Important Statuses can be deleted and modified

[ocket8888]

This Bug Report affects these Traffic Control components:

• Traffic Ops

Current behavior:

The Statuses named OFFLINE, ONLINE, REPORTED, PRE_PROD, and ADMIN_DOWN are handled specially by different parts of Traffic Control, and different parts of the code even go so far as to assume that OFFLINE, ONLINE, and REPORTED exist, but in fact there is no guarantee that any of the five exist at any given time.

That's because you can rename them (and less importantly change their descriptions):

GET /api/4.0/statuses?id=1 HTTP/1.1
Host: localhost:6443
Cookie: mojolicious=...
Content-Length: 0


HTTP/1.1 200 OK
Content-Type: application/json
Set-Cookie: mojolicious=...
Transfer-Encoding: chunked

{ "response": [{
	"description": "Server is Offline. Not active in any configuration.",
	"id": 1,
	"lastUpdated": "2021-10-14 08:04:39+00",
	"name": "OFFLINE"
}]}

PUT /api/3.0/statuses/1 HTTP/1.1
Cookie: mojolicious=...
Content-Length: 88
Content-Type: application/json

{"name": "Not OFFLINE anymore", "description": "an unhelpful or inaccurate description"}


HTTP/1.1 200 OK
Content-Type: application/json
Permissions-Policy: interest-cohort=()
Set-Cookie: mojolicious=...
Content-Length: 188

{
	"alerts": [
		{
			"text": "status was updated.",
			"level": "success"
		}
	],
	"response": {
		"description": "an unhelpful or inaccurate description",
		"id": 1,
		"lastUpdated": "2021-10-15 08:41:42+00",
		"name": "Not OFFLINE anymore"
	}
}

and even delete them:

DELETE /api/4.0/statuses/1 HTTP/1.1
Host: localhost:6443
Cookie: mojolicious=...
Content-Length: 0


HTTP/1.1 200 OK
Content-Type: application/json
Transfer-Encoding: chunked
Set-Cookie: mojolicious=...

{ "alerts": [{
	"text": "status was deleted.",
	"level": "success"
}]}

Expected behavior:

You shouldn't be able to get rid of things that we assume should exist. That means either disallowing those operations on certain of those objects, or disallowing those operations entirely. I've always been hopeful that we could do away with custom statuses, eliminating a server field, two endpoints, hundreds of lines of code, two database tables, and a lot of confusion and edge cases like this. However, that behavior is depended upon by many, so we can't get rid of it without at least an alternative (like the one proposed by #4819), so if nothing else we should ensure that all valid (i.e. only manipulated through the API) Traffic Ops server states contain the Statuses that ATC requires to function. At a minimum that would be REPORTED, but to avoid unexpected behavior when creating new Statuses with reserved names we should also do the same with the others mentioned above.

[ocket8888]

Also afaik these Statuses and their meanings aren't documented anywhere, which ought to change