Review fixes: a missed passphrase change follows at the next backup, a key from before 1.1.0 counts as used, schedules edited in their own time zone

- A location that a passphrase change could not reach gets it at its next backup
- A key from before 1.1.0 is never replaced as an unused one
- An unreadable settings file on a location is told apart from a missing one
- A schedule is shown and saved in the zone it was saved in
- Saving an unchanged schedule keeps its moment; --timezone needs a schedule
- Schedule coverage uses the time the backup began reading its data
- Tests: catch-up scenario, upgrade test restores the new file, autumn clock change

lib/Service/BackupService.php

@@ -227,6 +227,7 @@ final class BackupService {
 					$state['files']['started'] = gmdate('c');
 					// Locations from before 1.1.0 get their sealed settings at their next backup.
 					$this->targets->recordSettings($repo);
+					$this->targets->catchUpWrappedKey($target, $repo);
 				}
 				$dumper = new DbDumper($this->db->getInner(), $this->config->getSystemValueString('dbtableprefix', 'oc_'));
 				$dbStats = $state['dbStats'] ?? [];

lib/Service/KeyService.php

@@ -32,6 +32,7 @@ final class KeyService {
 	private const KEY_KIT_CODE = 'recovery_kit_code';
 	/** Set once a location was created or adopted with this key: from then on it is never replaced. */
 	private const KEY_USED = 'master_key_used';
+	private const KEY_WRAPPED_PENDING = 'master_key_wrapped_pending';
 	public const DEFAULT_DELETE_DELAY = 7;
 	/**
 	 * The location holds the passphrase-wrapped key too, so whoever can read it can try
@@ -127,6 +128,24 @@ final class KeyService {
 		}
 	}
 
+	/**
+	 * Locations that missed the last passphrase change (offline at the time): they still hold
+	 * the previous slots until the change reaches them, which is tried again at each backup.
+	 */
+	public function wrappedKeyPending(int $targetId): bool {
+		return $this->appConfig->getValueBool(Application::APP_ID, self::KEY_WRAPPED_PENDING . '_' . $targetId);
+	}
+
+	/** One flag per location, so that two processes never overwrite each other's. */
+	public function setWrappedKeyPending(int $targetId, bool $pending): void {
+		$key = self::KEY_WRAPPED_PENDING . '_' . $targetId;
+		if ($pending) {
+			$this->appConfig->setValueBool(Application::APP_ID, $key, true);
+		} elseif ($this->wrappedKeyPending($targetId)) {
+			$this->appConfig->deleteKey(Application::APP_ID, $key);
+		}
+	}
+
 	/**
 	 * A key made by mistake on a server that is being restored: remove it, so the key of the
 	 * backups can take its place. Only after the new key was opened with its passphrase, and

lib/Service/KeySlotService.php

@@ -43,8 +43,10 @@ final class KeySlotService {
 		foreach ($this->targets->list() as $t) {
 			try {
 				$this->targets->repository($t)->updateWrappedKey($wrapped);
+				$this->keys->setWrappedKeyPending($t->getId(), false);
 			} catch (\Throwable $e) {
 				$failed[] = $t->getName();
+				$this->keys->setWrappedKeyPending($t->getId(), true);
 			}
 		}
 		$label = '';
@@ -55,7 +57,7 @@ final class KeySlotService {
 		}
 		$this->alerts->securityEvent($event, ['slot' => (string)$slot, 'label' => $label]);
 		if ($failed !== []) {
-			throw new \RuntimeException('Saved, but these locations could not be updated (they still accept the previous passphrases): ' . implode(', ', $failed));
+			throw new \RuntimeException('Saved, but these locations could not be updated (they still accept the previous passphrases; the change is tried again at their next backup): ' . implode(', ', $failed));
 		}
 	}
 }

lib/Service/TargetService.php

@@ -172,7 +172,7 @@ final class TargetService {
 	 *
 	 * @param array<string, mixed> $options
 	 * @param ?callable(int, int): void $progress
-	 * @return array{target: Target, created: bool, deleteDelayDays: ?int} the deletion delay the location had stored, if any
+	 * @return array{target: Target, created: bool, deleteDelayDays: ?int, settingsUnreadable: bool} the deletion delay the location had stored, if any, and whether its settings could not be read
 	 * @throws \OCA\NgBackup\Crypto\CryptoException wrong passphrase
 	 */
 	public function addWithPassphrase(string $name, string $backend, string $auth, array $options, string $basePath,
@@ -194,13 +194,26 @@ final class TargetService {
 		if (!Repository::madeWithKey($storageBackend, $keys)) {
 			throw new \RuntimeException('The key in the config at this location does not open its backups: the config is damaged or was replaced. Only the recovery kit can help now: occ backup:key:import <kit file>, then this command again.');
 		}
-		$delay = Repository::settingsAt($storageBackend, $keys)['delete_delay_days'] ?? null;
+		$settings = Repository::settingsAt($storageBackend, $keys);
+		$delay = $settings['delete_delay_days'] ?? null;
 		$delay = is_int($delay) ? $delay : null;
 		$this->keys->adoptKey($keys, $wrapped, $delay, $replaceUnusedKey);
 		if ($old !== null) {
 			$this->alerts->securityEvent('key_replaced', ['old' => $old, 'new' => $this->keys->fingerprint()]);
 		}
-		return $this->add($name, $backend, $auth, $options, $basePath, $progress) + ['deleteDelayDays' => $delay];
+		return $this->add($name, $backend, $auth, $options, $basePath, $progress) + ['deleteDelayDays' => $delay, 'settingsUnreadable' => ($settings['unreadable'] ?? false) === true];
+	}
+
+	/** A passphrase change that missed this location (offline at the time) reaches it now. A failure is tried again at the next backup. */
+	public function catchUpWrappedKey(Target $target, Repository $repo): void {
+		if (!$this->keys->wrappedKeyPending($target->getId())) {
+			return;
+		}
+		try {
+			$repo->updateWrappedKey($this->keys->wrappedKey());
+			$this->keys->setWrappedKeyPending($target->getId(), false);
+		} catch (\Throwable) {
+		}
 	}
 
 	/** Seal the settings fixed at installation on the location, once. A failure is tried again at the next backup. */
@@ -402,6 +415,10 @@ final class TargetService {
 		}
 		$new = LocationSchedule::normalize($schedule);
 		$turnedOff = $new === '' && (string)$target->getSchedule() !== '';
+		if ($new === (string)$target->getSchedule() && $zone === $target->getScheduleZone()) {
+			// Saved again unchanged: a moment that already passed still gets its backup
+			return $target;
+		}
 		$target->setSchedule($new);
 		$target->setScheduleZone($zone);
 		$target->setScheduleSince(time());