M5: notifications, setup check, audit log and password confirmation

- notifications to administrators for failed backup/restore runs and locations without a successful backup for two days (once a day) - setup check in the admin overview: error when the key/kit is not set up, warning for missing, old or failed backups - security events (recovery kit downloaded, location removed, append-only turned off, retention changed, snapshots forgotten) go to the audit log and are announced to all administrators, from the web and from occ; the scheduled weekly cleanup is logged only - fix: the recovery-kit download link failed the CSRF check (412); it now requires a recent password confirmation instead, like creating the key, removing a location and restoring
2026-10-02 02:29:46 +02:00
parent 7b3c9cabf6
commit 7b154e322b
18 changed files with 318 additions and 8 deletions
@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Notification;
+
+use OCA\NgBackup\AppInfo\Application;
+use OCP\IURLGenerator;
+use OCP\L10N\IFactory;
+use OCP\Notification\INotification;
+use OCP\Notification\INotifier;
+use OCP\Notification\UnknownNotificationException;
+
+class Notifier implements INotifier {
+	public function __construct(
+		private IFactory $l10n,
+		private IURLGenerator $url,
+	) {
+	}
+
+	public function getID(): string {
+		return Application::APP_ID;
+	}
+
+	public function getName(): string {
+		return $this->l10n->get(Application::APP_ID)->t('NG Backup');
+	}
+
+	public function prepare(INotification $notification, string $languageCode): INotification {
+		if ($notification->getApp() !== Application::APP_ID) {
+			throw new UnknownNotificationException();
+		}
+		$l = $this->l10n->get(Application::APP_ID, $languageCode);
+		$p = $notification->getSubjectParameters();
+		switch ($notification->getSubject()) {
+			case 'run_failed':
+				$notification->setParsedSubject($p['kind'] === 'restore'
+					? $l->t('Restore from %s failed', [$p['target']])
+					: $l->t('Backup to %s failed', [$p['target']]));
+				$notification->setParsedMessage((string)($p['error'] ?? ''));
+				break;
+			case 'backup_stale':
+				$notification->setParsedSubject($l->t('No successful backup to %1$s since %2$s', [$p['target'], $p['since']]));
+				$notification->setParsedMessage($l->t('Check the backup settings and the server log.'));
+				break;
+			case 'security_event':
+				$who = (string)($p['actor'] ?? '');
+				$notification->setParsedSubject(match ($p['event'] ?? '') {
+					'kit_downloaded' => $l->t('%s downloaded the backup recovery kit', [$who]),
+					'target_removed' => $l->t('%1$s removed backup location %2$s', [$who, $p['target'] ?? '']),
+					'append_only_off' => $l->t('%1$s turned off append-only for backup location %2$s', [$who, $p['target'] ?? '']),
+					'retention_changed' => $l->t('%1$s changed the backup retention to %2$s', [$who, $p['policy'] ?? '']),
+					'snapshots_forgotten' => $l->t('%1$s removed %2$s snapshots from %3$s', [$who, $p['count'] ?? '', $p['target'] ?? '']),
+					default => $l->t('NG Backup security event'),
+				});
+				$notification->setParsedMessage($l->t('If this was not you or another administrator, check who has admin access.'));
+				break;
+			default:
+				throw new UnknownNotificationException();
+		}
+		$notification->setLink($this->url->linkToRouteAbsolute('settings.AdminSettings.index', ['section' => 'ng_backup']));
+		$notification->setIcon($this->url->getAbsoluteURL($this->url->imagePath(Application::APP_ID, 'app-dark.svg')));
+		return $notification;
+	}
+}