fix: [sc-86007] Add config validation in config mode (#41)

* fix: add validate configuration step in config mode

* ci: stagger auto updates and reduce backoff retry time

* refactor: default constants and validation

* fix: use github token for update api calls

* ci: match build version

Author: mlataza

.github/workflows/integration-test.yml

@@ -177,7 +177,7 @@ jobs:
         shell: bash
         run: |
           sudo ./dist/rewst_agent_config.linux.it.bin --update --org-id ${{ vars.IT_ORG_ID }}
-          echo "Installed integration test binary (version 0.0.0-it)"
+          echo "Installed integration test binary (version v0.0.0-it)"
 
       - name: Wait for auto updater to trigger and update
         shell: bash
@@ -208,9 +208,9 @@ jobs:
             fi
           done
 
-          if echo "$logContent" | grep -qF "version=0.0.0-it"; then
+          if echo "$logContent" | grep -qF "version=v0.0.0-it"; then
             lastVersion=$(echo "$logContent" | grep "Agent Smith started" | tail -1)
-            if echo "$lastVersion" | grep -qF "version=0.0.0-it"; then
+            if echo "$lastVersion" | grep -qF "version=v0.0.0-it"; then
               echo "ERROR: Agent is still running the integration test version after update"
               exit 1
             fi
@@ -454,7 +454,7 @@ jobs:
         shell: pwsh
         run: |
           ./dist/rewst_agent_config.win.it.exe --update --org-id ${{ vars.IT_ORG_ID }}
-          Write-Output "Installed integration test binary (version 0.0.0-it)"
+          Write-Output "Installed integration test binary (version v0.0.0-it)"
 
       - name: Wait for auto updater to trigger and update
         shell: pwsh
@@ -486,7 +486,7 @@ jobs:
           }
 
           $lastStartLine = ($logContent -split "`n" | Where-Object { $_ -match "Agent Smith started" } | Select-Object -Last 1)
-          if ($lastStartLine -match [regex]::Escape("version=0.0.0-it")) {
+          if ($lastStartLine -match [regex]::Escape("version=v0.0.0-it")) {
             Write-Error "Agent is still running the integration test version after update"
             exit 1
           }
@@ -758,7 +758,7 @@ jobs:
         shell: bash
         run: |
           sudo ./dist/rewst_agent_config.mac-os.it.bin --update --org-id ${{ vars.IT_ORG_ID }}
-          echo "Installed integration test binary (version 0.0.0-it)"
+          echo "Installed integration test binary (version v0.0.0-it)"
 
       - name: Wait for auto updater to trigger and update
         shell: bash
@@ -790,7 +790,7 @@ jobs:
           done
 
           lastVersion=$(echo "$logContent" | grep "Agent Smith started" | tail -1)
-          if echo "$lastVersion" | grep -qF "version=0.0.0-it"; then
+          if echo "$lastVersion" | grep -qF "version=v0.0.0-it"; then
             echo "ERROR: Agent is still running the integration test version after update"
             exit 1
           fi

cmd/agent_smith/config.go

@@ -21,6 +21,22 @@ type fetchConfigurationResponse struct {
 	Configuration agent.Device `json:"configuration"`
 }
 
+func validateConfiguration(device agent.Device) error {
+	if device.DeviceId == "" {
+		return fmt.Errorf("missing required field: device_id")
+	}
+	if device.RewstEngineHost == "" {
+		return fmt.Errorf("missing required field: rewst_engine_host")
+	}
+	if device.SharedAccessKey == "" {
+		return fmt.Errorf("missing required field: shared_access_key")
+	}
+	if device.AzureIotHubHost == "" {
+		return fmt.Errorf("missing required field: azure_iot_hub_host")
+	}
+	return nil
+}
+
 func runConfig(params *configContext) error {
 	logger := utils.ConfigureLogger("agent_smith", os.Stdout, utils.Default)
 
@@ -81,6 +97,11 @@ func runConfig(params *configContext) error {
 	if err != nil {
 		return fmt.Errorf("failed to parse response: %w", err)
 	}
+
+	if err := validateConfiguration(response.Configuration); err != nil {
+		return fmt.Errorf("invalid configuration: %w", err)
+	}
+
 	response.Configuration.LoggingLevel = utils.LoggingLevel(params.LoggingLevel)
 	response.Configuration.UseSyslog = params.UseSyslog
 	response.Configuration.DisableAgentPostback = params.DisableAgentPostback

cmd/agent_smith/config_test.go

@@ -76,6 +76,91 @@ func newBaseConfigParams(configURL string) *configContext {
 	}
 }
 
+// ── validateConfiguration tests ──────────────────────────────────────────────
+
+func TestValidateConfiguration_Valid(t *testing.T) {
+	device := agent.Device{
+		DeviceId:        "device-123",
+		RewstEngineHost: "engine.example.com",
+		SharedAccessKey: "key123",
+		AzureIotHubHost: "hub.example.com",
+	}
+	if err := validateConfiguration(device); err != nil {
+		t.Errorf("expected no error, got %v", err)
+	}
+}
+
+func TestValidateConfiguration_MissingFields(t *testing.T) {
+	tests := []struct {
+		name   string
+		device agent.Device
+		field  string
+	}{
+		{
+			name: "missing device_id",
+			device: agent.Device{
+				RewstEngineHost: "engine.example.com",
+				SharedAccessKey: "key123",
+				AzureIotHubHost: "hub.example.com",
+			},
+			field: "device_id",
+		},
+		{
+			name: "missing rewst_engine_host",
+			device: agent.Device{
+				DeviceId:        "device-123",
+				SharedAccessKey: "key123",
+				AzureIotHubHost: "hub.example.com",
+			},
+			field: "rewst_engine_host",
+		},
+		{
+			name: "missing shared_access_key",
+			device: agent.Device{
+				DeviceId:        "device-123",
+				RewstEngineHost: "engine.example.com",
+				AzureIotHubHost: "hub.example.com",
+			},
+			field: "shared_access_key",
+		},
+		{
+			name: "missing azure_iot_hub_host",
+			device: agent.Device{
+				DeviceId:        "device-123",
+				RewstEngineHost: "engine.example.com",
+				SharedAccessKey: "key123",
+			},
+			field: "azure_iot_hub_host",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateConfiguration(tt.device)
+			if err == nil {
+				t.Errorf("expected error for missing %s, got nil", tt.field)
+				return
+			}
+			if !strings.Contains(err.Error(), tt.field) {
+				t.Errorf("expected error to mention %q, got %v", tt.field, err)
+			}
+		})
+	}
+}
+
+func TestRunConfig_InvalidConfiguration(t *testing.T) {
+	// Response missing required fields (no device_id, engine host, etc.)
+	body := `{"configuration": {}}`
+	srv := newConfigServer(t, http.StatusOK, body)
+	defer srv.Close()
+
+	err := runConfig(newBaseConfigParams(srv.URL))
+
+	if err == nil || !strings.Contains(err.Error(), "invalid configuration") {
+		t.Errorf("expected 'invalid configuration' error, got %v", err)
+	}
+}
+
 // ── tests ─────────────────────────────────────────────────────────────────────
 
 func TestRunConfig_Success(t *testing.T) {

cmd/agent_smith/service.go

@@ -107,12 +107,17 @@ func (svc *serviceContext) Execute(
 			logger,
 			&device,
 			"https://api.github.com/repos/rewstapp/agent-smith-go/releases/latest",
+			os.Getenv("GITHUB_TOKEN"),
 			func(path string, args []string) error {
 				return detachedCommand(path, args, logFile, logFile).Start()
 			},
 		)
 		runner := agent.NewAutoUpdateRunner(
-			logger, updater, agent.DefaultUpdateInterval(), 5, 5*time.Minute,
+			logger,
+			updater,
+			agent.DefaultUpdateInterval(),
+			agent.DefaultMaxRetries(),
+			agent.DefaultBaseBackoff(),
 		)
 		runner.Start()
 		defer runner.Stop()

internal/agent/updater.go

@@ -36,6 +36,20 @@ type Updater interface {
 // Example: -ldflags "-X github.com/RewstApp/agent-smith-go/internal/agent.updateIntervalStr=30s"
 var updateIntervalStr = ""
 
+// baseBackoffStr is overridable via -ldflags for integration testing.
+// Example: -ldflags "-X github.com/RewstApp/agent-smith-go/internal/agent.baseBackoffStr=5s"
+var baseBackoffStr = ""
+
+// maxRetriesStr is overridable via -ldflags for integration testing.
+// Example: -ldflags "-X github.com/RewstApp/agent-smith-go/internal/agent.maxRetriesStr=3"
+var maxRetriesStr = ""
+
+const (
+	defaultUpdateInterval = 48 * time.Hour
+	defaultBaseBackoff    = 5 * time.Minute
+	defaultMaxRetries     = 5
+)
+
 // DefaultUpdateInterval returns the auto-update check interval.
 // Uses updateIntervalStr if set via ldflags, otherwise defaults to 48 hours.
 func DefaultUpdateInterval() time.Duration {
@@ -44,7 +58,30 @@ func DefaultUpdateInterval() time.Duration {
 			return d
 		}
 	}
-	return 48 * time.Hour
+	return defaultUpdateInterval
+}
+
+// DefaultBaseBackoff returns the base backoff duration for update retries.
+// Uses baseBackoffStr if set via ldflags, otherwise defaults to 5 minutes.
+func DefaultBaseBackoff() time.Duration {
+	if baseBackoffStr != "" {
+		if d, err := time.ParseDuration(baseBackoffStr); err == nil {
+			return d
+		}
+	}
+	return defaultBaseBackoff
+}
+
+// DefaultMaxRetries returns the maximum number of update retry attempts.
+// Uses maxRetriesStr if set via ldflags, otherwise defaults to 5.
+func DefaultMaxRetries() int {
+	if maxRetriesStr != "" {
+		var n int
+		if _, err := fmt.Sscanf(maxRetriesStr, "%d", &n); err == nil && n > 0 {
+			return n
+		}
+	}
+	return defaultMaxRetries
 }
 
 type RunCommandFunc = func(path string, args []string) error
@@ -53,19 +90,22 @@ type defaultUpdater struct {
 	logger           hclog.Logger
 	device           *Device
 	latestReleaseUrl string
+	githubToken      string
 	runCommand       RunCommandFunc
 }
 
 func NewUpdater(
 	logger hclog.Logger,
 	device *Device,
 	latestReleaseUrl string,
+	githubToken string,
 	runCommand RunCommandFunc,
 ) Updater {
 	return &defaultUpdater{
 		logger:           logger,
 		device:           device,
 		latestReleaseUrl: latestReleaseUrl,
+		githubToken:      githubToken,
 		runCommand:       runCommand,
 	}
 }
@@ -74,7 +114,15 @@ func (u *defaultUpdater) Check() (Release, error) {
 	release := Release{}
 	u.logger.Info("Checking for updates")
 
-	resp, err := http.Get(u.latestReleaseUrl)
+	req, err := http.NewRequest(http.MethodGet, u.latestReleaseUrl, nil)
+	if err != nil {
+		return release, err
+	}
+	if u.githubToken != "" {
+		req.Header.Set("Authorization", "Bearer "+u.githubToken)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		u.logger.Error("Failed to fetch latest release", "url", u.latestReleaseUrl, "error", err)
 		return release, err
@@ -138,6 +186,9 @@ func (u *defaultUpdater) Download(asset Asset) (string, error) {
 	}
 
 	req.Header.Add("Accept", "application/octet-stream")
+	if u.githubToken != "" {
+		req.Header.Set("Authorization", "Bearer "+u.githubToken)
+	}
 
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {