Two related changes, both addressing leakage and brittleness around
the public bytes the destination store sees.
First, every remote storage path that previously embedded a human
snapshot ID (e.g. metadata/heraklion_berlin.sneak.fs.photos.2026.
catalog_2026-06-24T07:00:15Z/...) now uses the hashed remote key:
RemoteSnapshotKey(id) = hex(SHA256(SHA256("vaultik|" + id)))
Applied at:
* uploadSnapshotArtifacts (snapshot create write path)
* the manifest.json.zst snapshot_id field — manifest is
unencrypted, so the human ID would otherwise be readable to
anyone with bucket-list permission
* cleanupIncompleteSnapshots metadata-existence probe
* snapshot restore / verify (downloadSnapshotDB,
loadVerificationData)
* downloadManifestByKey, deleteRemoteSnapshotByKey
* CleanupLocalSnapshots reconciliation
* the locally-driven removal paths (RemoveSnapshot,
RemoveAllSnapshots, confirmAndExecutePurge)
The local index database keeps human IDs everywhere — the hash is a
boundary translation, not a rename. A directory listing of the
backup destination now looks like
"metadata/<64-hex>/{db.zst.age,manifest.json.zst}" with no host,
snapshot-name, or timestamp information visible.
Second, snapshot list no longer fails just because remote storage is
unreachable, and only consults the remote when the local machine can
plausibly decrypt:
* Listing is always driven by the local index database — that's
what holds the human IDs, timestamps, and per-snapshot stats
that the table actually shows.
* If no age secret key is configured, we skip remote listing
entirely (the box is treated as a write-only backup machine —
there's no value showing it remote-only keys it could never
restore).
* If a key IS configured, we try the remote listing; failures
(volume unmounted, permission denied, network error) downgrade
to a warning instead of aborting the command.
* When the remote listing succeeds, we cross-reference by hashing
each local human ID and diffing against the returned key set.
Local-only snapshots get the existing "stale local record"
cleanup hint; remote-only keys are surfaced as a single
"NOTE: N remote snapshot(s) found in backup destination store
but not in local database" line.
FileStorer construction also no longer does an eager mkdir — the
basePath is recorded and the directory is created lazily on first
write. A missing or unmounted destination during `snapshot list`
should NOT block the command, and now it doesn't.
RemoveAllSnapshots is rewritten to drive deletion from the local
index instead of from a remote listing, hashing each local ID to
find the corresponding remote key. Orphan remote keys (no matching
local snapshot) are handled separately and only deleted when
--remote is set. Existing tests are updated to hash storage paths
through the new RemoteSnapshotKey helper.
The hash format is a hard pre-1.0 break: existing remote snapshots
written under the human-ID path scheme are no longer readable; they
need to be either re-uploaded under the new scheme or manually
renamed. There is no fallback path; matching the project policy of
"no migrations pre-1.0."
267 lines
6.5 KiB
Go
267 lines
6.5 KiB
Go
package storage
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"github.com/spf13/afero"
|
|
)
|
|
|
|
// FileStorer implements Storer using the local filesystem.
|
|
// It mirrors the S3 path structure for consistency.
|
|
type FileStorer struct {
|
|
fs afero.Fs
|
|
basePath string
|
|
}
|
|
|
|
// NewFileStorer creates a new filesystem storage backend.
|
|
//
|
|
// Construction is intentionally cheap and does not touch the filesystem.
|
|
// The basePath is recorded; the directory is created lazily on first
|
|
// write. Reads (Get/Stat/List) tolerate a missing basePath — a missing
|
|
// or unmounted destination during `snapshot list` should NOT block the
|
|
// command, it should degrade to "no remote snapshots reachable" with a
|
|
// warning. Write operations (Put/PutWithProgress) call MkdirAll for the
|
|
// per-blob parent directory, which also covers basePath on first use.
|
|
//
|
|
// Uses the real OS filesystem by default; call SetFilesystem to
|
|
// override for testing.
|
|
func NewFileStorer(basePath string) (*FileStorer, error) {
|
|
return &FileStorer{
|
|
fs: afero.NewOsFs(),
|
|
basePath: basePath,
|
|
}, nil
|
|
}
|
|
|
|
// SetFilesystem overrides the filesystem for testing.
|
|
func (f *FileStorer) SetFilesystem(fs afero.Fs) {
|
|
f.fs = fs
|
|
}
|
|
|
|
// fullPath returns the full filesystem path for a key.
|
|
func (f *FileStorer) fullPath(key string) string {
|
|
return filepath.Join(f.basePath, key)
|
|
}
|
|
|
|
// Put stores data at the specified key.
|
|
func (f *FileStorer) Put(ctx context.Context, key string, data io.Reader) error {
|
|
path := f.fullPath(key)
|
|
|
|
// Create parent directories
|
|
dir := filepath.Dir(path)
|
|
if err := f.fs.MkdirAll(dir, 0755); err != nil {
|
|
return fmt.Errorf("creating directories: %w", err)
|
|
}
|
|
|
|
file, err := f.fs.Create(path)
|
|
if err != nil {
|
|
return fmt.Errorf("creating file: %w", err)
|
|
}
|
|
defer func() { _ = file.Close() }()
|
|
|
|
if _, err := io.Copy(file, data); err != nil {
|
|
return fmt.Errorf("writing file: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// PutWithProgress stores data with progress reporting.
|
|
func (f *FileStorer) PutWithProgress(ctx context.Context, key string, data io.Reader, size int64, progress ProgressCallback) error {
|
|
path := f.fullPath(key)
|
|
|
|
// Create parent directories
|
|
dir := filepath.Dir(path)
|
|
if err := f.fs.MkdirAll(dir, 0755); err != nil {
|
|
return fmt.Errorf("creating directories: %w", err)
|
|
}
|
|
|
|
file, err := f.fs.Create(path)
|
|
if err != nil {
|
|
return fmt.Errorf("creating file: %w", err)
|
|
}
|
|
defer func() { _ = file.Close() }()
|
|
|
|
// Wrap with progress tracking
|
|
pw := &progressWriter{
|
|
writer: file,
|
|
callback: progress,
|
|
}
|
|
|
|
if _, err := io.Copy(pw, data); err != nil {
|
|
return fmt.Errorf("writing file: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// Get retrieves data from the specified key.
|
|
func (f *FileStorer) Get(ctx context.Context, key string) (io.ReadCloser, error) {
|
|
path := f.fullPath(key)
|
|
file, err := f.fs.Open(path)
|
|
if err != nil {
|
|
if os.IsNotExist(err) {
|
|
return nil, ErrNotFound
|
|
}
|
|
return nil, fmt.Errorf("opening file: %w", err)
|
|
}
|
|
return file, nil
|
|
}
|
|
|
|
// Stat returns metadata about an object without retrieving its contents.
|
|
func (f *FileStorer) Stat(ctx context.Context, key string) (*ObjectInfo, error) {
|
|
path := f.fullPath(key)
|
|
info, err := f.fs.Stat(path)
|
|
if err != nil {
|
|
if os.IsNotExist(err) {
|
|
return nil, ErrNotFound
|
|
}
|
|
return nil, fmt.Errorf("stat file: %w", err)
|
|
}
|
|
return &ObjectInfo{
|
|
Key: key,
|
|
Size: info.Size(),
|
|
}, nil
|
|
}
|
|
|
|
// Delete removes an object.
|
|
func (f *FileStorer) Delete(ctx context.Context, key string) error {
|
|
path := f.fullPath(key)
|
|
err := f.fs.Remove(path)
|
|
if os.IsNotExist(err) {
|
|
return nil // Match S3 behavior: no error if doesn't exist
|
|
}
|
|
if err != nil {
|
|
return fmt.Errorf("removing file: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// List returns all keys with the given prefix.
|
|
func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error) {
|
|
var keys []string
|
|
basePath := f.fullPath(prefix)
|
|
|
|
// Check if base path exists
|
|
exists, err := afero.Exists(f.fs, basePath)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("checking path: %w", err)
|
|
}
|
|
if !exists {
|
|
return keys, nil // Empty list for non-existent prefix
|
|
}
|
|
|
|
err = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// Check context cancellation
|
|
select {
|
|
case <-ctx.Done():
|
|
return ctx.Err()
|
|
default:
|
|
}
|
|
|
|
if !info.IsDir() {
|
|
// Convert back to key (relative path from basePath)
|
|
relPath, err := filepath.Rel(f.basePath, path)
|
|
if err != nil {
|
|
return fmt.Errorf("computing relative path: %w", err)
|
|
}
|
|
// Normalize path separators to forward slashes for consistency
|
|
relPath = strings.ReplaceAll(relPath, string(filepath.Separator), "/")
|
|
keys = append(keys, relPath)
|
|
}
|
|
return nil
|
|
})
|
|
|
|
if err != nil {
|
|
return nil, fmt.Errorf("walking directory: %w", err)
|
|
}
|
|
|
|
return keys, nil
|
|
}
|
|
|
|
// ListStream returns a channel of ObjectInfo for large result sets.
|
|
func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan ObjectInfo {
|
|
ch := make(chan ObjectInfo)
|
|
go func() {
|
|
defer close(ch)
|
|
basePath := f.fullPath(prefix)
|
|
|
|
// Check if base path exists
|
|
exists, err := afero.Exists(f.fs, basePath)
|
|
if err != nil {
|
|
ch <- ObjectInfo{Err: fmt.Errorf("checking path: %w", err)}
|
|
return
|
|
}
|
|
if !exists {
|
|
return // Empty channel for non-existent prefix
|
|
}
|
|
|
|
_ = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
|
|
// Check context cancellation
|
|
select {
|
|
case <-ctx.Done():
|
|
ch <- ObjectInfo{Err: ctx.Err()}
|
|
return ctx.Err()
|
|
default:
|
|
}
|
|
|
|
if err != nil {
|
|
ch <- ObjectInfo{Err: err}
|
|
return nil // Continue walking despite errors
|
|
}
|
|
|
|
if !info.IsDir() {
|
|
relPath, err := filepath.Rel(f.basePath, path)
|
|
if err != nil {
|
|
ch <- ObjectInfo{Err: fmt.Errorf("computing relative path: %w", err)}
|
|
return nil
|
|
}
|
|
// Normalize path separators
|
|
relPath = strings.ReplaceAll(relPath, string(filepath.Separator), "/")
|
|
ch <- ObjectInfo{
|
|
Key: relPath,
|
|
Size: info.Size(),
|
|
}
|
|
}
|
|
return nil
|
|
})
|
|
}()
|
|
return ch
|
|
}
|
|
|
|
// Info returns human-readable storage location information.
|
|
func (f *FileStorer) Info() StorageInfo {
|
|
return StorageInfo{
|
|
Type: "file",
|
|
Location: f.basePath,
|
|
}
|
|
}
|
|
|
|
// progressWriter wraps an io.Writer to track write progress.
|
|
type progressWriter struct {
|
|
writer io.Writer
|
|
written int64
|
|
callback ProgressCallback
|
|
}
|
|
|
|
func (pw *progressWriter) Write(p []byte) (int, error) {
|
|
n, err := pw.writer.Write(p)
|
|
if n > 0 {
|
|
pw.written += int64(n)
|
|
if pw.callback != nil {
|
|
if callbackErr := pw.callback(pw.written); callbackErr != nil {
|
|
return n, callbackErr
|
|
}
|
|
}
|
|
}
|
|
return n, err
|
|
}
|