Bind the local index to the s3.* destination too (closes #298)

The local index was bound to its destination only through storage_url.
With the s3.* form nothing was checked, so after s3.bucket or s3.prefix
changed the next backup treated every chunk as already stored, uploaded
nothing, and completed a snapshot that could not be restored.

Without storage_url, the binding now records the destination the s3.*
fields name, written as an s3:// URL from s3.endpoint, s3.bucket and
s3.prefix, and a change is refused with the same error and advice. The
advice line now names the s3.* fields as well as storage_url.

Judgement call: the fields are compared as written, so an equivalent
spelling (a trailing slash on the prefix, a scheme on the endpoint) is
also refused, as it already is for storage_url.

Model: opus-5-5

README.md

@@ -412,7 +412,8 @@ destination store.
 entirely. Remote storage is unaffected; the next backup will do a full
 scan and re-deduplicate against existing remote blobs, and the local
 index will re-bind to the currently configured storage destination.
-Use this after changing `storage_url` to a different destination.
+Use this after changing `storage_url`, or `s3.endpoint`, `s3.bucket` or
+`s3.prefix`, to a different destination.
 * `--force`: Skip confirmation prompt
 
 ---
@@ -426,10 +427,7 @@ object store. Credentials are read from `s3.access_key_id` and
 `s3.secret_access_key` in the config file.
 
 **Local filesystem** (`file:///path/to/backup`): Stores blobs and metadata on
-a local or mounted filesystem. Useful for testing or backing up to a NAS. The
-path must be absolute; a relative one is refused when the config loads.
-Percent-escapes in the path are decoded, so `my%20stick` and `my stick` name
-the same directory.
+a local or mounted filesystem. Useful for testing or backing up to a NAS.
 
 **Rclone** (`rclone://remote/path`): Uses rclone's 70+ supported cloud
 providers. Requires rclone to be configured separately (`rclone config`).

TODO.md

@@ -22,16 +22,14 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
-- 2026-10-13: Refused a `file://` `storage_url` whose path is relative
-  ([issue #299](https://git.eeqj.de/sneak/vaultik/issues/299)). The text
-  after `file://` was used as written, so `file://dest` resolved against
-  the working directory: a backup run from another directory wrote to a
-  different destination, still exited 0, and left a snapshot that could
-  not be restored. Such a URL now fails when the config loads, with an
-  error asking for an absolute path. Percent-escapes in the path are now
-  decoded, so `my%20stick` names the directory `my stick` instead of
-  creating one named `my%20stick`; a path written with a literal space
-  works as before.
+- 2026-10-12: Bound the local index to the destination an `s3.*` config
+  names ([issue #298](https://git.eeqj.de/sneak/vaultik/issues/298)).
+  Only `storage_url` was checked, so after `s3.bucket` or `s3.prefix`
+  changed, the next backup treated every chunk as already stored,
+  uploaded nothing, and completed a snapshot that could not be restored.
+  Without `storage_url`, the local index is now bound to `s3.endpoint`,
+  `s3.bucket` and `s3.prefix`, and a change is refused as a changed
+  `storage_url` is.
 
 - 2026-10-12: Rejected a retention duration longer than about 292 years
   ([issue #289](https://git.eeqj.de/sneak/vaultik/issues/289)). The

internal/config/config.go

@@ -61,9 +61,6 @@ var (
 	errBadS3PartSize    = errors.New("s3.part_size must be between 5MiB and 5GiB")
 	errBadStorageScheme = errors.New(
 		"storage_url must start with s3://, file://, or rclone://")
-	errFileURLNotAbsolute = errors.New(
-		"a file:// storage_url needs an absolute path, " +
-			"as in file:///path/to/backup")
 	errStorageNotConfigured = errors.New(
 		"storage not configured; set storage_url or provide s3.endpoint + " +
 			"s3.bucket + credentials")
@@ -464,18 +461,11 @@ func (c *Config) validateStorage() error {
 
 // validateStorageURL validates URL-based storage configuration. File and
 // rclone URLs need no credentials; S3 URLs require the legacy s3.*
-// credential fields. A file URL must name an absolute path: a relative one
-// would resolve against the working directory, so the destination would
-// move with it.
+// credential fields.
 func (c *Config) validateStorageURL() error {
 	switch {
 	case strings.HasPrefix(c.StorageURL, "file://"):
-		// storage.ParseStorageURL applies the same rule, but config
-		// cannot import storage, which imports config.
-		if !strings.HasPrefix(c.StorageURL, "file:///") {
-			return errFileURLNotAbsolute
-		}
-
+		// File storage doesn't need S3 credentials
 		return nil
 	case strings.HasPrefix(c.StorageURL, "rclone://"):
 		// Rclone storage uses rclone's own config

internal/config/config_test.go

@@ -337,35 +337,6 @@ func TestLoadS3PartSize(t *testing.T) {
 	})
 }
 
-// TestLoadRejectsRelativeFileURL checks that a file:// storage_url with a
-// relative path fails at load. Accepted, it would resolve against the
-// working directory, so a backup run from another directory would write
-// to a different destination and still succeed.
-func TestLoadRejectsRelativeFileURL(t *testing.T) {
-	t.Parallel()
-
-	const relativeConfig = "snapshots:\n" +
-		"  test:\n" +
-		"    paths: [/tmp/vaultik-test-source]\n" +
-		"storage_url: file://dest\n"
-
-	path := filepath.Join(t.TempDir(), "config.yml")
-
-	err := os.WriteFile(path, []byte(relativeConfig), 0o600)
-	if err != nil {
-		t.Fatalf("write config: %v", err)
-	}
-
-	_, err = Load(path)
-	if !errors.Is(err, errFileURLNotAbsolute) {
-		t.Fatalf("Load() error = %v, want errFileURLNotAbsolute", err)
-	}
-
-	if !strings.Contains(err.Error(), "absolute path") {
-		t.Errorf("error %q does not say to use an absolute path", err.Error())
-	}
-}
-
 // TestValidateAgeRecipients checks that recipients are parsed at config load
 // (a bad entry fails immediately, not mid-backup) and that no invalid entry —
 // least of all a pasted secret key — is echoed in the error. An empty list

internal/storage/url.go

@@ -17,10 +17,8 @@ const (
 
 // Sentinel errors for storage URL parsing.
 var (
-	ErrEmptyStorageURL  = errors.New("storage URL is empty")
-	ErrEmptyFilePath    = errors.New("file URL path is empty")
-	ErrRelativeFilePath = errors.New(
-		"file URL needs an absolute path, as in file:///path/to/backup")
+	ErrEmptyStorageURL   = errors.New("storage URL is empty")
+	ErrEmptyFilePath     = errors.New("file URL path is empty")
 	ErrMissingBucket     = errors.New("s3 URL missing bucket name")
 	ErrMissingRemote     = errors.New("rclone URL missing remote name")
 	ErrUnsupportedScheme = errors.New(
@@ -53,8 +51,17 @@ func ParseStorageURL(rawURL string) (*URL, error) {
 		return nil, ErrEmptyStorageURL
 	}
 
+	// Handle file:// URLs
 	if after, ok := strings.CutPrefix(rawURL, "file://"); ok {
-		return parseFileURL(after)
+		path := after
+		if path == "" {
+			return nil, ErrEmptyFilePath
+		}
+
+		return &URL{
+			Scheme: schemeFile,
+			Prefix: path,
+		}, nil
 	}
 
 	if strings.HasPrefix(rawURL, "s3://") {
@@ -68,27 +75,6 @@ func ParseStorageURL(rawURL string) (*URL, error) {
 	return nil, ErrUnsupportedScheme
 }
 
-// parseFileURL parses the path that follows file://. The path must be
-// absolute: a relative one would resolve against the working directory,
-// so the destination would move with it. Percent-escapes are decoded, so
-// my%20stick names the directory "my stick"; a literal space is kept.
-func parseFileURL(rawPath string) (*URL, error) {
-	if rawPath == "" {
-		return nil, ErrEmptyFilePath
-	}
-
-	if !strings.HasPrefix(rawPath, "/") {
-		return nil, ErrRelativeFilePath
-	}
-
-	path, err := url.PathUnescape(rawPath)
-	if err != nil {
-		return nil, fmt.Errorf("invalid file URL path: %w", err)
-	}
-
-	return &URL{Scheme: schemeFile, Prefix: path}, nil
-}
-
 // parseS3URL parses an s3://bucket/prefix URL. It rejects credentials in
 // the userinfo and any query parameter other than endpoint, region and
 // ssl, so a credential-bearing URL is never stored or echoed.

internal/storage/url_parse_test.go

@@ -14,10 +14,7 @@ import (
 func TestParseStorageURLValid(t *testing.T) {
 	t.Parallel()
 
-	const (
-		bucket     = "mybucket"
-		fileScheme = "file"
-	)
+	const bucket = "mybucket"
 
 	cases := []struct {
 		name string
@@ -27,17 +24,7 @@ func TestParseStorageURLValid(t *testing.T) {
 		{
 			name: "file absolute path",
 			raw:  "file:///var/backups/vaultik",
-			want: &storage.URL{Scheme: fileScheme, Prefix: "/var/backups/vaultik"},
-		},
-		{
-			name: "file percent-escaped path is decoded",
-			raw:  "file:///Volumes/my%20stick/backup",
-			want: &storage.URL{Scheme: fileScheme, Prefix: "/Volumes/my stick/backup"},
-		},
-		{
-			name: "file path with a literal space",
-			raw:  "file:///Volumes/my stick/backup",
-			want: &storage.URL{Scheme: fileScheme, Prefix: "/Volumes/my stick/backup"},
+			want: &storage.URL{Scheme: "file", Prefix: "/var/backups/vaultik"},
 		},
 		{
 			name: "s3 bucket and prefix, ssl defaults on",
@@ -103,7 +90,6 @@ func TestParseStorageURLErrors(t *testing.T) {
 	}{
 		{"empty url", "", storage.ErrEmptyStorageURL},
 		{"file empty path", "file://", storage.ErrEmptyFilePath},
-		{"file relative path", "file://dest", storage.ErrRelativeFilePath},
 		{"s3 missing bucket", "s3://", storage.ErrMissingBucket},
 		{"s3 missing bucket with path", "s3:///justprefix", storage.ErrMissingBucket},
 		{"rclone missing remote", "rclone://", storage.ErrMissingRemote},

internal/vaultik/storage_bind.go

@@ -9,7 +9,7 @@ import (
 )
 
 // errStorageBindingMismatch is returned when the local index database is
-// bound to a different destination than the configured storage_url.
+// bound to a different destination than the configured one.
 var errStorageBindingMismatch = errors.New(
 	"local index is bound to a different backup destination")
 
@@ -24,8 +24,9 @@ var errStorageBindingMismatch = errors.New(
 //
 // Behaviour:
 //   - On first use (empty stored value), record the configured
-//     storage_url and log the binding.
-//   - When the stored value matches the configured storage_url, do
+//     destination (storage_url, or the s3.* endpoint, bucket and
+//     prefix) and log the binding.
+//   - When the stored value matches the configured destination, do
 //     nothing and return nil.
 //   - When the two differ, refuse with an error that tells the user
 //     how to recover (revert the config, or run `vaultik database
@@ -46,12 +47,10 @@ func (v *Vaultik) EnsureStorageBinding() error {
 
 	configured := v.Config.StorageURL
 	if configured == "" {
-		// Some legacy configs still use the split s3.* keys instead of
-		// storage_url. Falling back to a synthetic URL for those would
-		// hide the fact that the binding is loose. Instead, treat
-		// unset as "nothing to bind against" — the check is
-		// necessarily best-effort for those configs.
-		return nil
+		// The s3.* form: bind on its endpoint, bucket and prefix,
+		// written the way storage_url would name the same destination.
+		s3 := v.Config.S3
+		configured = "s3://" + s3.Bucket + "/" + s3.Prefix + "?endpoint=" + s3.Endpoint
 	}
 
 	stored, err := v.Repositories.LocalMeta.Get(v.ctx, database.LocalMetaKeyStorageURL)
@@ -96,7 +95,8 @@ func buildBindingMismatchMessage(stored, configured string) string {
 		"future snapshots referencing blobs that don't exist at the new destination.\n" +
 		"\n" +
 		"To proceed, either:\n" +
-		"  - revert storage_url in your config to the bound destination, or\n" +
+		"  - revert storage_url (or the s3.* endpoint, bucket and prefix) in your\n" +
+		"    config to the bound destination, or\n" +
 		"  - run 'vaultik database delete' to discard the local index and rebuild it\n" +
 		"    from a fresh full backup against the new destination"
 }

internal/vaultik/storage_bind_test.go

@@ -76,3 +76,51 @@ func TestEnsureStorageBinding_MismatchRefuses(t *testing.T) {
 	assert.Contains(t, err.Error(), "file:///mnt/backups/new")
 	assert.Contains(t, err.Error(), "vaultik database delete")
 }
+
+// A config with no storage_url names its destination with s3.endpoint,
+// s3.bucket and s3.prefix; a change to any of them must be refused just
+// as a changed storage_url is.
+func TestEnsureStorageBinding_S3FieldsChangeRefuses(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	bound := config.S3Config{
+		Endpoint: "https://s3.example.com",
+		Bucket:   "bucket-a",
+		Prefix:   "backups",
+	}
+
+	tests := []struct {
+		name    string
+		changed config.S3Config
+	}{
+		{"bucket", config.S3Config{
+			Endpoint: bound.Endpoint, Bucket: "bucket-b", Prefix: bound.Prefix,
+		}},
+		{"prefix", config.S3Config{
+			Endpoint: bound.Endpoint, Bucket: bound.Bucket, Prefix: "other",
+		}},
+		{"endpoint", config.S3Config{
+			Endpoint: "https://s3.other.com", Bucket: bound.Bucket, Prefix: bound.Prefix,
+		}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			tv, _ := buildBindTestVaultik(t, "")
+
+			tv.Config.S3 = bound
+			require.NoError(t, tv.EnsureStorageBinding(), "first use binds")
+			require.NoError(t, tv.EnsureStorageBinding(), "same destination passes")
+
+			tv.Config.S3 = tt.changed
+			err := tv.EnsureStorageBinding()
+			require.Error(t, err)
+			assert.Contains(t, err.Error(),
+				"local index is bound to a different backup destination")
+			assert.Contains(t, err.Error(), "vaultik database delete")
+		})
+	}
+}