Expose sanitized backup restore evidence

tests/test_operational_checks.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
+from datetime import UTC, datetime, timedelta
 from pathlib import Path
 
 from govoplan_core.core.operations import (
@@ -156,3 +157,57 @@ def test_local_storage_capacity_reports_bounded_filesystem_metrics(
     assert metrics["capacity_observable"] is True
     assert metrics["capacity_total_bytes"] > 0
     assert 0 <= metrics["capacity_used_percent"] <= 100
+
+
+def test_deployer_backup_receipt_reports_verified_and_expired_state(
+    monkeypatch,
+) -> None:
+    now = datetime.now(UTC)
+    values = {
+        "GOVOPLAN_BACKUP_EVIDENCE_STATE": "verified",
+        "GOVOPLAN_BACKUP_EVIDENCE_ID": "evidence-1",
+        "GOVOPLAN_BACKUP_RECOVERY_POINT_ID": "recovery-1",
+        "GOVOPLAN_BACKUP_RESTORE_DRILL_ID": "drill-1",
+        "GOVOPLAN_BACKUP_EVIDENCE_SHA256": "a" * 64,
+        "GOVOPLAN_BACKUP_RELEASE_MANIFEST_SHA256": "b" * 64,
+        "GOVOPLAN_BACKUP_CAPTURED_AT": (now - timedelta(hours=2)).isoformat(),
+        "GOVOPLAN_BACKUP_EXPIRES_AT": (now + timedelta(hours=2)).isoformat(),
+        "GOVOPLAN_BACKUP_RESTORE_STARTED_AT": (
+            now - timedelta(hours=1, minutes=5)
+        ).isoformat(),
+        "GOVOPLAN_BACKUP_RESTORE_COMPLETED_AT": (now - timedelta(hours=1)).isoformat(),
+        "GOVOPLAN_BACKUP_VERIFIED_AT": (now - timedelta(minutes=30)).isoformat(),
+        "GOVOPLAN_BACKUP_MEASURED_RPO_SECONDS": "120",
+        "GOVOPLAN_BACKUP_MEASURED_RTO_SECONDS": "300",
+        "GOVOPLAN_BACKUP_COMPONENT_COUNT": "4",
+    }
+    for key, value in values.items():
+        monkeypatch.setenv(key, value)
+
+    verified = routes._backup_restore_check()
+    assert verified["state"] == "ok"
+    assert verified["metrics"]["recovery_point_id"] == "recovery-1"
+    assert verified["metrics"]["measured_rto_seconds"] == 300
+
+    monkeypatch.setenv(
+        "GOVOPLAN_BACKUP_EXPIRES_AT",
+        (now - timedelta(minutes=1)).isoformat(),
+    )
+    expired = routes._backup_restore_check()
+    assert expired["state"] == "warning"
+    assert expired["metrics"]["evidence_state"] == "expired"
+
+
+def test_deployer_backup_receipt_fails_closed_without_exposing_private_evidence(
+    monkeypatch,
+) -> None:
+    monkeypatch.setenv("GOVOPLAN_BACKUP_EVIDENCE_STATE", "invalid")
+    invalid = routes._backup_restore_check()
+
+    assert invalid["state"] == "warning"
+    assert invalid["metrics"] == {
+        "evidence_state": "invalid",
+        "restore_drill_ok": False,
+    }
+    assert "artifact" not in invalid["detail"].lower()
+    assert "key" not in invalid["detail"].lower()