5 Commits

Author	SHA1	Message	Date
dillard	2a72acb70b	Review fixes: the derived key is wiped also when a key is damaged, each tidy-up step after a removal on its own ... - The key derived from the passphrase is wiped on every path, also when the key or nonce turns out damaged - After a removal the pending flag and the cached index are tidied up independently; a failing log cannot stop the removal event - Tests: a short salt or nonce gives the damaged-key error	2026-11-09 02:33:50 +01:00
dillard	fb8e8d0694	Review fixes: a malformed key reads as damaged, removing a location always reports it, a key from before 1.1.0 in the recovery guide ... - Invalid base64 or a wrong salt/nonce length in a key gives the damaged-key error, so the recovery options are shown - Tidying up after a removed location cannot fail the removal anymore, so the removal event is always sent - Recovery guide: a key made before 1.1.0 counts as used and cannot make way	2026-11-09 00:55:20 +01:00
dillard	042fdae686	Review fixes: the longest deletion delay when the location's settings cannot be read, a damaged passphrase slot does not stop the next one ... - Unreadable settings or an invalid delay on the location: 365 days, so nothing leaves the Bin sooner than on the old server - A passphrase change that still cannot reach a location is logged; removing a location clears its flag - A damaged slot (missing parts, invalid base64) is skipped and the next slot is tried - Tests: damaged settings scenario, damaged slot, upgrade test checks the migration and the time zone	2026-11-08 18:29:31 +01:00
dillard	d3aa07b106	M5: deletion delay with trash, passphrase slots, ransomware documentation ... - removed snapshots go to a trash on the location and their data is only freed after the deletion delay, which is chosen when the key is created (default 7 days, 1-365) and cannot be changed afterwards; any admin can bring them back (occ backup:trash, backup:trash:restore, web UI) - up to three passphrase slots open the same master key (like LUKS), so one person leaving or dying does not lock the company out; slot changes are written to every location, announced to all admins and require a new recovery kit confirmation, while backups keep running - occ backup:key:slots, backup:key:slot:add|replace|remove; key init takes --label and --delete-delay-days - web UI: deletion delay and first slot at key creation, slot management, trash per location with restore; all behind password confirmation - README: key, slots (safe / CTO / head of IT), and protection against ransomware: object lock in compliance mode (e.g. 90 days), credentials without delete rights, provider snapshots, off-site copy	2026-10-02 03:01:44 +02:00
dillard	9bfb6ae334	M1: PHPUnit test suite for crypto, repository and resumable runs ... Dev tooling via composer (phpunit, psalm, nextcloud/ocp); vendor/ is mounted from outside the repository by a helper script. 28 unit tests ported from the phase-0 spikes (round trips, corruption, wrong keys, dedup, incremental runs, partial restore, tampering, object binding, time-boxed steps, file changed between steps).	2026-10-02 00:32:56 +02:00