fix(admin): harden maintenance actions

Author: Medformatik

apps/web/src/components/admin/system/SystemMaintenance.test.tsx

@@ -1,5 +1,26 @@
 import { renderToStaticMarkup } from "react-dom/server";
-import { describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const systemStatus = {
+  deployment: {
+    dockerAvailable: true,
+    composeRendered: true,
+    hostControlConfigured: true,
+    maintenanceReady: true,
+  },
+  images: [
+    {
+      id: "app-api",
+      name: "OpenMapX API",
+      image: "ghcr.io/openmapx/api:latest",
+      containerState: "running",
+      runningImageId: "sha256:old-image",
+      localImageId: "sha256:new-image",
+      updateAvailable: true,
+      status: "update-available" as "update-available" | "up-to-date",
+    },
+  ],
+};
 
 vi.mock("@/lib/EnvProvider", () => ({ useEnv: () => ({ apiUrl: "http://api.test" }) }));
 vi.mock("../shared/AdminToast", () => ({ useAdminToast: () => vi.fn() }));
@@ -9,31 +30,19 @@ vi.mock("@tanstack/react-query", () => ({
   useQuery: (options: { queryKey: unknown[] }) =>
     options.queryKey[1] === "system"
       ? {
-          data: {
-            deployment: {
-              dockerAvailable: true,
-              composeRendered: true,
-              hostControlConfigured: true,
-              maintenanceReady: true,
-            },
-            images: [
-              {
-                id: "app-api",
-                name: "OpenMapX API",
-                image: "ghcr.io/openmapx/api:latest",
-                containerState: "running",
-                runningImageId: "sha256:old-image",
-                localImageId: "sha256:new-image",
-                updateAvailable: true,
-                status: "update-available",
-              },
-            ],
-          },
+          data: systemStatus,
           isError: false,
         }
       : { data: undefined, isError: false },
 }));
 
+afterEach(() => {
+  systemStatus.images[0].runningImageId = "sha256:old-image";
+  systemStatus.images[0].localImageId = "sha256:new-image";
+  systemStatus.images[0].updateAvailable = true;
+  systemStatus.images[0].status = "update-available";
+});
+
 describe("SystemMaintenance", () => {
   it("renders staged image state and safe operator actions", async () => {
     const { SystemMaintenance } = await import("./SystemMaintenance");
@@ -45,4 +54,35 @@ describe("SystemMaintenance", () => {
     expect(markup).toContain("Deep diagnostics");
     expect(markup).toContain("Host-control readiness");
   });
+
+  it("does not send a JSON content type for bodyless maintenance actions", async () => {
+    const { buildSystemJobRequestInit } = await import("./SystemMaintenance");
+
+    expect(buildSystemJobRequestInit()).toEqual({
+      method: "POST",
+      credentials: "include",
+    });
+    expect(buildSystemJobRequestInit({ confirmation: "UPDATE OPENMAPX" })).toEqual({
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ confirmation: "UPDATE OPENMAPX" }),
+    });
+  });
+
+  it("disables application updates when every core image is current", async () => {
+    systemStatus.images[0].runningImageId = "sha256:current-image";
+    systemStatus.images[0].localImageId = "sha256:current-image";
+    systemStatus.images[0].updateAvailable = false;
+    systemStatus.images[0].status = "up-to-date";
+
+    const { SystemMaintenance } = await import("./SystemMaintenance");
+    const markup = renderToStaticMarkup(<SystemMaintenance />);
+
+    expect(
+      /<button[^>]*disabled=""[^>]*title="All core images are up to date"[^>]*>[\s\S]*?Update OpenMapX/.test(
+        markup,
+      ),
+    ).toBe(true);
+  });
 });

apps/web/src/components/admin/system/SystemMaintenance.tsx

@@ -70,6 +70,19 @@ interface JobStatus {
   error: string | null;
 }
 
+export function buildSystemJobRequestInit(body?: Record<string, unknown>): RequestInit {
+  return {
+    method: "POST",
+    credentials: "include",
+    ...(body === undefined
+      ? {}
+      : {
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(body),
+        }),
+  };
+}
+
 function digest(value: string | null): string {
   if (!value) return "—";
   return value.replace(/^sha256:/, "").slice(0, 12);
@@ -137,12 +150,10 @@ export function SystemMaintenance() {
       body?: Record<string, unknown>;
       label: string;
     }) => {
-      const response = await fetch(`${apiUrl}/api/admin/system/${path}`, {
-        method: "POST",
-        credentials: "include",
-        headers: { "Content-Type": "application/json" },
-        body: body ? JSON.stringify(body) : undefined,
-      });
+      const response = await fetch(
+        `${apiUrl}/api/admin/system/${path}`,
+        buildSystemJobRequestInit(body),
+      );
       const result = (await response.json().catch(() => ({}))) as {
         jobId?: string;
         error?: string;
@@ -227,7 +238,8 @@ export function SystemMaintenance() {
             <Button
               variant="contained"
               startIcon={<UpdateIcon />}
-              disabled={active || !status?.deployment.maintenanceReady}
+              disabled={active || !status?.deployment.maintenanceReady || updateCount === 0}
+              title={updateCount === 0 ? "All core images are up to date" : undefined}
               onClick={() => setDialogOpen(true)}
             >
               Update OpenMapX
@@ -365,7 +377,7 @@ export function SystemMaintenance() {
             variant="contained"
             color="warning"
             startIcon={<UpdateIcon />}
-            disabled={confirmation !== CONFIRMATION || queueJob.isPending}
+            disabled={confirmation !== CONFIRMATION || queueJob.isPending || updateCount === 0}
             onClick={() => {
               queueJob.mutate({
                 path: "updates/apply",