Reject a decrypted snapshot database that is not the requested one (closes #156)

Restore and deep verify downloaded and decrypted metadata/<key>/db.zst.age by object name alone. age decryption proves the database is readable, not that it is the snapshot that was asked for: an attacker who swaps in another valid db.zst.age could redirect the operation, and deep verify with a swapped database plus an empty manifest reported success with zero blobs verified.

After the database is opened, both paths now confirm its identity: an exported per-snapshot database holds one snapshot row, and a snapshot remote key derives from that row ID, so the database is the requested one exactly when its sole snapshot hashes back to the remote key fetched. The shared check lives in verifySnapshotDBIdentity, backed by a new SnapshotRepository.GetOnlySnapshot.

Model: opus-4-8

internal/vaultik/restore.go

@@ -19,6 +19,7 @@ import (
 	"sneak.berlin/go/vaultik/internal/blobgen"
 	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/snapshot"
 	"sneak.berlin/go/vaultik/internal/types"
 )
 
@@ -41,6 +42,8 @@ var (
 		"restored file has trailing data after its last chunk")
 	errRestoreIncomplete = errors.New(
 		"restore loop ended with files still pending")
+	errSnapshotDBMismatch = errors.New(
+		"decrypted database is not the requested snapshot")
 )
 
 // snapshotDBFilename is the name the decrypted snapshot database is
@@ -655,7 +658,53 @@ func (v *Vaultik) downloadSnapshotDB(
 
 	log.Debug("Decrypted database", "size", ubytes(int64(len(dbData))))
 
-	return v.materializeSnapshotDB(dbData)
+	db, tempDir, err := v.materializeSnapshotDB(dbData)
+	if err != nil {
+		return nil, "", err
+	}
+
+	// Confirm the decrypted database really is the snapshot named by
+	// remoteKey before any files are read from it. On mismatch, close the
+	// database and remove its private directory so nothing is left behind.
+	err = v.verifySnapshotDBIdentity(db, snapshotID, remoteKey)
+	if err != nil {
+		_ = db.Close()
+		_ = v.Fs.RemoveAll(tempDir)
+
+		return nil, "", err
+	}
+
+	return db, tempDir, nil
+}
+
+// verifySnapshotDBIdentity confirms the decrypted metadata database really
+// is the snapshot named by remoteKey. age decryption proves the database
+// is readable, not that the object served at
+// metadata/<remoteKey>/db.zst.age is the snapshot that was requested: an
+// attacker who swaps in another valid db.zst.age (which needs no key
+// material) would otherwise redirect restore and deep verify to a
+// different snapshot's contents. The exported per-snapshot database holds
+// exactly one snapshot row, and a snapshot's remote key is derived from
+// that row's ID, so the database is the requested one exactly when its
+// sole snapshot hashes back to remoteKey. Comparing the requested
+// identifier directly would not do: it may be a remote-key prefix a
+// recovery host uses in place of a human snapshot ID it cannot know.
+func (v *Vaultik) verifySnapshotDBIdentity(
+	db *database.DB, requested, remoteKey string,
+) error {
+	repos := database.NewRepositories(db)
+
+	snap, err := repos.Snapshots.GetOnlySnapshot(v.ctx)
+	if err != nil {
+		return fmt.Errorf("checking identity of database for %s: %w", requested, err)
+	}
+
+	if snapshot.RemoteSnapshotKey(snap.ID.String()) != remoteKey {
+		return fmt.Errorf("%w: requested %s but the database is snapshot %s",
+			errSnapshotDBMismatch, requested, snap.ID)
+	}
+
+	return nil
 }
 
 // materializeSnapshotDB writes the decrypted snapshot database bytes into