4 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	14936b62dc	refactor: retire the images tarball backup ... Images and attachments are backed up off-site, one object per file, so the tar+zstd of /images goes: its service and restore, both tasks, the trigger and restore routes, the Keep last setting, the screen's Images section, and the tests. Migration 0122 drops backup_run.tar_path and import_settings.backup_images_keep_last_n and deletes any images runs. The local database dump stays for an install with no off-site destination, and the Backups card now says plainly that images and attachments are backed up only off-site. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 22:07:44 -05:00
bvandeusenandClaude Opus 5.5	375e7e2eda	feat: restore a new install from the off-site bucket, database first, then every file ... Settings → Maintenance → Backups gains "Restore from the bucket": pick one of the bucket's dated dumps, type its confirmation, and FabledCurator saves the current database to the bucket, replaces it with the dump, migrates it to this version, then fetches every image and attachment back to the path its row records. Each file is checked against its sha256 on arrival and moved into place only then; a file already on disk is left alone, so "Fetch missing files" repairs a library that lost files without touching the database. - services/backup_restore.py: list/find/fetch dumps, migrate, keep this install's destination (the dump's sealed secret can't be opened here), library_files work list, restore_file (one fetch per sha, copies for duplicate paths, refuses paths outside /images). - restore_offsite_task: the database phase, then 45-minute file chunks with a heartbeat; a failed load leaves an empty migrated database and says why. The dump's own run row is marked ok, other runs then going "Interrupted". - backup_s3.get_file: sha/size check on arrival, ObjectMissing for a 404, download pacing. - backup_service: every dump leaves the credential table's rows out; restore_db reports pg_restore's last line, stops at the first error, ends other connections and waits at most 60 s for locks. - Backups and orphan repair wait while a restore runs; the stall sweep judges restores by heartbeat; restore runs are pruned to 20. - CLI: python -m backend.app.scripts.restore list|database|files. - README: backup and restore section; logins are in no backup. - Tests: a round trip through an in-process S3 bucket (tests/fake_s3.py) with real pg_dump/pg_restore, plus file, run, API and get_file cases. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 14:34:47 -05:00
bvandeusen	df6d89cb59	fix(secure-context): full audit — DestructiveConfirmModal.expectedTokenOverride + bulk-delete + min-dim use backend-computed tokens ... Operator-flagged 2026-05-27: walk the whole project for the same shape as the min-dim Delete-button silent failure (crypto.subtle TypeError on plain HTTP). FC runs over plain HTTP per the homelab posture; Secure-Context-gated browser APIs are undefined on the production origin. **Audit results across `frontend/src/`:** crypto.subtle.digest — 2 sites: - MinDimensionCard (fixed 2026-05-27) - BulkEditorPanel (THIS FIX) navigator.clipboard — 1 site, already guarded: - utils/clipboard.js writeText with execCommand fallback serviceWorker / mediaDevices / Push / Web USB|HID|Bluetooth|Serial / cookieStore / queryLocalFonts / WebAuthn / geolocation — NOT USED, nothing to fix Extension scripts (background.js) use crypto.subtle but run from moz-extension:// which IS a Secure Context — left as-is. **BulkEditorPanel double bug** The bulk-delete UI on the gallery selection had been broken since FC-3k shipped, in two ways: 1. `crypto.subtle.digest` swallowed TypeError on plain HTTP — modal never opened. Same symptom as min-dim. 2. Even on HTTPS, the modal's `kind="images-selection"` produced `delete-images-selection-<sha8>` while the backend expected `delete-images-<sha8>`. The two would never match. Fix: - Backend `/api/admin/images/bulk-delete` dry-run response now returns `confirm_token` (the canonical `delete-images-<sha8>` string). Integration test `test_bulk_delete_dry_run_returns_counts` pinned to assert the new field. - DestructiveConfirmModal gains an `expectedTokenOverride` prop. When set, it bypasses the `${action}-${kind}-${runId}` formula and uses the explicit string. This decouples the UI label (`kind`) from the wire-format token (server-provided), so future endpoints can use a kind-specific label without their kind name leaking into the token. - BulkEditorPanel passes `:expected-token-override="bulkProjected?.confirm_token"` — no client-side crypto, no kind-prefix mismatch. - MinDimensionCard refactored to the same explicit pattern (was slicing the 8-char suffix off the backend's token and passing it through `runId`; now passes the full backend token via `expected-token-override` directly). Cleaner; one source of truth. **Banked memory** `feedback_no_secure_context_apis.md` documents the full table of Secure-Context-gated APIs, which ones FC currently uses, and how each is handled. Indexed in MEMORY.md. Sites for the audit also listed in the memory for future drift-checking. No other Secure-Context-gated APIs found in `frontend/src/`. The same shape won't recur unless someone adds a new dependency on one — at which point the banked memory should fire.	2026-05-27 21:17:40 -04:00
bvandeusenandClaude Opus 4.7	42c6b642c2	fc3k(ui): rename + relocate BackupConfirmModal → modal/DestructiveConfirmModal; add tier + projectedCounts props ... Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 00:46:37 -04:00