Restore

Restore file to captured state

Every captured change carries its SHA-256-addressed content in BLOB_STORE. Restoring writes that content back to the original path — current file gets backed up to <path>.drift_restore_backup_<epoch> before overwrite.

What will change

Preview -- nothing has been written yet.

Target file	/var/www/vhosts/3dshawn.com/site1/_alert_dispatch.pl
Site	DriftSense self-monitor on local
Kind	local
Captured at	2026-07-11 19:38:00
Captured SHA	ad10d46443a15412a8e99cf91ebfa462cce1de88674043364ed0dfb63797a664

Current state on disk

Live check just now. If SHAs match, the restore is a no-op.

File present	yes
Size	22933 bytes
Current SHA	a53566efc691
Same as captured?	no -- restore will change it

See exactly what's different →

What restore will change — live diff

Left column shows current on-disk content; right shows what restore will write. +2 additions, -268 deletions, 325 unchanged context lines.

1	1	#!/usr/bin/perl
2	2	#======================================================================
3	3	# DriftSense -- alert dispatcher
4	4	#
5	5	# Cron entry point (NOT a CGI). Walks FILE_CHANGES + SCHEMA_CHANGE rows
6	6	# inserted since the last cursor tick, evaluates every ACTIVE rule
7	7	# against each new row, and POSTs matching payloads to the configured
8	8	# webhook (Slack / Discord / generic HTTP). Every attempt is logged
9	9	# to ALERT_DELIVERIES for the operator's audit trail.
10	10	#
11	11	# Config: /etc/drift_sense/drift_sense.conf (via MODS::Config).
12	12	# Log: /var/log/drift_sense/alert_dispatch.log (via cron redirect).
13	13	#======================================================================
14	14	use strict;
15	15	use warnings;
16	16	use lib '/var/www/vhosts/3dshawn.com/site1';
17	17	use POSIX ();
18		use Symbol ();
19	18	use JSON::PP;
20	19	use MODS::Config;
21	20	use MODS::DBConnect;
22	21	use MODS::Webhook;
23	22
24	23	$\| = 1;
25	24	my $ts = POSIX::strftime('%Y-%m-%d %H:%M:%S', localtime);
26	25
27	26	my $cfg = MODS::Config->new;
28	27	my $db = MODS::DBConnect->new;
29	28	my $dbh = $db->db_connect or die "[$ts] cannot connect to DriftSense storage DB\n";
30	29
31	30	my $public_url = $cfg->settings('public_url') \|\| 'https://watchtower.3dshawn.com';
32	31
33	32	# ---- Fetch active rules ---------------------------------------------
34	33	my @rules = $db->db_readwrite_multiple($dbh, q~
35	34	SELECT alert_rule_id, rule_name, match_kind, match_path_glob,
36	35	match_status_list, exclude_ts_only,
37	36	delivery_kind, delivery_url, delivery_email,
38		rate_limit_per_min, coalesce_window_s,
39		frequency_threshold, frequency_window_min,
40		UNIX_TIMESTAMP(last_frequency_fire_at) AS last_freq_fire_epoch
	37	rate_limit_per_min, coalesce_window_s
41	38	FROM ALERT_RULES
42	39	WHERE is_active = 1
43	40	~, __FILE__, __LINE__);
44	41
45	42	unless (@rules) {
46	43	print "[$ts] no active alert rules, exiting\n";
47	44	$db->db_disconnect($dbh);
48	45	exit 0;
49	46	}
50	47
51	48	# ---- Fetch cursor ---------------------------------------------------
52	49	my %cursor;
53	50	foreach my $r ($db->db_readwrite_multiple($dbh, q~
54	51	SELECT source_kind, last_seen_id FROM ALERT_CURSOR
55	52	~, __FILE__, __LINE__)) {
56	53	$cursor{$r->{source_kind}} = $r->{last_seen_id};
57	54	}
58	55	$cursor{file} //= 0;
59	56	$cursor{schema} //= 0;
60	57
61	58	# ---- Pull new FILE_CHANGES since cursor ------------------------------
62	59	my $file_max = $cursor{file};
63	60	my @file_new = $db->db_readwrite_multiple($dbh, qq~
64	61	SELECT fc.file_changes_id AS id, fc.file_name, fc.status, fc.blob_sha,
65	62	fc.is_ts_only, fc.date_time,
66	63	UNIX_TIMESTAMP(fc.date_time) AS ts_epoch,
67	64	s.server_name
68	65	FROM FILE_CHANGES fc
69	66	LEFT JOIN SERVERS s ON s.server_id = fc.server_id
70	67	WHERE fc.file_changes_id > $cursor{file}
71	68	ORDER BY fc.file_changes_id ASC
72	69	LIMIT 500
73	70	~, __FILE__, __LINE__);
74	71	foreach my $r (@file_new) {
75	72	$file_max = $r->{id} if $r->{id} > $file_max;
76	73	}
77	74
78	75	# ---- Pull new SCHEMA_CHANGE since cursor -----------------------------
79	76	my $schema_max = $cursor{schema};
80	77	my @schema_new = $db->db_readwrite_multiple($dbh, qq~
81	78	SELECT sc.schema_change_id AS id, sc.database_name, sc.table_name,
82	79	sc.changes, sc.is_ts_only, sc.change_datetime,
83	80	UNIX_TIMESTAMP(sc.change_datetime) AS ts_epoch,
84	81	s.server_name
85	82	FROM SCHEMA_CHANGE sc
86	83	LEFT JOIN SERVERS s ON s.server_id = sc.server_id
87	84	WHERE sc.schema_change_id > $cursor{schema}
88	85	ORDER BY sc.schema_change_id ASC
89	86	LIMIT 500
90	87	~, __FILE__, __LINE__);
91	88	foreach my $r (@schema_new) {
92	89	$schema_max = $r->{id} if $r->{id} > $schema_max;
93	90	}
94	91
95	92	my $total_new = scalar(@file_new) + scalar(@schema_new);
96	93	if ($total_new == 0) {
97	94	print "[$ts] no new changes since cursor (file=$cursor{file} schema=$cursor{schema})\n";
98	95	$db->db_disconnect($dbh);
99	96	exit 0;
100	97	}
101	98
102	99	# ---- Evaluate + deliver ---------------------------------------------
103	100	# HTTP transport is MODS::Webhook (shells out to /usr/bin/curl) so we
104	101	# don't need LWP::Protocol::https / IO::Socket::SSL as CPAN installs.
105	102
106	103	my $delivered = 0;
107	104	my $skipped = 0;
108	105	my $failed = 0;
109	106
110	107	foreach my $row (@file_new) { _process_row($row, 'file'); }
111	108	foreach my $row (@schema_new) { _process_row($row, 'schema'); }
112
113		# ---- Frequency-mode rules ------------------------------------------
114		# For any rule where frequency_threshold > 0, we ignore the per-row loop
115		# above and instead: query how many file changes matching the rule's
116		# path glob happened in the last window_min minutes. If it crosses the
117		# threshold and we haven't fired within the same window, fire once with
118		# the top offender.
119		foreach my $rule (@rules) {
120		next unless ($rule->{frequency_threshold} \|\| 0) > 0;
121		my $win = int($rule->{frequency_window_min} \|\| 60);
122		my $thr = int($rule->{frequency_threshold});
123
124		# Re-fire cooldown: don't fire more than once per window
125		my $last = int($rule->{last_freq_fire_epoch} \|\| 0);
126		if ($last && (time - $last) < $win * 60) {
127		next;
128		}
129
130		# Find files whose match_path_glob-hit change count > threshold
131		my $glob = $rule->{match_path_glob} // '';
132		my $glob_sql = '';
133		if (length $glob) {
134		# Approx: SQL LIKE. Convert glob wildcards to SQL % / _.
135		my $like = $glob;
136		$like =~ s/\\/%/g;
137		$like =~ s/\*/%/g;
138		$like =~ s/\?/_/g;
139		my $q_like = $dbh->quote($like);
140		$glob_sql = " AND fc.file_name LIKE $q_like";
141		}
142		my @hot = $db->db_readwrite_multiple($dbh, qq~
143		SELECT fc.file_name,
144		COUNT(*) AS ct,
145		MAX(fc.file_changes_id) AS latest_id,
146		s.server_name
147		FROM FILE_CHANGES fc
148		LEFT JOIN SERVERS s ON s.server_id = fc.server_id
149		WHERE fc.date_time >= DATE_SUB(NOW(), INTERVAL $win MINUTE)
150		$glob_sql
151		GROUP BY fc.file_name
152		HAVING ct >= $thr
153		ORDER BY ct DESC
154		LIMIT 5
155		~, __FILE__, __LINE__);
156		next unless @hot;
157
158		# Fire once with the top offender's info
159		my $top = $hot[0];
160		my $fake_row = {
161		id => $top->{latest_id},
162		file_name => $top->{file_name},
163		server_name => $top->{server_name} // 'local',
164		date_time => POSIX::strftime('%Y-%m-%d %H:%M:%S', localtime),
165		ts_epoch => time,
166		status => 'frequency_alert',
167		};
168		my $payload = _build_payload($rule, $fake_row, 'file');
169		# Enrich summary with count + threshold
170		my $extra = "frequency alert: $top->{file_name} changed $top->{ct} times in the last $win min (threshold: $thr)";
171		if (ref($payload->{generic_webhook}) eq 'HASH') {
172		$payload->{generic_webhook}{frequency_summary} = $extra;
173		$payload->{generic_webhook}{frequency_count} = $top->{ct};
174		$payload->{generic_webhook}{frequency_window} = $win;
175		$payload->{generic_webhook}{summary} = $extra;
176		}
177		my ($status, $http_code, $body, $err) = _deliver($rule, $payload);
178		_log_delivery($rule, $fake_row, 'file', $status, $http_code, $body, $err);
179		if ($status eq 'sent') {
180		$delivered++;
181		$db->db_readwrite($dbh, qq~
182		UPDATE ALERT_RULES
183		SET fire_count = fire_count + 1,
184		last_fired_at = NOW(),
185		last_frequency_fire_at = NOW()
186		WHERE alert_rule_id = $rule->{alert_rule_id}
187		~, __FILE__, __LINE__);
188		} else {
189		$failed++;
190		}
191		}
192	109
193	110	# ---- Advance cursor atomically --------------------------------------
194	111	if ($file_max > $cursor{file}) {
195	112	$db->db_readwrite($dbh,
196	113	"UPDATE ALERT_CURSOR SET last_seen_id = $file_max WHERE source_kind = 'file'",
197	114	__FILE__, __LINE__);
198	115	}
199	116	if ($schema_max > $cursor{schema}) {
200	117	$db->db_readwrite($dbh,
201	118	"UPDATE ALERT_CURSOR SET last_seen_id = $schema_max WHERE source_kind = 'schema'",
202	119	__FILE__, __LINE__);
203		}
204
205		# ---- Pin-drift alerts (Feature 5 wave 4) ---------------------------
206		# For each Named Release with alert_delivery_url set, check whether any
207		# pin's current-latest SHA differs from the pinned SHA. Log the drift
208		# to PIN_DRIFT_LOG (with notified=0) and, if not yet notified, POST an
209		# alert to the release's delivery URL, then set notified=1.
210		foreach my $rel ($db->db_readwrite_multiple($dbh, q~
211		SELECT named_release_id, name, alert_delivery_kind, alert_delivery_url
212		FROM NAMED_RELEASES
213		WHERE alert_delivery_kind IS NOT NULL
214		AND alert_delivery_kind != 'none'
215		AND alert_delivery_url IS NOT NULL
216		AND alert_delivery_url != ''
217		~, __FILE__, __LINE__)) {
218
219		my $rid = $rel->{named_release_id};
220		my @drifts;
221		foreach my $pin ($db->db_readwrite_multiple($dbh, qq~
222		SELECT p.pin_id, p.file_name, p.blob_sha AS pinned_sha,
223		fc.server_id
224		FROM NAMED_RELEASE_PINS p
225		LEFT JOIN FILE_CHANGES fc ON fc.file_changes_id = p.file_changes_id
226		WHERE p.named_release_id = $rid
227		~, __FILE__, __LINE__)) {
228		my $q_file = $dbh->quote($pin->{file_name});
229		my $sid = int($pin->{server_id} \|\| 0);
230		my $cur = $db->db_readwrite($dbh, qq~
231		SELECT blob_sha, file_changes_id FROM FILE_CHANGES
232		WHERE server_id = $sid AND file_name = $q_file
233		ORDER BY file_changes_id DESC LIMIT 1
234		~, __FILE__, __LINE__);
235		my $cur_sha = $cur ? $cur->{blob_sha} : '';
236		next unless $cur_sha && $cur_sha ne $pin->{pinned_sha};
237
238		# Have we already logged + notified this (pin, current_sha) tuple?
239		my $q_pinned = $dbh->quote($pin->{pinned_sha});
240		my $q_current = $dbh->quote($cur_sha);
241		my $seen = $db->db_readwrite($dbh, qq~
242		SELECT drift_id, notified FROM PIN_DRIFT_LOG
243		WHERE pin_id = $pin->{pin_id}
244		AND current_sha = $q_current
245		ORDER BY drift_id DESC LIMIT 1
246		~, __FILE__, __LINE__);
247		if ($seen && $seen->{notified}) {
248		next; # already notified for this exact drift state
249		}
250
251		# Log the drift
252		my $q_fname = $dbh->quote($pin->{file_name});
253		my $cid = int($cur->{file_changes_id} \|\| 0);
254		$db->db_readwrite($dbh, qq~
255		INSERT INTO PIN_DRIFT_LOG
256		(named_release_id, pin_id, file_name, pinned_sha, current_sha, file_changes_id, notified)
257		VALUES
258		($rid, $pin->{pin_id}, $q_fname, $q_pinned, $q_current, $cid, 0)
259		~, __FILE__, __LINE__);
260		push @drifts, {
261		file_name => $pin->{file_name},
262		pinned_sha => $pin->{pinned_sha},
263		current_sha => $cur_sha,
264		change_id => $cid,
265		};
266		}
267
268		next unless @drifts;
269
270		# Build a summary payload
271		my $summary = sprintf('Named release "%s" -- %d pinned file(s) have drifted', $rel->{name}, scalar @drifts);
272		my $public_url = $cfg->settings('public_url') \|\| 'https://watchtower.3dshawn.com';
273		my $files_list = join("\n", map {
274		" * $_->{file_name} (pinned: " . substr($_->{pinned_sha}, 0, 12) .
275		" -> current: " . substr($_->{current_sha}, 0, 12) . ")"
276		} @drifts);
277		my $link = "$public_url/restore_release.cgi?release_id=$rid";
278
279		my $slack_body = {
280		text => "DriftSense pin drift: $summary",
281		attachments => [{
282		color => '#f43f5e',
283		fields => [
284		{ title => 'Release', value => $rel->{name}, short => 1 },
285		{ title => 'Drifted files', value => scalar(@drifts), short => 1 },
286		{ title => 'Details', value => $files_list, short => 0 },
287		],
288		actions => [{ type => 'button', text => 'Restore all pinned', url => $link }],
289		}],
290		};
291		my $discord_body = {
292		content => "DriftSense pin drift: $summary",
293		embeds => [{
294		title => $rel->{name},
295		url => $link,
296		color => 16005694,
297		description => $files_list,
298		}],
299		};
300		my $generic_body = {
301		source => 'drift_sense',
302		alert_type => 'pin_drift',
303		release_id => $rid,
304		release_name => $rel->{name},
305		drifted_count=> scalar @drifts,
306		summary => $summary,
307		files => \@drifts,
308		restore_url => $link,
309		};
310
311		my $body_ref = $rel->{alert_delivery_kind} eq 'slack' ? $slack_body
312		: $rel->{alert_delivery_kind} eq 'discord' ? $discord_body
313		: $generic_body;
314
315		my ($code, $rbody, $err) = MODS::Webhook::post_json(
316		$rel->{alert_delivery_url}, $body_ref,
317		timeout => 8,
318		user_agent => 'DriftSense/1.0 (pin-drift)',
319		);
320
321		if (!$err && $code >= 200 && $code < 400) {
322		# Mark all just-logged rows as notified
323		foreach my $d (@drifts) {
324		my $q_current = $dbh->quote($d->{current_sha});
325		$db->db_readwrite($dbh, qq~
326		UPDATE PIN_DRIFT_LOG SET notified = 1
327		WHERE named_release_id = $rid
328		AND file_name = @{[ $dbh->quote($d->{file_name}) ]}
329		AND current_sha = $q_current
330		AND notified = 0
331		~, __FILE__, __LINE__);
332		}
333		$delivered++;
334		print "[$ts] pin-drift alert delivered for release '$rel->{name}' (" . scalar(@drifts) . " drifted)\n";
335		} else {
336		$failed++;
337		print "[$ts] pin-drift alert FAILED for release '$rel->{name}': " . ($err // "HTTP $code") . "\n";
338		}
339
340		# Bookkeep the check timestamp
341		$db->db_readwrite($dbh, qq~
342		UPDATE NAMED_RELEASES SET last_pin_drift_check_at = NOW()
343		WHERE named_release_id = $rid
344		~, __FILE__, __LINE__);
345	120	}
346	121
347	122	$db->db_disconnect($dbh);
348	123	print "[$ts] processed +$total_new new changes: $delivered delivered, $skipped skipped, $failed failed\n";
349	124	exit 0;
350	125
351	126	#---------------------------------------------------------------------
352	127	sub _process_row {
353	128	my ($row, $kind) = @_;
354	129	foreach my $rule (@rules) {
355	130	next unless _rule_matches($rule, $row, $kind);
356	131
357	132	# Rate limit check
358	133	if ($rule->{rate_limit_per_min} > 0) {
359	134	my $rlq = $db->db_readwrite($dbh, qq~
360	135	SELECT COUNT(*) AS n FROM ALERT_DELIVERIES
361	136	WHERE alert_rule_id = $rule->{alert_rule_id}
362	137	AND fired_at >= DATE_SUB(NOW(), INTERVAL 1 MINUTE)
363	138	AND delivery_status IN ('sent','pending')
364	139	~, __FILE__, __LINE__);
365	140	if ($rlq && $rlq->{n} >= $rule->{rate_limit_per_min}) {
366	141	_log_delivery($rule, $row, $kind, 'skipped', undef, undef,
367	142	"rate limit ($rule->{rate_limit_per_min}/min) reached");
368	143	$skipped++;
369	144	next;
370	145	}
371	146	}
372	147
373	148	# Build payload + POST
374	149	my $payload = _build_payload($rule, $row, $kind);
375	150	my ($status, $http_code, $body, $err) = _deliver($rule, $payload);
376	151	_log_delivery($rule, $row, $kind, $status, $http_code, $body, $err);
377	152
378	153	if ($status eq 'sent') { $delivered++; }
379	154	elsif ($status eq 'skipped') { $skipped++; }
380	155	else { $failed++; }
381	156
382	157	# Bump the rule's fire_count + last_fired_at
383	158	if ($status eq 'sent') {
384	159	$db->db_readwrite($dbh, qq~
385	160	UPDATE ALERT_RULES
386	161	SET fire_count = fire_count + 1,
387	162	last_fired_at = NOW()
388	163	WHERE alert_rule_id = $rule->{alert_rule_id}
389	164	~, __FILE__, __LINE__);
390	165	}
391	166	}
392	167	}
393	168
394	169	#---------------------------------------------------------------------
395	170	sub _rule_matches {
396	171	my ($rule, $row, $kind) = @_;
397	172
398	173	# Kind filter
399	174	return 0 if $rule->{match_kind} ne 'either' && $rule->{match_kind} ne $kind;
400	175
401	176	# ts-only exclusion (files only)
402	177	return 0 if $kind eq 'file' && $rule->{exclude_ts_only} && $row->{is_ts_only};
403	178
404	179	# Path glob
405	180	my $glob = $rule->{match_path_glob} // '';
406	181	if (length $glob) {
407	182	my $target = $kind eq 'file'
408	183	? ($row->{file_name} // '')
409	184	: (($row->{database_name} // '') . '.' . ($row->{table_name} // ''));
410	185	my $re = _glob_to_regex($glob);
411	186	return 0 unless $target =~ $re;
412	187	}
413	188
414	189	# Status filter (files only)
415	190	if ($kind eq 'file' && $rule->{match_status_list}) {
416	191	my %allowed = map { s/^\s+\|\s+$//g; $_ => 1 }
417	192	split /,/, $rule->{match_status_list};
418	193	return 0 unless $allowed{ $row->{status} // '' };
419	194	}
420	195
421	196	return 1;
422	197	}
423	198
424	199	sub _glob_to_regex {
425	200	my $g = shift;
426	201	my $re = quotemeta $g;
427	202	# Handle glob patterns: escaped meta chars back to regex meaning
428	203	$re =~ s{\\\\\\}{.}g; # * -> .*
429	204	$re =~ s{\\\}{[^/]}g; # * -> [^/]*
430	205	$re =~ s{\\\?}{.}g; # ? -> .
431	206	return qr/^$re$/;
432	207	}
433	208
434	209	#---------------------------------------------------------------------
435	210	sub _build_payload {
436	211	my ($rule, $row, $kind) = @_;
437	212
438	213	my $where = $kind eq 'file'
439	214	? ($row->{file_name} // '(unknown file)')
440	215	: (($row->{database_name} // '?') . '.' . ($row->{table_name} // '?'));
441	216	my $when_utc = $row->{date_time} \|\| $row->{change_datetime} \|\| '';
442	217	my $server = $row->{server_name} \|\| 'local';
443	218	my $status_h = $kind eq 'file' ? ($row->{status} // '') : 'DDL change';
444	219	my $link_id = $row->{id};
445	220	my $link = "$public_url/diff.cgi?kind=$kind&id=$link_id";
446	221
447	222	my $summary = $kind eq 'file'
448	223	? "$status_h: $where on $server"
449	224	: "$where changed on $server";
450	225
451	226	my $slack = {
452	227	text => "DriftSense: $summary",
453	228	attachments => [{
454	229	color => $kind eq 'schema' ? '#f59e0b' : '#14b8a6',
455	230	fields => [
456	231	{ title => 'What', value => $where, short => 0 },
457	232	{ title => 'When', value => $when_utc, short => 1 },
458	233	{ title => 'Server', value => $server, short => 1 },
459	234	],
460	235	actions => [{
461	236	type => 'button', text => 'View diff', url => $link,
462	237	}],
463	238	}],
464	239	};
465	240	my $discord = {
466	241	content => "DriftSense: $summary",
467	242	embeds => [{
468	243	title => $where,
469	244	url => $link,
470	245	color => $kind eq 'schema' ? 16101915 : 1349286, # amber, teal
471	246	fields => [
472	247	{ name => 'When', value => $when_utc \|\| '?', inline => \1 },
473	248	{ name => 'Server', value => $server, inline => \1 },
474	249	],
475	250	}],
476	251	};
477	252	my $generic = {
478	253	source => 'drift_sense',
479	254	rule_id => $rule->{alert_rule_id},
480	255	rule_name => $rule->{rule_name},
481	256	kind => $kind,
482	257	summary => $summary,
483	258	target => $where,
484	259	server => $server,
485	260	when_utc => $when_utc,
486	261	ts_epoch => $row->{ts_epoch},
487	262	diff_url => $link,
488	263	status => $status_h,
489	264	};
490	265
491	266	return {
492	267	slack => $slack,
493	268	discord => $discord,
494	269	generic_webhook => $generic,
495	270	summary => $summary,
496	271	};
497	272	}
498	273
499	274	#---------------------------------------------------------------------
500	275	sub _deliver {
501	276	my ($rule, $payload) = @_;
502	277	my $kind = $rule->{delivery_kind};
503	278	my $url = $rule->{delivery_url};
504	279
505	280	if ($kind eq 'email') {
506		my $to = $rule->{delivery_email} \|\| '';
507		return ('failed', undef, undef, 'no delivery_email configured') unless length $to;
508		my $summary = $payload->{summary} // 'DriftSense alert';
509		my $target = ($payload->{generic_webhook} && $payload->{generic_webhook}{target}) // '(unknown)';
510		my $server = ($payload->{generic_webhook} && $payload->{generic_webhook}{server}) // 'local';
511		my $link = ($payload->{generic_webhook} && $payload->{generic_webhook}{diff_url}) // '';
512
513		my $mail_body = "DriftSense captured a change matching alert rule: $rule->{rule_name}\n\n"
514		. "Target : $target\n"
515		. "Server : $server\n"
516		. "Summary: $summary\n"
517		. ($link ? "Diff : $link\n" : '')
518		. "\n(Automated notification from DriftSense.)\n";
519
520		my $from = $cfg->settings('alert_from_email') \|\| 'drift_sense@localhost';
521		my $subj = "[DriftSense] " . substr($summary, 0, 120);
522
523		my $sendmail = '/usr/sbin/sendmail';
524		$sendmail = '/usr/lib/sendmail' unless -x $sendmail;
525		return ('failed', undef, undef, "no sendmail binary") unless -x $sendmail;
526
527		require IPC::Open3;
528		my ($wtr, $rdr, $err_fh);
529		$err_fh = Symbol::gensym();
530		my $pid = eval { IPC::Open3::open3($wtr, $rdr, $err_fh, $sendmail, '-t', '-i') };
531		return ('failed', undef, undef, "spawn: $@") if $@ \|\| !$pid;
532		binmode $wtr;
533		print {$wtr} "From: $from\r\n";
534		print {$wtr} "To: $to\r\n";
535		print {$wtr} "Subject: $subj\r\n";
536		print {$wtr} "Content-Type: text/plain; charset=utf-8\r\n";
537		print {$wtr} "\r\n";
538		print {$wtr} $mail_body;
539		close $wtr;
540		do { local $/; <$rdr> // ''; };
541		do { local $/; <$err_fh> // ''; };
542		close $rdr; close $err_fh;
543		waitpid $pid, 0;
544		my $rc = $? >> 8;
545		return $rc == 0
546		? ('sent', 0, "delivered to $to", undef)
547		: ('failed', $rc, undef, "sendmail exit $rc");
	281	return ('skipped', undef, undef, 'email delivery not yet implemented');
548	282	}
549	283	unless (length($url // '')) {
550	284	return ('failed', undef, undef, "no delivery URL configured");
551	285	}
552	286
553	287	my $body_ref = $kind eq 'slack' ? $payload->{slack}
554	288	: $kind eq 'discord' ? $payload->{discord}
555	289	: $payload->{generic_webhook};
556	290
557	291	# MODS::Webhook handles JSON encoding + curl transport; returns
558	292	# (http_code, response_body, error_message).
559	293	my ($code, $rbody, $err) = MODS::Webhook::post_json(
560	294	$url, $body_ref,
561	295	timeout => 8,
562	296	user_agent => 'DriftSense/1.0 (alert-dispatch)',
563	297	);
564	298	$rbody //= '';
565	299	$rbody = substr($rbody, 0, 500) if length($rbody) > 500;
566	300
567	301	if (!$err && $code >= 200 && $code < 400) {
568	302	return ('sent', $code, $rbody, undef);
569	303	}
570	304	return ('failed', $code, $rbody, $err \|\| "HTTP $code");
571	305	}
572	306
573	307	#---------------------------------------------------------------------
574	308	sub _log_delivery {
575	309	my ($rule, $row, $kind, $status, $http_code, $body, $err) = @_;
576	310	my $summary = substr(($rule->{rule_name} // '') . ' :: ' . ($row->{file_name}
577	311	\|\| ($row->{database_name} . '.' . $row->{table_name})
578	312	\|\| '?'), 0, 490);
579	313	my $q_summary = $dbh->quote($summary);
580	314	my $q_status = $dbh->quote($status);
581	315	my $q_body = $dbh->quote($body // '');
582	316	my $q_err = $dbh->quote($err // '');
583	317	my $q_code = defined($http_code) ? int($http_code) : 'NULL';
584	318
585	319	$db->db_readwrite($dbh, qq~
586	320	INSERT INTO ALERT_DELIVERIES
587	321	(alert_rule_id, source_kind, source_id, match_summary,
588	322	delivery_status, http_status, http_response, error_message)
589	323	VALUES
590	324	($rule->{alert_rule_id}, '$kind', $row->{id}, $q_summary,
591	325	$q_status, $q_code, $q_body, $q_err)
592	326	~, __FILE__, __LINE__);
593	327	}

Confirm restore

Backs current content to <target>.drift_restore_backup_<epoch>, writes the captured content, verifies SHA post-write.