Restore without the recovery kit: the key from the location, with a passphrase

On a server without a backup key, backup:target:add finds the backups at the location and takes their key from its config with one of the old server's passphrases. Backups then wait until a new recovery kit is confirmed. The deletion delay and the repository id are now stored on the location, sealed with the key, so the delay survives a restore without a kit and --repair-config can write a lost config again from the kit. The key page warns against creating a new key when restoring a server. New test: tests/integration/recovery-scenarios.sh, and a no-kit mode in full-restore-roundtrip.sh.
2026-11-07 12:22:38 +01:00
parent 51a4a67bc4
commit 569077fa69
15 changed files with 687 additions and 43 deletions
@@ -0,0 +1,111 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\NgBackup\Tests\Unit\Repository;
+
+use OCA\NgBackup\Backend\LocalBackend;
+use OCA\NgBackup\Crypto\CryptoException;
+use OCA\NgBackup\Crypto\KeyRing;
+use OCA\NgBackup\Repository\Repository;
+use OCA\NgBackup\Tests\Unit\TempDirTrait;
+use PHPUnit\Framework\TestCase;
+
+/** Disaster recovery without the recovery kit: the location gives its key with a passphrase. */
+class KeyFromLocationTest extends TestCase {
+	use TempDirTrait;
+
+	private string $dir;
+	private LocalBackend $backend;
+	private KeyRing $keys;
+
+	protected function setUp(): void {
+		$this->dir = $this->tempDir();
+		$this->backend = new LocalBackend($this->dir);
+		$this->keys = KeyRing::generate();
+		$slots = ['slots' => [
+			['slot' => 1, 'label' => 'A', 'created' => 0, 'key' => $this->keys->wrap('first passphrase')],
+			['slot' => 2, 'label' => 'B', 'created' => 0, 'key' => $this->keys->wrap('second passphrase')],
+		]];
+		Repository::initWithKey($this->backend, $this->keys, $slots)->recordSettings(['delete_delay_days' => 30]);
+	}
+
+	public function testEachPassphraseGivesTheKeyThatOpensTheBackups(): void {
+		foreach (['first passphrase', 'second passphrase'] as $passphrase) {
+			$keys = KeyRing::unwrapAny(Repository::wrappedKeyAt($this->backend), $passphrase);
+			$this->assertTrue(Repository::madeWithKey($this->backend, $keys));
+			$this->assertSame($this->keys->exportMasterKey(), $keys->exportMasterKey());
+		}
+	}
+
+	public function testAWrongPassphraseGivesNothing(): void {
+		$this->expectException(CryptoException::class);
+		KeyRing::unwrapAny(Repository::wrappedKeyAt($this->backend), 'not the passphrase');
+	}
+
+	public function testAnotherKeyIsNotTakenForTheRightOne(): void {
+		$this->assertFalse(Repository::madeWithKey($this->backend, KeyRing::generate()));
+	}
+
+	public function testTheSettingsAreSealedAndWrittenOnce(): void {
+		$this->assertSame(30, Repository::settingsAt($this->backend, $this->keys)['delete_delay_days']);
+		Repository::openWithKey($this->backend, $this->keys)->recordSettings(['delete_delay_days' => 1]);
+		$this->assertSame(30, Repository::settingsAt($this->backend, $this->keys)['delete_delay_days']);
+		$this->assertSame([], Repository::settingsAt($this->backend, KeyRing::generate()));
+	}
+
+	public function testAlteredSettingsAreNotBelieved(): void {
+		$file = $this->dir . '/settings';
+		$raw = file_get_contents($file);
+		$raw[strlen($raw) - 1] = $raw[strlen($raw) - 1] ^ "\x01";
+		file_put_contents($file, $raw);
+		$this->assertSame([], Repository::settingsAt($this->backend, $this->keys));
+	}
+
+	public function testTheKitWritesALostConfigAgainAndTheBackupsOpen(): void {
+		$src = $this->tempDir();
+		file_put_contents("$src/a", 'still here');
+		$repo = Repository::openWithKey($this->backend, $this->keys);
+		$id = $repo->id();
+		$snapshot = $repo->backupDirectory($src)['snapshot'];
+		unlink($this->dir . '/config');
+		$this->assertTrue(Repository::holdsData($this->backend));
+
+		Repository::repairConfig($this->backend, $this->keys, $this->keys->wrap('kit passphrase'));
+		$repo = Repository::openWithKey($this->backend, $this->keys);
+		$this->assertSame($id, $repo->id());
+		$this->assertSame([$snapshot], $repo->listSnapshots());
+		$out = $this->tempDir();
+		$repo->restore($snapshot, $out);
+		$this->assertSame('still here', file_get_contents("$out/a"));
+		$this->assertSame($this->keys->exportMasterKey(), KeyRing::unwrapAny(Repository::wrappedKeyAt($this->backend), 'kit passphrase')->exportMasterKey());
+	}
+
+	public function testAnotherKeyWritesNoConfig(): void {
+		unlink($this->dir . '/config');
+		$other = KeyRing::generate();
+		try {
+			Repository::repairConfig($this->backend, $other, $other->wrap('x'));
+			$this->fail('a config was written with another key');
+		} catch (\OCA\NgBackup\Repository\RepositoryException $e) {
+			$this->assertStringContainsString('another server', $e->getMessage());
+		}
+		$this->assertFileDoesNotExist($this->dir . '/config');
+	}
+
+	public function testAConfigThatIsThereIsNeverRepaired(): void {
+		$before = file_get_contents($this->dir . '/config');
+		try {
+			Repository::repairConfig($this->backend, $this->keys, $this->keys->wrap('x'));
+			$this->fail('an existing config was replaced');
+		} catch (\OCA\NgBackup\Repository\RepositoryException) {
+		}
+		$this->assertSame($before, file_get_contents($this->dir . '/config'));
+	}
+
+	public function testALocationWithoutSettingsHasNone(): void {
+		$other = new LocalBackend($this->tempDir());
+		Repository::initWithKey($other, $this->keys, $this->keys->wrap('x'));
+		$this->assertSame([], Repository::settingsAt($other, $this->keys));
+	}
+}