Skip to content

feat(backup): import a backup, swapped in on the next start - #200

Merged
httpsphl merged 2 commits into
mainfrom
feat/backup-import
Oct 5, 2026
Merged

httpsphl merged 2 commits into
mainfrom
feat/backup-import

Conversation

@httpsphl

@httpsphl httpsphl commented Oct 5, 2026

Copy link
Copy Markdown
Owner

Second part of backups, stacked on #199: this diff includes its commit until it merges.

Two steps, so nothing changes while Botloft runs.

Stage

  • backup.stage {path, passphrase} opens the file into <home>\restore\staged.zip.
  • It checks the manifest (format 1, not from a newer Botloft) and that the database is there.
  • It returns the manifest, so the app can show what comes.
  • A wrong passphrase or a file that is not a backup leaves nothing behind.

Confirm or cancel

  • backup.confirm marks the backup, and the app restarts Botloft.
  • backup.cancel drops it.

Swap on start, before the database opens:

  • The marker is removed first, so a failing backup is not retried forever.
  • The archive is unpacked into restore\unpacked, refusing entries that would land outside it.
  • The current botloft.db (with -wal and -shm) goes to <home>\before-restore\<time>, and the whole workspaces_root to <workspaces_root>-before-restore-<time>. Nothing is deleted.
  • Then the backup's database and folders go in place, copying when the folders are on different drives.

Spec: 14.2.

Test: tests/backup_restore.rs, exporting from one test daemon and restoring into another folder:

  • a wrong passphrase leaves nothing;
  • nothing applies before confirm;
  • after confirm: the database and memory are back, the old database and folders are kept aside, and it applies once.

Next: the screen in Settings.

…assphrase

backup.export copies the database (VACUUM INTO) and every crew's folder
in workspaces_root into a zip, leaving out what Botloft writes again on
every start, and seals it: Argon2id turns the passphrase into a key and
XChaCha20-Poly1305 in the STREAM construction encrypts it in 64 KiB
chunks. Nothing is readable without the passphrase, which is never
kept. The app will offer Save as for the file. Spec 14.2.
backup.stage opens a backup with the passphrase into <home>/restore and
checks its manifest and database; backup.confirm marks it, and on the
next start, before the database opens, the daemon unpacks it, moves the
current database and the whole workspaces_root aside (never deleted),
and puts the backup's in place. backup.cancel drops it. A marker is
cleared first, so a failing backup is not tried forever. Spec 14.2.
@httpsphl
httpsphl enabled auto-merge October 5, 2026 17:49
@httpsphl
httpsphl merged commit 652e540 into main Oct 5, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant