Fix upgrade/Install issues post setup refactor

[bmfmancini]

This pull request introduces significant improvements to the syslog plugin’s database schema management and upgrade processes, making schema repairs safer, more robust, and modular. The changes add explicit repair functions for saved searches, dashboards, and dashboard panels, introduce a new repair mode for schema setup, and refactor the upgrade hooks to be more maintainable. Additionally, the plugin’s version is updated and legacy upgrade code is cleaned up.

Schema repair and upgrade improvements:

• Added syslog_ensure_saved_search_tables, syslog_ensure_dashboard_tables, and updated syslog_ensure_share_tables to explicitly repair and create missing or outdated tables and columns for saved searches, dashboards, and sharing, ensuring safer upgrades without dropping data. [1] [2]
• Introduced a repair mode to syslog_setup_table_new and a new syslog_ensure_table_structures function to complete interrupted installs/upgrades without dropping existing data, improving resilience and reliability during upgrades. [1] [2]
• Refactored the syslog schema setup to call these new repair functions, and adjusted logic to avoid dropping or truncating tables when in repair mode. [1] [2] [3] [4] [5] [6]

Plugin upgrade and hook management:

• Refactored plugin upgrade hooks: moved hook registration to a new syslog_upgrade_hook_module_paths function, which updates hook file paths and functions, making the codebase more modular and maintainable.
• Removed the legacy syslog_config_insert upgrade callback and its registration, as upgrades are now handled explicitly. [1] [2]

Permission and realm updates:

• Updated permission realm assignments and file associations to include new modules like syslog_device_rules.php, ensuring correct access control after schema or feature upgrades. [1] [2] [3]

Other improvements and maintenance:

• Updated the plugin version from 4.6 to 4.11 in INFO.
• Cleaned up and simplified upgrade logic, including removal of unnecessary calls to api_plugin_replicate_config and dead code in upgrade-related functions. [1] [2] [3] [4] [5] [6]

These changes make the syslog plugin’s schema management more robust, minimize risk during upgrades, and improve code maintainability.

[Copilot]

🟡 Changes recommended

Unresolved schema repair and remote initialization defects can block upgrades, delete legacy reports, and leave replication tables nontransactional.

5 open findings

• Create device-rule table before completeness checks · New
• Exclude main-only replication tables from remote checks · New
• Prevent destructive report drops during repair mode · New
• Restore local bootstrap migrations for remote collectors · New
• Restore replication storage-engine normalization · New

What changed in this PR

Improves Syslog installation and upgrade recovery after the setup-module refactor.

Changes:

• Adds schema repair helpers and completeness checks.
• Moves upgrade work to explicit lifecycle callbacks and updates permission mappings.
• Bumps the version to 4.11 and adjusts regression tests.

File	Description
tests/​Unit/​SetupModuleBoundaryTest.php	Checks lifecycle and module boundaries.
tests/​Security/​TraditionalTableDeprecationTest.php	Updates upgrade-notice expectations.
tests/​Security/​SavedSearchRealmUpgradeTest.php	Removes per-migration replication assertions.
tests/​Security/​RemoteCollectorInstallOptionsTest.php	Updates setup-call expectations.
tests/​Security/​ItemShareVisibilityTest.php	Adds schema repair checks.
tests/​Security/​DashboardRealmUpgradeTest.php	Removes per-migration replication assertions.
tests/​regression/​rule_realm_upgrade_test.php	Covers device-rule permissions.
setup.php	Refactors upgrade orchestration and hook migration.
INFO	Updates version to 4.11.
includes/​settings.php	Updates permissions and retires callback work.
includes/​schema.php	Adds repair mode and table completeness checks.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.