MB-70102 Add subcommand for configuring WORM for an existing repository

Add the 'repo-worm' command. It accepts a '--period' and '--disable'
flags similarly to the 'cbbackupmgr worm' command.

Change-Id: I05b4387c64e676c796147f0298cebd5e9a45f3b6
Reviewed-on: https://review.couchbase.org/c/couchbase-cli/+/238415
Tested-by: Build Bot <build@couchbase.com>
Reviewed-by: Safian Ali <safian.ali@couchbase.com>

Author: lubomarinski

cbmgr.py

@@ -7003,12 +7003,13 @@ def __init__(self):
         self.repo_remove_cmd = BackupServiceRepoRemove(self.subparser)
         self.repo_pause_cmd = BackupServiceRepoPause(self.subparser)
         self.repo_resume_cmd = BackupServiceRepoResume(self.subparser)
+        self.repo_worm_cmd = BackupServiceRepoWORM(self.subparser)
         self.plan_cmd = BackupServicePlan(self.subparser)
         self.nodeThreads_cmd = BackupServiceNodeThreadsMap(self.subparser)
 
     def execute(self, opts):
         subcommands = ['settings', 'repository', 'repo-list', 'repo-get', 'repo-add', 'repo-archive', 'repo-remove',
-                       'repo-pause', 'repo-resume', 'plan', 'node-threads']
+                       'repo-pause', 'repo-resume', 'repo-worm', 'plan', 'node-threads']
 
         if opts.sub_cmd is None or opts.sub_cmd not in subcommands:
             _exit_if_errors([f'<subcommand> must be one of {subcommands}'])
@@ -7031,6 +7032,8 @@ def execute(self, opts):
             self.repo_pause_cmd.execute(opts)
         elif opts.sub_cmd == 'repo-resume':
             self.repo_resume_cmd.execute(opts)
+        elif opts.sub_cmd == 'repo-worm':
+            self.repo_worm_cmd.execute(opts)
         elif opts.sub_cmd == 'plan':
             self.plan_cmd.execute(opts)
         elif opts.sub_cmd == 'node-threads':
@@ -7538,6 +7541,44 @@ def get_description():
         return 'Resume a repository'
 
 
+class BackupServiceRepoWORM:
+    """Set WORM for a repository.
+    """
+
+    def __init__(self, subparser):
+        """setup the parser"""
+        self.rest = None
+        repository_parser = subparser.add_parser('repo-worm', help='Set WORM for a repository', add_help=False,
+                                                 allow_abbrev=False)
+
+        repository_parser.add_argument('--id', metavar='<id>', help='The repository id', required=True)
+
+        action_group = repository_parser.add_mutually_exclusive_group(required=True)
+        action_group.add_argument('--period', type=int, metavar='<days>',
+                                  help='The WORM compliance period in days [3, 36525]')
+        action_group.add_argument('--disable', action='store_true',
+                                  help='Disable WORM once its validity period has expired')
+
+    @rest_initialiser(version_check=True, enterprise_check=True, cluster_init_check=True)
+    def execute(self, opts):
+        """Run the backup-service repo-worm subcommand"""
+
+        if opts.period is not None and (opts.period < 3 or opts.period > 36525):
+            _exit_if_errors(['the provided period must be in the [3, 36525] range'])
+
+        _, errors = self.rest.set_worm_for_backup_repo(opts.id, opts.period, opts.disable)
+        _exit_if_errors(errors)
+        _success('Repository WORM config was set')
+
+    @staticmethod
+    def get_man_page_name():
+        return get_doc_page_name("couchbase-cli-backup-service-repo-worm")
+
+    @staticmethod
+    def get_description():
+        return 'Set WORM for a repository'
+
+
 class BackupServiceRepository:
     """(Deprecated) This command manages backup services repositories.
 

cluster_manager.py

@@ -2695,11 +2695,35 @@ def resume_backup_repository(self, repository_id):
 
         return self._post_json(f'{hosts[0]}/api/v1/cluster/self/repository/active/{repository_id}/resume', None)
 
+    def set_worm_for_backup_repo(self, repository_id: str, period: Optional[int], disable: bool):
+        """Set WORM for a repository
+
+        Args:
+            repository_id (str): The repository id.
+            period (int | None): The WORM compliance period.
+            disable (bool): Whether to disable WORM for the repository.
+        """
+        hosts, errors = self.get_hostnames_for_service(BACKUP_SERVICE)
+        if errors:
+            return None, errors
+
+        if not hosts:
+            raise ServiceNotAvailableException(BACKUP_SERVICE)
+
+        body: Dict[str, Any] = {
+            "disable": disable
+        }
+
+        if period is not None:
+            body["period"] = period
+
+        return self._post_json(f'{hosts[0]}/api/v1/cluster/self/repository/active/{repository_id}/worm', body)
+
     def add_backup_active_repository(self, repository_id: str, body: Dict[str, Any], cluster: str = 'self'):
-        """Archive an active repository
+        """Add an active repository
 
         Args:
-            repository_id (str): The id to be given to the new repository.
+            repository_id (str): The repository id.
             body (dict): The add active repository request.
             cluster (str): Only 'self' is supported.
         """

docs/modules/cli/pages/_partials/cbcli/nav.adoc

@@ -11,6 +11,7 @@
  ** xref:cli:cbcli/couchbase-cli-backup-service-repo-pause.adoc[backup-service repo-pause]
  ** xref:cli:cbcli/couchbase-cli-backup-service-repo-remove.adoc[backup-service repo-remove]
  ** xref:cli:cbcli/couchbase-cli-backup-service-repo-resume.adoc[backup-service repo-resume]
+ ** xref:cli:cbcli/couchbase-cli-backup-service-repo-worm.adoc[backup-service repo-worm]
  ** xref:cli:cbcli/couchbase-cli-backup-service-repository.adoc[backup-service repository]
  ** xref:cli:cbcli/couchbase-cli-backup-service-settings.adoc[backup-service settings]
  ** xref:cli:cbcli/couchbase-cli-bucket-compact.adoc[bucket-compact]

docs/modules/cli/pages/cbcli/couchbase-cli-backup-service-repo-worm.adoc

@@ -0,0 +1,94 @@
+= couchbase-cli-backup-service-repo-worm(1)
+:description: Configure WORM for a backup service repository
+ifndef::doctype-manpage[:doctitle: backup-service repo-worm]
+
+ifdef::doctype-manpage[]
+== NAME
+
+couchbase-cli-backup-service-repo-worm -
+endif::[]
+Configure WORM for a backup service repository
+
+== SYNOPSIS
+
+[verse]
+_couchbase-cli backup-service_ [--cluster <url>] [--username <user>]
+    [--password <password>] [--client-cert <path>]
+    [--client-cert-password <password>] [--client-key <path>]
+    [--client-key-password <password>] _repo-worm_ [--id <id>]
+    (--period <days> | --disable)
+
+== DESCRIPTION
+
+Configures Write Once Read Many (WORM) compliance settings for a backup service
+repository. WORM ensures that backup data cannot be modified or deleted for a
+specified retention period, providing data immutability for regulatory compliance.
+
+This command allows you to either set a WORM compliance period (in days) or
+disable WORM for a repository once its validity period has expired. Only paused
+repositories can have their WORM configuration modified.
+
+== OPTIONS
+
+--id <id>::
+    The repository ID. This argument is required.
+
+--period <days>::
+    The WORM compliance period in days. Valid values are between 3 and 36525
+    days (approximately 100 years). This option is mutually exclusive with
+    `--disable`.
+
+--disable::
+    Disable WORM for the repository once its validity period has expired. This
+    option is mutually exclusive with `--period`.
+
+include::{partialsdir}/cbcli/part-common-options.adoc[]
+
+include::{partialsdir}/cbcli/part-host-formats.adoc[]
+
+include::{partialsdir}/cbcli/part-certificate-authentication.adoc[]
+
+== EXAMPLES
+
+To set a WORM compliance period of 30 days for a repository named 'weekly-backup',
+run the following command.
+
+----
+$ couchbase-cli backup-service -c 127.0.0.1:8091 -u Administrator -p password \
+  repo-worm --id weekly-backup --period 30
+----
+
+If successful, the following output will be displayed:
+
+----
+Repository WORM config was set
+----
+
+To set a WORM compliance period of 3 days:
+
+----
+$ couchbase-cli backup-service -c 127.0.0.1:8091 -u Administrator -p password \
+  repo-worm --id my-repo --period 3
+----
+
+To disable WORM for a repository after its validity period has expired:
+
+----
+$ couchbase-cli backup-service -c 127.0.0.1:8091 -u Administrator -p password \
+  repo-worm --id old-backup --disable
+----
+
+== ENVIRONMENT AND CONFIGURATION VARIABLES
+
+include::{partialsdir}/cbcli/part-common-env.adoc[]
+
+== SEE ALSO
+
+man:couchbase-cli-backup-service[1],
+man:couchbase-cli-backup-service-repo-list[1],
+man:couchbase-cli-backup-service-repo-get[1],
+man:couchbase-cli-backup-service-repo-add[1],
+man:couchbase-cli-backup-service-repo-archive[1]
+
+include::{partialsdir}/cbcli/part-footer.adoc[]
+

docs/modules/cli/pages/cbcli/couchbase-cli-backup-service.adoc

@@ -55,6 +55,9 @@ man:couchbase-cli-backup-service-repo-pause[1]::
 man:couchbase-cli-backup-service-repo-resume[1]::
   Resume a backup service repository.
 
+man:couchbase-cli-backup-service-repo-worm[1]::
+  Configure WORM for a backup service repository.
+
 include::{partialsdir}/cbcli/part-host-formats.adoc[]
 
 include::{partialsdir}/cbcli/part-certificate-authentication.adoc[]

test/mock_server.py

@@ -632,6 +632,7 @@ def export_eventing_functions(rest_params=None, server_args=None, path="", endpo
     (r'/api/v1/cluster/self/repository/active/\w+/archive$', {'POST': do_nothing}),
     (r'/api/v1/cluster/self/repository/active/[\w-]+/pause$', {'POST': do_nothing}),
     (r'/api/v1/cluster/self/repository/active/[\w-]+/resume$', {'POST': do_nothing}),
+    (r'/api/v1/cluster/self/repository/active/[\w-]+/worm$', {'POST': do_nothing}),
     (r'/api/v1/plan$', {'GET': get_by_path}),
     (r'/api/v1/plan/\w+$', {'GET': get_by_path, 'DELETE': do_nothing, 'POST': do_nothing}),
     (r'/api/v1/cluster/self/repository/(:?active|archived|imported)/\w+(:?\?remove_repository=\w+)?$',

test/test_cli.py

@@ -5464,6 +5464,77 @@ def test_resume_repository_success(self):
         self.assertIn('Repository was resumed', self.str_output)
 
 
+class TestBackupServiceRepoWORM(CommandTest):
+    """Test the backup-service repo-worm subcommand"""
+
+    def setUp(self):
+        self.server_args = {'enterprise': True, 'init': True, 'is_admin': True,
+                            '/pools/default/nodeServices': {'nodesExt': [{
+                                'hostname': host,
+                                'services': {
+                                    'backupAPI': port,
+                                },
+                            }]}}
+        self.command = ['couchbase-cli', 'backup-service'] + cluster_connect_args + ['repo-worm']
+        super(TestBackupServiceRepoWORM, self).setUp()
+
+    def test_missing_id(self):
+        """Test that the command fails if --id is not provided"""
+        self.system_exit_run(self.command + ['--period', '30'], self.server_args)
+        self.assertIn('--id', self.str_error)
+        self.assertIn('required', self.str_error)
+
+    def test_missing_period_or_disable(self):
+        """Test that the command fails if neither --period nor --disable is provided"""
+        self.system_exit_run(self.command + ['--id', 'myrepo'], self.server_args)
+        self.assertIn('--period', self.str_error)
+        self.assertIn('--disable', self.str_error)
+        self.assertIn('required', self.str_error)
+
+    def test_period_and_disable_mutually_exclusive(self):
+        """Test that the command fails if both --period and --disable are provided"""
+        self.system_exit_run(self.command + ['--id', 'myrepo', '--period', '30', '--disable'], self.server_args)
+        self.assertIn('not allowed with argument', self.str_error)
+
+    def test_period_below_minimum(self):
+        """Test that the command fails if --period is less than 3"""
+        self.system_exit_run(self.command + ['--id', 'myrepo', '--period', '2'], self.server_args)
+        self.assertIn('the provided period must be in the [3, 36525] range', self.str_output)
+
+    def test_period_above_maximum(self):
+        """Test that the command fails if --period is greater than 36525"""
+        self.system_exit_run(self.command + ['--id', 'myrepo', '--period', '36526'], self.server_args)
+        self.assertIn('the provided period must be in the [3, 36525] range', self.str_output)
+
+    def test_set_worm_period_success(self):
+        """Test that the command successfully sets WORM period for a repository"""
+        self.no_error_run(self.command + ['--id', 'myrepo', '--period', '30'], self.server_args)
+        self.assertIn('POST:/api/v1/cluster/self/repository/active/myrepo/worm', self.server.trace)
+        self.rest_parameter_match([json.dumps({'disable': False, 'period': 30}, sort_keys=True)])
+        self.assertIn('Repository WORM config was set', self.str_output)
+
+    def test_set_worm_period_minimum(self):
+        """Test that the command accepts the minimum period of 3 days"""
+        self.no_error_run(self.command + ['--id', 'myrepo', '--period', '3'], self.server_args)
+        self.assertIn('POST:/api/v1/cluster/self/repository/active/myrepo/worm', self.server.trace)
+        self.rest_parameter_match([json.dumps({'disable': False, 'period': 3}, sort_keys=True)])
+        self.assertIn('Repository WORM config was set', self.str_output)
+
+    def test_set_worm_period_maximum(self):
+        """Test that the command accepts the maximum period of 36525 days"""
+        self.no_error_run(self.command + ['--id', 'myrepo', '--period', '36525'], self.server_args)
+        self.assertIn('POST:/api/v1/cluster/self/repository/active/myrepo/worm', self.server.trace)
+        self.rest_parameter_match([json.dumps({'disable': False, 'period': 36525}, sort_keys=True)])
+        self.assertIn('Repository WORM config was set', self.str_output)
+
+    def test_disable_worm_success(self):
+        """Test that the command successfully disables WORM for a repository"""
+        self.no_error_run(self.command + ['--id', 'myrepo', '--disable'], self.server_args)
+        self.assertIn('POST:/api/v1/cluster/self/repository/active/myrepo/worm', self.server.trace)
+        self.rest_parameter_match([json.dumps({'disable': True}, sort_keys=True)])
+        self.assertIn('Repository WORM config was set', self.str_output)
+
+
 class TestBackupServiceSettings(CommandTest):
     """Test the backup-service settings subcommand"""