["iTotalDisplayRecords"] = filesreported
           data["aaData"] = row_data
           data.delete(:files)
-          data = data.as_json
         end
         data.to_json
       end

data/lib/coverband/reporters/web.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "base64"
 require "coverband"
 
 begin
@@ -42,11 +41,11 @@ module Coverband
       def check_auth
         return true unless Coverband.configuration.password
 
-        # support rack 1.6.x and rack 2.0 (get_header)
-        auth_header = request.respond_to?(:get_header) ? request.get_header("HTTP_AUTHORIZATION") : request.env["HTTP_AUTHORIZATION"]
-        return unless auth_header
+        auth = Rack::Auth::Basic::Request.new(request.env)
+        return false unless auth.provided? && auth.basic? && auth.credentials
 
-        Coverband.configuration.password == Base64.decode64(auth_header.split[1]).split(":")[1]
+        # credentials splits on the first colon only, so passwords may contain one
+        Rack::Utils.secure_compare(Coverband.configuration.password.to_s, auth.credentials.last.to_s)
       end
 
       def self.call(env)
@@ -114,6 +113,7 @@ module Coverband
       def index
         notice = "<strong>Notice:</strong> #{Rack::Utils.escape_html(request.params["notice"])}<br/>"
         notice = request.params["notice"] ? notice : ""
+        notice += storage_notices(Coverband.configuration.store, subject: "coverage")
         page = (request.params["page"] || 1).to_i
         options = {
           static: false,
@@ -153,6 +153,7 @@ module Coverband
       def display_abstract_tracker(tracker)
         notice = "<strong>Notice:</strong> #{Rack::Utils.escape_html(request.params["notice"])}<br/>"
         notice = request.params["notice"] ? notice : ""
+        notice += storage_notices(tracker, subject: "tracker")
         used_keys_sort = tracker_used_keys_sort_mode(tracker)
         options = {
           tracker: tracker,
@@ -189,11 +190,14 @@ module Coverband
       end
 
       def clear
-        if Coverband.configuration.web_enable_clear
-          Coverband.configuration.store.clear!
-          notice = "coverband coverage cleared"
+        notice = if Coverband.configuration.web_enable_clear
+          if Coverband.configuration.store.clear! == false
+            "coverage clear failed, the store did not accept the write"
+          else
+            "coverband coverage cleared"
+          end
         else
-          notice = "web_enable_clear isn't enabled in your configuration"
+          "web_enable_clear isn't enabled in your configuration"
         end
         [302, {"Location" => "#{base_path}?notice=#{notice}"}, []]
       end
@@ -202,19 +206,72 @@ module Coverband
         if Coverband.configuration.web_enable_clear
           filename = request.params["filename"]
           Coverband.configuration.store.clear_file!(filename)
-          notice = "coverage for file #{filename} cleared"
+          notice = "coverage clear submitted for file #{filename}, applied within a reporting cycle"
         else
           notice = "web_enable_clear isn't enabled in your configuration"
         end
         [302, {"Location" => "#{base_path}?notice=#{notice}"}, []]
       end
 
+      ###
+      # A cache can drop what we wrote, and a conflicted delta can outlive its
+      # retention caps. Both are repaired as far as they can be, but the numbers
+      # on screen are partial after either, so say so rather than implying the
+      # report is complete.
+      ###
+      ###
+      # Nothing is lost, but nothing is arriving either, and an empty tab reads
+      # exactly like an app that used nothing. Process-local, unlike a recorded
+      # loss -- when the failure is that nothing can be stored, what this process
+      # is holding is the only evidence there is.
+      ###
+      def storage_notices(source, subject:)
+        health = Coverband::StorageHealth.for_source(source)
+        data_loss_notice(health, subject: subject) + unwritten_notice(health, subject: subject)
+      end
+
+      def unwritten_notice(health, subject:)
+        held = health[:unwritten]
+        return "" unless held
+
+        deltas = held[:deltas]
+        "<strong>Notice:</strong> #{deltas} #{subject} #{(deltas == 1) ? "report" : "reports"} " \
+          "could not be stored, the oldest since #{held[:since]}. What is shown is missing them, " \
+          "and the log says why each write was refused.<br/>"
+      end
+
+      def data_loss_notice(health, subject:)
+        loss = health[:data_loss]
+        return "" unless loss
+
+        detail = Rack::Utils.escape_html(loss[:detail].to_s)
+        kind = Rack::Utils.escape_html(loss[:kind])
+        lead, consequence = data_loss_wording(kind, subject)
+        "<strong>Notice:</strong> #{lead} at #{loss[:at]} " \
+          "(#{kind}): #{detail}. #{consequence}<br/>"
+      end
+
+      # a forfeited retry is not lost data -- that work is in the document unless
+      # another writer clobbered the write it went out in -- so it must not read
+      # like a real eviction
+      def data_loss_wording(kind, subject)
+        if kind == "unconfirmed_dropped"
+          ["some #{subject} data may be undercounted",
+            "Affected only if another process overwrote that write."]
+        else
+          ["#{subject} data was lost", "Results before that point are unavailable."]
+        end
+      end
+
       def clear_abstract_tracking(tracker)
-        if Coverband.configuration.web_enable_clear
-          tracker.reset_recordings
-          notice = "#{tracker.title} tracking reset"
+        notice = if !Coverband.configuration.web_enable_clear
+          "web_enable_clear isn't enabled in your configuration"
+        elsif tracker.reset_recordings == false
+          # a reset whose pointer write didn't land hasn't happened, and saying
+          # otherwise leaves the operator believing data is gone when it is not
+          "#{tracker.title} tracking reset failed, the store did not accept the write"
         else
-          notice = "web_enable_clear isn't enabled in your configuration"
+          "#{tracker.title} tracking reset"
         end
         [302, {"Location" => "#{base_path}/#{tracker.route}?notice=#{notice}"}, []]
       end
@@ -223,7 +280,7 @@ module Coverband
         if Coverband.configuration.web_enable_clear
           key = request.params["key"]
           tracker.clear_key!(key)
-          notice = "coverage for #{tracker.title} #{key} cleared"
+          notice = "coverage for #{tracker.title} #{key} clear submitted, applied within a reporting cycle"
         else
           notice = "web_enable_clear isn't enabled in your configuration"
         end