List a file:// destination through a symlinked directory (closes #296)

List and ListStream walked the destination with afero.Walk, which uses
Lstat and so reported a symlinked metadata/ or blobs/ directory as one
file, while Put, Get and Stat follow the link. The store then listed as
empty, and prune removed the local snapshot records and deleted every
blob. Both listings now walk a view of the filesystem without its Lstat
method, so afero falls back to Stat and enters the link.

A symlink loop is not detected: it is followed until the system refuses
the path for too many levels of links, and the listing fails.

Model: opus-5-5

README.md

@@ -412,8 +412,7 @@ destination store.
 entirely. Remote storage is unaffected; the next backup will do a full
 scan and re-deduplicate against existing remote blobs, and the local
 index will re-bind to the currently configured storage destination.
-Use this after changing `storage_url`, or `s3.endpoint`, `s3.bucket` or
+Use this after changing `storage_url` to a different destination.
-`s3.prefix`, to a different destination.
 * `--force`: Skip confirmation prompt
 
 ---

TODO.md

@@ -29,18 +29,8 @@ the tag exists and is exercised; what is left is merging `next` to
   empty while backups and restores still worked through the link.
   `prune` then removed the local snapshot records and deleted every blob,
   and `remote info` and `remote nuke` found no blobs. The listings now
-  read through the link as `Get` and `Stat` do. A link whose target is
+  read through the link as `Get` and `Stat` do; a link pointing back up
-  missing, such as one to a volume that is not mounted, or a link
+  the tree makes them fail.
-  pointing back up the tree makes them fail.
-
-- 2026-10-12: Bound the local index to the destination an `s3.*` config
-  names ([issue #298](https://git.eeqj.de/sneak/vaultik/issues/298)).
-  Only `storage_url` was checked, so after `s3.bucket` or `s3.prefix`
-  changed, the next backup treated every chunk as already stored,
-  uploaded nothing, and completed a snapshot that could not be restored.
-  Without `storage_url`, the local index is now bound to `s3.endpoint`,
-  `s3.bucket` and `s3.prefix`, and a change is refused as a changed
-  `storage_url` is.
 
 - 2026-10-12: Rejected a retention duration longer than about 292 years
   ([issue #289](https://git.eeqj.de/sneak/vaultik/issues/289)). The

internal/storage/file.go

@@ -121,9 +121,8 @@ func (f *FileStorer) Delete(_ context.Context, key string) error {
 }
 
 // List returns all keys with the given prefix, reading through symlinked
-// directories. It fails when the destination directory is missing or the
+// directories. It fails when the destination directory is missing; a
-// prefix is a symlink whose target is missing; a missing prefix under the
+// missing prefix under it is an empty listing.
-// destination directory is an empty listing.
 func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error) {
 	var keys []string
 
@@ -134,7 +133,8 @@ func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error)
 
 	basePath := f.fullPath(prefix)
 
-	exists, err := f.prefixExists(basePath)
+	// Check if the prefix exists
+	exists, err := afero.Exists(f.fs, basePath)
 	if err != nil {
 		return nil, fmt.Errorf("checking path: %w", err)
 	}
@@ -177,8 +177,7 @@ func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error)
 
 // ListStream returns a channel of ObjectInfo for large result sets. Like
 // List, it reads through symlinked directories and sends an error when
-// the destination directory is missing or the prefix is a symlink whose
+// the destination directory is missing.
-// target is missing.
 func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan ObjectInfo {
 	ch := make(chan ObjectInfo)
 
@@ -194,7 +193,8 @@ func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan Objec
 
 		basePath := f.fullPath(prefix)
 
-		exists, err := f.prefixExists(basePath)
+		// Check if the prefix exists
+		exists, err := afero.Exists(f.fs, basePath)
 		if err != nil {
 			ch <- ObjectInfo{Err: fmt.Errorf("checking path: %w", err)}
 
@@ -364,29 +364,6 @@ func (f *FileStorer) walk(root string, fn filepath.WalkFunc) error {
 	return afero.Walk(struct{ afero.Fs }{f.fs}, root, fn)
 }
 
-// prefixExists is afero.Exists, except that it does not follow a symlink
-// at path. A symlinked prefix whose target is missing, such as a link to
-// a volume that is not mounted, therefore exists, and walk then fails on
-// it; with afero.Exists it would list as empty, and prune would delete
-// every blob.
-func (f *FileStorer) prefixExists(path string) (bool, error) {
-	lstater, ok := f.fs.(afero.Lstater)
-	if !ok {
-		return afero.Exists(f.fs, path)
-	}
-
-	_, _, err := lstater.LstatIfPossible(path)
-	if err == nil {
-		return true, nil
-	}
-
-	if os.IsNotExist(err) {
-		return false, nil
-	}
-
-	return false, err
-}
-
 // fullPath returns the full filesystem path for a key.
 func (f *FileStorer) fullPath(key string) string {
 	return filepath.Join(f.basePath, key)

internal/storage/file_backend_test.go

@@ -119,57 +119,6 @@ func TestFileStorerListsThroughSymlinkedDirectory(t *testing.T) {
 	}
 }
 
-// TestFileStorerListFailsOnSymlinkWithMissingTarget checks that List and
-// ListStream fail on a symlinked metadata/ or blobs/ directory whose target
-// is missing, such as a link to a volume that is not mounted, as they do on
-// a missing destination directory, instead of listing it as empty.
-func TestFileStorerListFailsOnSymlinkWithMissingTarget(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-
-	for _, dir := range []string{"metadata", "blobs"} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			base := t.TempDir()
-
-			s, err := storage.NewFileStorer(base)
-			if err != nil {
-				t.Fatalf("NewFileStorer: %v", err)
-			}
-
-			unmounted := filepath.Join(t.TempDir(), "unmounted")
-
-			err = os.Symlink(unmounted, filepath.Join(base, dir))
-			if err != nil {
-				t.Fatalf("Symlink: %v", err)
-			}
-
-			for _, prefix := range []string{"", dir + "/"} {
-				keys, err := s.List(ctx, prefix)
-				if !errors.Is(err, fs.ErrNotExist) {
-					t.Errorf("List(%q) = %v, %v; want a not-exist error",
-						prefix, keys, err)
-				}
-
-				var streamErr error
-
-				for object := range s.ListStream(ctx, prefix) {
-					if object.Err != nil {
-						streamErr = object.Err
-					}
-				}
-
-				if !errors.Is(streamErr, fs.ErrNotExist) {
-					t.Errorf("ListStream(%q) error = %v, want a not-exist error",
-						prefix, streamErr)
-				}
-			}
-		})
-	}
-}
-
 // TestFileStorerListFailsOnSymlinkLoop checks that a symlink pointing back
 // at the destination makes List and ListStream fail instead of walking it
 // forever.

internal/vaultik/storage_bind.go

@@ -9,7 +9,7 @@ import (
 )
 
 // errStorageBindingMismatch is returned when the local index database is
-// bound to a different destination than the configured one.
+// bound to a different destination than the configured storage_url.
 var errStorageBindingMismatch = errors.New(
 	"local index is bound to a different backup destination")
 
@@ -24,9 +24,8 @@ var errStorageBindingMismatch = errors.New(
 //
 // Behaviour:
 //   - On first use (empty stored value), record the configured
-//     destination (storage_url, or the s3.* endpoint, bucket and
+//     storage_url and log the binding.
-//     prefix) and log the binding.
+//   - When the stored value matches the configured storage_url, do
-//   - When the stored value matches the configured destination, do
 //     nothing and return nil.
 //   - When the two differ, refuse with an error that tells the user
 //     how to recover (revert the config, or run `vaultik database
@@ -47,10 +46,12 @@ func (v *Vaultik) EnsureStorageBinding() error {
 
 	configured := v.Config.StorageURL
 	if configured == "" {
-		// The s3.* form: bind on its endpoint, bucket and prefix,
+		// Some legacy configs still use the split s3.* keys instead of
-		// written the way storage_url would name the same destination.
+		// storage_url. Falling back to a synthetic URL for those would
-		s3 := v.Config.S3
+		// hide the fact that the binding is loose. Instead, treat
-		configured = "s3://" + s3.Bucket + "/" + s3.Prefix + "?endpoint=" + s3.Endpoint
+		// unset as "nothing to bind against" — the check is
+		// necessarily best-effort for those configs.
+		return nil
 	}
 
 	stored, err := v.Repositories.LocalMeta.Get(v.ctx, database.LocalMetaKeyStorageURL)
@@ -95,8 +96,7 @@ func buildBindingMismatchMessage(stored, configured string) string {
 		"future snapshots referencing blobs that don't exist at the new destination.\n" +
 		"\n" +
 		"To proceed, either:\n" +
-		"  - revert storage_url (or the s3.* endpoint, bucket and prefix) in your\n" +
+		"  - revert storage_url in your config to the bound destination, or\n" +
-		"    config to the bound destination, or\n" +
 		"  - run 'vaultik database delete' to discard the local index and rebuild it\n" +
 		"    from a fresh full backup against the new destination"
 }

internal/vaultik/storage_bind_test.go

@@ -76,51 +76,3 @@ func TestEnsureStorageBinding_MismatchRefuses(t *testing.T) {
 	assert.Contains(t, err.Error(), "file:///mnt/backups/new")
 	assert.Contains(t, err.Error(), "vaultik database delete")
 }
-
-// A config with no storage_url names its destination with s3.endpoint,
-// s3.bucket and s3.prefix; a change to any of them must be refused just
-// as a changed storage_url is.
-func TestEnsureStorageBinding_S3FieldsChangeRefuses(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	bound := config.S3Config{
-		Endpoint: "https://s3.example.com",
-		Bucket:   "bucket-a",
-		Prefix:   "backups",
-	}
-
-	tests := []struct {
-		name    string
-		changed config.S3Config
-	}{
-		{"bucket", config.S3Config{
-			Endpoint: bound.Endpoint, Bucket: "bucket-b", Prefix: bound.Prefix,
-		}},
-		{"prefix", config.S3Config{
-			Endpoint: bound.Endpoint, Bucket: bound.Bucket, Prefix: "other",
-		}},
-		{"endpoint", config.S3Config{
-			Endpoint: "https://s3.other.com", Bucket: bound.Bucket, Prefix: bound.Prefix,
-		}},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			tv, _ := buildBindTestVaultik(t, "")
-
-			tv.Config.S3 = bound
-			require.NoError(t, tv.EnsureStorageBinding(), "first use binds")
-			require.NoError(t, tv.EnsureStorageBinding(), "same destination passes")
-
-			tv.Config.S3 = tt.changed
-			err := tv.EnsureStorageBinding()
-			require.Error(t, err)
-			assert.Contains(t, err.Error(),
-				"local index is bound to a different backup destination")
-			assert.Contains(t, err.Error(), "vaultik database delete")
-		})
-	}
-}

internal/vaultik/symlinked_destination_test.go

@@ -29,8 +29,24 @@ func TestPruneDeletesNothingThroughSymlinkedDirectory(t *testing.T) {
 			ctx := context.Background()
 			storeDir := filepath.Join(t.TempDir(), "store")
 			v, repos, _ := backUpToFileDestination(ctx, t, storeDir)
-			blobFiles := blobFilesIn(t, storeDir)
+
-			moveBehindSymlink(t, storeDir, dir)
+			var blobFiles []string
+
+			err := filepath.WalkDir(filepath.Join(storeDir, "blobs"),
+				func(path string, entry fs.DirEntry, err error) error {
+					if err == nil && !entry.IsDir() {
+						blobFiles = append(blobFiles, path)
+					}
+
+					return err
+				})
+			require.NoError(t, err)
+			require.NotEmpty(t, blobFiles)
+
+			linkPath := filepath.Join(storeDir, dir)
+			movedPath := filepath.Join(t.TempDir(), dir)
+			require.NoError(t, os.Rename(linkPath, movedPath))
+			require.NoError(t, os.Symlink(movedPath, linkPath))
 
 			require.NoError(t, v.Prune(&vaultik.PruneOptions{Force: true}))
 
@@ -45,77 +61,3 @@ func TestPruneDeletesNothingThroughSymlinkedDirectory(t *testing.T) {
 		})
 	}
 }
-
-// TestPruneFailsOnSymlinkedDirectoryWithMissingTarget checks that prune
-// fails, deleting no blob and keeping the local snapshot record, when the
-// metadata/ or blobs/ directory of a file:// destination is a symlink
-// whose target is missing, as a link to a volume that is not mounted is.
-func TestPruneFailsOnSymlinkedDirectoryWithMissingTarget(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	for _, dir := range []string{"metadata", "blobs"} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-			storeDir := filepath.Join(t.TempDir(), "store")
-			v, repos, _ := backUpToFileDestination(ctx, t, storeDir)
-			blobFiles := blobFilesIn(t, storeDir)
-			targetPath := moveBehindSymlink(t, storeDir, dir)
-
-			// Unmount the volume the link points to, and mount it again
-			// once prune has run.
-			unmountedPath := targetPath + "-unmounted"
-			require.NoError(t, os.Rename(targetPath, unmountedPath))
-
-			err := v.Prune(&vaultik.PruneOptions{Force: true})
-			require.ErrorIs(t, err, fs.ErrNotExist)
-
-			require.NoError(t, os.Rename(unmountedPath, targetPath))
-
-			// When blobs/ is the link, these paths run through it.
-			for _, blobFile := range blobFiles {
-				assert.FileExists(t, blobFile, "prune must delete no blob")
-			}
-
-			snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-			require.NoError(t, err)
-			assert.Len(t, snapshots, 1, "prune must delete no local snapshot record")
-		})
-	}
-}
-
-// blobFilesIn returns the paths of the blob files under storeDir/blobs, and
-// fails the test when there are none.
-func blobFilesIn(t *testing.T, storeDir string) []string {
-	t.Helper()
-
-	var blobFiles []string
-
-	err := filepath.WalkDir(filepath.Join(storeDir, "blobs"),
-		func(path string, entry fs.DirEntry, err error) error {
-			if err == nil && !entry.IsDir() {
-				blobFiles = append(blobFiles, path)
-			}
-
-			return err
-		})
-	require.NoError(t, err)
-	require.NotEmpty(t, blobFiles)
-
-	return blobFiles
-}
-
-// moveBehindSymlink moves storeDir/dir to a directory elsewhere, puts a
-// symlink to it in its place, and returns where it went.
-func moveBehindSymlink(t *testing.T, storeDir, dir string) string {
-	t.Helper()
-
-	linkPath := filepath.Join(storeDir, dir)
-	targetPath := filepath.Join(t.TempDir(), dir)
-	require.NoError(t, os.Rename(linkPath, targetPath))
-	require.NoError(t, os.Symlink(targetPath, linkPath))
-
-	return targetPath
-}