Backups per repository: leave one out, or give it its own schedule d3b048b27277

-- Per-repository backups (docs/backups.md §5, oxygenhub#177): empty goes

-- with its owner's backup; `off` leaves it out; `hourly` or `daily` backs

-- it up at least that often, whatever its owner's schedule.

ALTER TABLE repositories ADD COLUMN backup TEXT NOT NULL DEFAULT '';

        .route("/repos/{owner}/{name}/backup", axum::routing::put(set_backup))

struct BackupSetting {

    /// `owner` (with its owner's), `hourly`, `daily` or `off`.

    backup: String,

}

/// `PUT /repos/{owner}/{name}/backup {"backup": ...}`: this repository's

/// backup (docs/backups.md §5). Owners and admins.

async fn set_backup(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name)): Path<(String, String)>,

    Json(b): Json<BackupSetting>,

) -> Result<Json<serde_json::Value>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Maintain).await?;

    let setting = match b.backup.as_str() {

        "owner" => "",

        "hourly" | "daily" | "off" => b.backup.as_str(),

        _ => return Err(ApiError(StatusCode::BAD_REQUEST, "backup is owner, hourly, daily or off".into())),

    };

    db::repos::set_backup(&app.db, row.id, setting).await?;

    db::accounts::audit(&app.db, c.account.as_ref(), "repo.backup", &format!("{owner}/{name}"), &b.backup).await.ok();

    Ok(Json(serde_json::json!({ "backup": b.backup })))

}

#[derive(serde::Deserialize)]

/// What a repository may choose about its backup (§5): with its owner's,

/// left out, or at least hourly or daily whatever its owner's schedule.

pub const REPO_CHOICES: &[(&str, &str)] =

    &[("", "With its owner's backup"), ("hourly", "At least every hour"), ("daily", "At least every day"), ("off", "Left out")];

/// Whether `row` is in its owner's run: never when it is left out, always

/// when it has its own schedule, else as its owner's schedule says (a run

/// asked for by hand takes every repository not left out).

pub fn included(s: &Setting, row: &db::repos::RepoRow, by_hand: bool) -> bool {

    match row.backup.as_str() {

        "off" => false,

        "hourly" | "daily" => true,

        _ => by_hand || s.every != "off",

    }

}

/// Seconds between an owner's runs: the shortest of its own schedule and

/// its repositories' own; none when nothing is scheduled.

pub fn period_with(s: &Setting, repos: &[db::repos::RepoRow]) -> Option<i64> {

    let own = repos.iter().filter_map(|r| match r.backup.as_str() {

        "hourly" => Some(3600),

        "daily" => Some(86_400),

        _ => None,

    });

    s.period_s().into_iter().chain(own).min()

}

        let repos = db::repos::list(pool).await?.iter().filter(|r| r.owner == s.owner && included(&s, r, false)).count() as i64;

    let uncovered = counts.into_iter().filter(|(owner, _)| !out.iter().any(|o| o.setting.owner == *owner && o.repos > 0)).collect();

    let outcome = run_into(app, &s, &at, trigger == "now").await;

async fn run_into(app: &Shared, s: &Setting, at: &str, by_hand: bool) -> Result<((i64, Sent), Vec<String>)> {

    // Its repositories, but those left out (§5).

    let mine: Vec<db::repos::RepoRow> =

        db::repos::list(&app.db).await?.into_iter().filter(|r| r.owner == s.owner && included(s, r, by_hand)).collect();

/// The owners whose next run is due now: by their own schedule, or by

/// the shortest schedule one of their repositories chose (§5). A run takes

/// every included repository and sends only what changed, so each run

/// stays whole and a restore point has everything.

    let all: Vec<Setting> = sqlx::query_as("SELECT * FROM backup_settings WHERE updated_ms > 0").fetch_all(pool).await?;

    let repos = db::repos::list(pool).await?;

        let theirs: Vec<db::repos::RepoRow> = repos.iter().filter(|r| r.owner == s.owner).cloned().collect();

        let Some(period) = period_with(&s, &theirs) else { continue };

    /// Backups (migration 0062): empty with its owner's, `off`, or its own

    /// `hourly` or `daily`.

    #[sqlx(default)]

    pub backup: String,

    Ok(())

}

pub async fn set_backup(pool: &Pool, id: i64, setting: &str) -> sqlx::Result<()> {

    sqlx::query("UPDATE repositories SET backup = ? WHERE id = ?").bind(setting).bind(id).execute(pool).await?;

        .route("/{owner}/{name}/settings/backup", post(repo_settings::backup))

    /// Its owner's backup, when one is set up (docs/backups.md §5).

    backup_owner: Option<crate::backups::Setting>,

impl RepoSettingsPage {

    fn backup_choices(&self) -> &'static [(&'static str, &'static str)] {

        crate::backups::REPO_CHOICES

    }

}

    let backup_owner = crate::backups::setting(&app.db, &row.owner).await.map_err(|e| Error::from_db(shell.clone(), e))?;

        backup_owner,

}

#[derive(Deserialize)]

pub struct BackupForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    /// Empty (with its owner's), `hourly`, `daily` or `off`.

    #[serde(default)]

    backup: String,

}

/// This repository's backup (docs/backups.md §5): with its owner's, left

/// out, or at least hourly or daily. Its owners and admins decide.

pub async fn backup(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name)): Path<(String, String)>,

    Form(f): Form<BackupForm>,

) -> Result<Page<RepoSettingsPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/settings"), &viewer);

    let (_, row, role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Maintain).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    if !crate::backups::REPO_CHOICES.iter().any(|(v, _)| *v == f.backup) {

        return settings_page(&app, shell, row, role, None, Some("Pick how this repository is backed up.".into())).await;

    }

    db::repos::set_backup(&app.db, row.id, &f.backup).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let what = if f.backup.is_empty() { "with its owner's" } else { f.backup.as_str() };

    accounts::audit(&app.db, viewer.account(), "repo.backup", &format!("{owner}/{name}"), what).await.ok();

    let row = db::repos::get_by_id(&app.db, row.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.unwrap_or(row);

    let notice = match f.backup.as_str() {

        "off" => "This repository is left out of its owner's backups from the next run.".to_string(),

        "" => "This repository is backed up with its owner's.".to_string(),

        every => {

            format!("This repository is backed up at least {} from now on.", if every == "hourly" { "every hour" } else { "every day" })

        }

    };

    settings_page(&app, shell, row, role, Some(notice), None).await

/// docs/backups.md §5 (BP3): a repository left out is in no run; one with

/// its own schedule makes its owner's backup run at least that often, and

/// alone when its owner's is off; a run by hand takes all but those left

/// out.

#[tokio::test(flavor = "multi_thread")]

async fn repositories_choose_their_own_backup() {

    let store = tempfile::tempdir().unwrap();

    let h = hub(store.path()).await;

    db::accounts::create_account(&h.app.db, "andy", "[email protected]", "x", "salt", false).await.unwrap();

    for n in ["game", "notes", "secret"] {

        create(&h.app, "andy", n, hub_api::Visibility::Public).await;

        let work = tempfile::tempdir().unwrap();

        push(&format!("{}/andy/{n}", h.base), work.path(), &[("README.md", n)]);

    }

    let id = |n: &'static str| {

        let db = h.app.db.clone();

        async move { db::repos::get(&db, "andy", n).await.unwrap().unwrap().id }

    };

    db::repos::set_backup(&h.app.db, id("secret").await, "off").await.unwrap();

    let mut s = Setting::off("andy", "user");

    s.every = "daily".into();

    s.target = store.path().display().to_string();

    backups::save(&h.app.db, &s).await.unwrap();

    let names = |at: String| {

        let dest = Directory { root: store.path().join("andy") };

        let mut v = dest.list(&format!("runs/{at}/records")).unwrap();

        v.sort();

        v

    };

    let first = backups::run(&h.app, "andy", "schedule").await.unwrap();

    assert_eq!((first.status.as_str(), first.repos), ("ok", 2), "{}", first.detail);

    assert_eq!(names(first.at.clone()), vec!["game.json", "notes.json"], "the one left out is not in it");

    // Daily, and it just ran: not due, until a repository asks for hourly.

    assert!(backups::due(&h.app.db).await.unwrap().is_empty());

    db::repos::set_backup(&h.app.db, id("game").await, "hourly").await.unwrap();

    sqlx::query("UPDATE backup_runs SET started_ms = started_ms - 2 * 3600 * 1000").execute(&h.app.db).await.unwrap();

    assert_eq!(backups::due(&h.app.db).await.unwrap().len(), 1, "hourly for the game");

    // The owner's schedule off: only the game, which asks for its own.

    s.every = "off".into();

    backups::save(&h.app.db, &s).await.unwrap();

    assert_eq!(backups::due(&h.app.db).await.unwrap().len(), 1);

    tokio::time::sleep(std::time::Duration::from_millis(1100)).await;

    let second = backups::run(&h.app, "andy", "schedule").await.unwrap();

    assert_eq!(names(second.at.clone()), vec!["game.json"]);

    // By hand: everything but the one left out.

    tokio::time::sleep(std::time::Duration::from_millis(1100)).await;

    let third = backups::run(&h.app, "andy", "now").await.unwrap();

    assert_eq!(names(third.at.clone()), vec!["game.json", "notes.json"]);

    // Admin › Backups counts what the next scheduled run covers.

    let (owners, uncovered) = backups::overview(&h.app.db).await.unwrap();

    assert_eq!((owners[0].repos, uncovered.len()), (1, 0));

}

    // A repository chooses its own (BP3): its owners decide.

    let game = get(app, "/bob/game/settings", Some(&bob)).await;

    assert!(game.body.contains("bob has no backup set up yet") && game.body.contains(r#"name="backup" value="" checked"#), "{}", game.body);

    let csrf = csrf_of(&game.body);

    let saved = post(app, "/bob/game/settings/backup", Some(&bob), &format!("_csrf={csrf}&backup=off")).await;

    assert!(saved.body.contains("left out of its owner"), "{}", saved.body);

    assert_eq!(db::repos::get(&app.db, "bob", "game").await.unwrap().unwrap().backup, "off");

    let bad = post(app, "/bob/game/settings/backup", Some(&bob), &format!("_csrf={csrf}&backup=weekly")).await;

    assert!(bad.body.contains("Pick how this repository is backed up."));

release assets travel with the stores; Admin › Backups (#176);

per-repository settings (#177). Next: S3.

- **A repository** (built 2026-10-14, oxygenhub#177): its Settings ›

  Backup, or `PUT /repos/{owner}/{name}/backup {"backup": "owner" |

  "hourly" | "daily" | "off"}`, by its owners and admins (migration

  0062). Left out, it is in no new run. With its own schedule, its

  owner's backup runs at least that often, and runs even when the owner's

  own schedule is off (taking only the repositories that asked); a run

  sends only what changed and keeps every included repository, so each

  run stays whole and restores everything. A run asked for by hand takes

  every repository not left out.

<form class="card wide" id="backup" method="post" action="{{ repo.url }}/settings/backup">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Backup</h2>

  {% if let Some(b) = backup_owner %}

  <p>{{ row.owner }} backs up {% if b.every == "off" %}only by hand or when a repository asks{% else %}{% if b.every == "hourly" %}every hour{% else %}every day{% endif %}{% endif %} to {% if b.destination == "gcs" %}<code>gs://{{ b.target }}</code>{% else %}a directory on this hub's host{% endif %}. Every repository goes with it unless it says otherwise here.</p>

  {% else %}

  <p>{{ row.owner }} has no backup set up yet: a user sets one up in <a href="/settings/backups">Settings › Backups</a>, an organisation's owners in its settings. What you choose here applies once it has.</p>

  {% endif %}

  <div class="choice">

    {% for (v, label) in backup_choices() %}<label><input type="radio" name="backup" value="{{ v }}"{% if row.backup == *v %} checked{% endif %}> {{ label }}</label>{% endfor %}

  </div>

  <p class="small mute">A repository with its own schedule makes its owner's backup run at least that often; each run sends only what changed and keeps every repository, so any run restores everything. Left out, it is in no new run; earlier runs keep it until they are pruned.</p>

  <button type="submit">SAVE</button>

</form>