Roadmap 1.2.0: restore only the database from a restore point, with occ

Release 1.1.0

CHANGELOG.md

@@ -11,7 +11,7 @@ Each heading starts with that `<version>`, once: the app store shows a release t
 whose heading starts with its `x.y.z` and ignores anything after it, so `## [1.0.0-rc.6]` would be
 shown under 1.0.0. The git tag of a release candidate goes after the date.
 
-## [1.1.0] - Unreleased
+## [1.1.0] - 2026-11-09
 
 ### Added
 - Pin a restore point, on the restore page or with `occ backup:pin`: the retention policy leaves it
@@ -21,7 +21,8 @@ shown under 1.0.0. The git tag of a release candidate goes after the date.
   An older version of NG Backup can still read the location, but drops them when it writes to it.
 - A schedule per location: off, once a day, or every N hours from a given time, on the page under
   Backups or with `occ backup:target:schedule`. After the update every location keeps the time that
-  held for all of them; a new location starts with the schedule of the first one.
+  held for all of them; a new location starts with the schedule of the first one. A schedule is
+  shown and changed in the time zone it was saved in, which the page names next to the time.
 - All folders get their original modification time back on a restore, not only the empty ones, from
   the first backup made with this version. An older version of NG Backup can still read new restore
   points. A restore through Nextcloud into a folder that is already there leaves its time alone.
@@ -34,6 +35,10 @@ shown under 1.0.0. The git tag of a release candidate goes after the date.
   of the old server's passphrases. Backups then wait until a new recovery kit is confirmed. The
   deletion delay is now also stored on the location, sealed with the key, from its first backup
   with this version; a location backed up only by an older version gives the default of 7 days.
+  When the settings on the location cannot be read, the longest delay (365 days) is taken, so
+  nothing leaves the Bin sooner than on the old server; the command says so.
+- A passphrase change that cannot reach a location (offline at the time) now reaches it at the
+  location's next backup, so a new server can open it with the new passphrase.
 - `occ backup:target:add --repair-config`: when the config file of a location is gone, the recovery
   kit writes it again (for locations backed up by this version or newer). Before, the message said
   this was possible, but it was not.
@@ -41,7 +46,8 @@ shown under 1.0.0. The git tag of a release candidate goes after the date.
   by mistake can still make way for the key of the backups, as long as it was never used (no
   location, no backup): `occ backup:key:import --replace-unused-key` with the kit, or
   `occ backup:target:add --replace-unused-key` with a passphrase of the old server. A key that
-  protected a location is never replaced. All administrators are notified of a replacement.
+  protected a location is never replaced, and neither is a key from before this version. All
+  administrators are notified of a replacement.
 
 ### Changed
 - The list of backups stays within the page: a long label, note or error wraps onto more lines

PLAN.md

@@ -638,6 +638,17 @@ in README "Known limitations":
      to hear how NG Backup works for you ... Share your experience" in de beheerpagina blijft tot
      dan staan. Er komt weinig feedback bij zo'n 150 downloads per versie; geen bericht is goed
      bericht. Het formulier (`experience.yml`) in de issues blijft.
+  10. **Alleen de database terughalen, CLI-only** (besluit 2026-11-10). Aanleiding: op nc01 liep
+     de automatische AIO-update 34 → 35 vast op een migratie van de (uitgeschakelde) app
+     files_archive; AIO had alle apps uitgezet en hun status alleen in het geheugen bewaard, dus
+     wat aan stond (en voor welke groepen) was weg. Uit de database in het restorepunt van 02:45
+     is `oc_appconfig` (rijen `enabled`) met een eenmalig script gelezen. Te bouwen:
+     `occ backup:restore:db <locatie> <snapshot>` met `--tables=` (één of meer tabellen) en
+     `--to-directory=DIR` (per tabel een leesbaar bestand, zonder iets aan de database te doen),
+     of zonder `--to-directory` de gekozen tabellen terugzetten in de draaiende instantie, in
+     onderhoudsmodus, met dezelfde controles als `restore:full` (schema, eigen ngb-rijen blijven).
+     Eventueel `--where` voor alleen sommige rijen (zoals `configkey = 'enabled'`). Geen web-UI:
+     daar kan een beheerder weinig mee.
 - **Bevindingen DR-test op PVE02 (2026-10-17, snapshot van nc01, 1 TB, AIO → gewone NC 34 met
   PostgreSQL 18)** — voor **1.0.0-rc.2**:
   1. Tabellen van apps die bij de backup **niet aanstonden** (restanten: Deck, ONLYOFFICE,

README.md

@@ -271,6 +271,9 @@ a 👍 on its issue helps decide what comes first.
 **1.2.0**
 - Faster backups over a long line: several uploads at the same time, with a setting
   (2 by default) to suit the server and the size of the backup.
+- Only the database from a restore point, with `occ` (no web interface): export one or more
+  tables to a local directory to look something up, or put chosen tables back into the running
+  instance in maintenance mode. For example the app settings after an update that went wrong.
 
 **Later**
 - A full restore onto the existing installation, without first installing a fresh Nextcloud, in a

docs/DISASTER-RECOVERY.md

@@ -91,7 +91,9 @@ As long as that key was never used (no location added with it, no backup), it ca
 key of your backups. NG Backup says so when it refuses the location. Add `--replace-unused-key` to
 `occ backup:key:import` (with the kit) or to `occ backup:target:add` (without the kit; it asks for
 a passphrase of the old server). The passphrases and kit of the unused key then stop working. A key
-that was used for a location is never replaced: its own backups depend on it.
+that was used for a location is never replaced: its own backups depend on it. A key made with a
+version before 1.1.0 always counts as used (those versions did not keep track), also when it never
+protected a location; recover onto a fresh Nextcloud installation instead.
 
 **6. List the restore points** and pick one, normally the newest:
 

lib/BackgroundJob/BackupJob.php

@@ -116,7 +116,7 @@ final class BackupJob extends TimedJob {
 			}
 			$attempts = $this->runs->startedSince($t->getId(), BackupService::KIND_FULL, $moment);
 			if (!\OCA\NgBackup\Service\LocationSchedule::isDue($moment, (int)$t->getScheduleSince(),
-				$this->runs->lastFinished($t->getId(), BackupService::KIND_FULL)?->getStartedAt(),
+				$this->dataStarted($this->runs->lastFinished($t->getId(), BackupService::KIND_FULL)),
 				count($attempts), ($attempts[0] ?? null)?->getFinishedAt(), $now)) {
 				continue;
 			}
@@ -127,4 +127,15 @@ final class BackupJob extends TimedJob {
 			}
 		}
 	}
+
+	/** When a backup began reading its data: a queued one can start well after it was asked for. */
+	private function dataStarted(?\OCA\NgBackup\Db\Run $run): ?int {
+		if ($run === null) {
+			return null;
+		}
+		$state = json_decode($run->getState(), true);
+		$started = is_array($state) ? ($state['files']['started'] ?? null) : null;
+		$at = is_string($started) ? strtotime($started) : false;
+		return $at !== false ? $at : $run->getStartedAt();
+	}
 }

lib/Command/TargetAdd.php

@@ -161,9 +161,12 @@ HELP);
 			$r['target']->getRepositoryId(), $r['created'] ? 'created' : 'found and adopted'));
 		if ($passphrase !== null) {
 			$output->writeln(($replace ? 'The unused key was replaced. ' : '') . 'Backup key taken from the location, fingerprint <info>' . $this->keys->fingerprint() . '</info>.');
-			$output->writeln(array_key_exists('deleteDelayDays', $r) && $r['deleteDelayDays'] !== null
-				? 'Deletion delay for forgotten snapshots: <info>' . $this->keys->deleteDelayDays() . '</info> days (from the location).'
-				: 'Deletion delay for forgotten snapshots: <info>' . $this->keys->deleteDelayDays() . '</info> days (the default: the location has none stored, its backups were made before NG Backup 1.1.0).');
+			$days = 'Deletion delay for forgotten snapshots: <info>' . $this->keys->deleteDelayDays() . '</info> days';
+			$output->writeln(match (true) {
+				($r['deleteDelayDays'] ?? null) !== null => $days . ' (from the location).',
+				$r['settingsUnreadable'] ?? false => '<comment>' . $days . ' (the longest: the settings on the location could not be read or hold no valid delay, so nothing leaves the Bin sooner than on the old server; removed restore points take space for that long).</comment>',
+				default => $days . ' (the default: the location has none stored, its backups were made before NG Backup 1.1.0).',
+			});
 			$output->writeln('Next: <info>occ backup:list</info> and <info>occ backup:restore:full</info>. Before backups run again, download a new recovery kit and confirm it (<info>occ backup:key:kit</info>, <info>occ backup:key:confirm</info>).');
 		}
 		return 0;

lib/Command/TargetSchedule.php

@@ -34,6 +34,10 @@ final class TargetSchedule extends Command {
 	protected function execute(InputInterface $input, OutputInterface $output): int {
 		$t = $this->targets->get($input->getArgument('target'));
 		$schedule = $input->getArgument('schedule');
+		if ($schedule === null && $input->getOption('timezone') !== null) {
+			$output->writeln('<error>--timezone goes with a schedule, e.g. backup:target:schedule ' . $t->getName() . ' 02:30 --timezone=Europe/Amsterdam</error>');
+			return 1;
+		}
 		$zone = $input->getOption('timezone') ?? $this->schedule->zoneOr($t->getScheduleZone());
 		if ($schedule !== null) {
 			try {

lib/Crypto/KeyRing.php

@@ -87,14 +87,20 @@ final class KeyRing {
 		foreach ($field['slots'] as $slot) {
 			try {
 				return self::unwrap($slot['key'], $passphrase);
-			} catch (CryptoException) {
+			} catch (CryptoException|\SodiumException|\TypeError|\ValueError) {
+				// a wrong passphrase for this slot, or a damaged slot: the next one may still open
 			}
 		}
 		throw new CryptoException('Wrong passphrase or damaged key');
 	}
 
-	/** @param array{v:int, salt:string, ops:int, mem:int, nonce:string, key:string} $wrapped */
+	/** @param array<string, mixed> $wrapped from a kit file or a location's config: checked here, not trusted */
 	public static function unwrap(array $wrapped, #[\SensitiveParameter] string $passphrase): self {
+		if (!isset($wrapped['salt'], $wrapped['nonce'], $wrapped['key'], $wrapped['ops'], $wrapped['mem'])
+			|| !is_string($wrapped['salt']) || !is_string($wrapped['nonce']) || !is_string($wrapped['key'])
+			|| !is_int($wrapped['ops']) || !is_int($wrapped['mem'])) {
+			throw new CryptoException('Damaged key file: a part of the key is missing');
+		}
 		$b64 = static fn (string $s): string => sodium_base642bin($s, SODIUM_BASE64_VARIANT_ORIGINAL);
 		// ops/mem come from unauthenticated JSON (kit file, repository config): bound them, so a
 		// damaged or crafted file cannot make the KDF use unbounded memory or time.
@@ -102,10 +108,22 @@ final class KeyRing {
 			|| $wrapped['mem'] < SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE || $wrapped['mem'] > SODIUM_CRYPTO_PWHASH_MEMLIMIT_SENSITIVE) {
 			throw new CryptoException('Unsupported key derivation parameters (damaged or foreign key file)');
 		}
-		$kek = sodium_crypto_pwhash(SODIUM_CRYPTO_SECRETBOX_KEYBYTES, $passphrase, $b64($wrapped['salt']),
-			$wrapped['ops'], $wrapped['mem'], SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13);
-		$master = sodium_crypto_secretbox_open($b64($wrapped['key']), $b64($wrapped['nonce']), $kek);
-		sodium_memzero($kek);
+		$kek = null;
+		try {
+			$salt = $b64($wrapped['salt']);
+			$sealed = $b64($wrapped['key']);
+			$nonce = $b64($wrapped['nonce']);
+			$kek = sodium_crypto_pwhash(SODIUM_CRYPTO_SECRETBOX_KEYBYTES, $passphrase, $salt,
+				$wrapped['ops'], $wrapped['mem'], SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13);
+			$master = sodium_crypto_secretbox_open($sealed, $nonce, $kek);
+		} catch (\SodiumException|\ValueError $e) {
+			// invalid base64 or a salt/nonce of the wrong length: damaged, so the caller shows its recovery options
+			throw new CryptoException('Damaged key file: ' . $e->getMessage(), 0, $e);
+		} finally {
+			if ($kek !== null) {
+				sodium_memzero($kek);
+			}
+		}
 		if ($master === false) {
 			throw new CryptoException('Wrong passphrase or damaged key');
 		}

lib/Migration/Version000009Date20261108000000.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Migration;
+
+use Closure;
+use OCA\NgBackup\Service\KeyService;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+/**
+ * A key from before 1.1.0 counts as used: those versions did not keep track, and it may protect
+ * backups on a location that was removed from this server later (user exports included). Only a
+ * key made with 1.1.0 or newer can be replaced as an unused one.
+ */
+final class Version000009Date20261108000000 extends SimpleMigrationStep {
+	public function __construct(
+		private KeyService $keys,
+	) {
+	}
+
+	public function postSchemaChange(IOutput $output, Closure $schemaClosure, array $options): void {
+		if ($this->keys->isInitialized()) {
+			$this->keys->markUsed();
+		}
+	}
+}

lib/Repository/Repository.php

@@ -239,8 +239,8 @@ final class Repository {
 	/**
 	 * Settings of the installation that never change (the deletion delay), sealed with the
 	 * master key so that, unlike the config and the recovery kit, nobody can alter them unseen.
-	 * Empty when the location has none yet (made before 1.1.0, until its next backup) or they
-	 * cannot be read.
+	 * Empty when the location has none yet (made before 1.1.0, until its next backup); only
+	 * ['unreadable' => true] when they are there but cannot be read.
 	 *
 	 * @return array<string, mixed>
 	 */
@@ -253,9 +253,9 @@ final class Repository {
 			$raw = (string)stream_get_contents($fh);
 			fclose($fh);
 			$settings = json_decode((new StreamCipher($keys))->decryptString($raw, 'settings'), true, 16, JSON_THROW_ON_ERROR);
-			return is_array($settings) ? $settings : [];
+			return is_array($settings) ? $settings : ['unreadable' => true];
 		} catch (BackendException|\OCA\NgBackup\Crypto\CryptoException|\JsonException) {
-			return [];
+			return ['unreadable' => true];
 		}
 	}
 

lib/Service/BackupService.php

@@ -227,6 +227,7 @@ final class BackupService {
 					$state['files']['started'] = gmdate('c');
 					// Locations from before 1.1.0 get their sealed settings at their next backup.
 					$this->targets->recordSettings($repo);
+					$this->targets->catchUpWrappedKey($target, $repo);
 				}
 				$dumper = new DbDumper($this->db->getInner(), $this->config->getSystemValueString('dbtableprefix', 'oc_'));
 				$dbStats = $state['dbStats'] ?? [];

lib/Service/KeyService.php

@@ -32,6 +32,7 @@ final class KeyService {
 	private const KEY_KIT_CODE = 'recovery_kit_code';
 	/** Set once a location was created or adopted with this key: from then on it is never replaced. */
 	private const KEY_USED = 'master_key_used';
+	private const KEY_WRAPPED_PENDING = 'master_key_wrapped_pending';
 	public const DEFAULT_DELETE_DELAY = 7;
 	/**
 	 * The location holds the passphrase-wrapped key too, so whoever can read it can try
@@ -127,6 +128,24 @@ final class KeyService {
 		}
 	}
 
+	/**
+	 * Locations that missed the last passphrase change (offline at the time): they still hold
+	 * the previous slots until the change reaches them, which is tried again at each backup.
+	 */
+	public function wrappedKeyPending(int $targetId): bool {
+		return $this->appConfig->getValueBool(Application::APP_ID, self::KEY_WRAPPED_PENDING . '_' . $targetId);
+	}
+
+	/** One flag per location, so that two processes never overwrite each other's. */
+	public function setWrappedKeyPending(int $targetId, bool $pending): void {
+		$key = self::KEY_WRAPPED_PENDING . '_' . $targetId;
+		if ($pending) {
+			$this->appConfig->setValueBool(Application::APP_ID, $key, true);
+		} elseif ($this->wrappedKeyPending($targetId)) {
+			$this->appConfig->deleteKey(Application::APP_ID, $key);
+		}
+	}
+
 	/**
 	 * A key made by mistake on a server that is being restored: remove it, so the key of the
 	 * backups can take its place. Only after the new key was opened with its passphrase, and

lib/Service/KeySlotService.php

@@ -43,8 +43,10 @@ final class KeySlotService {
 		foreach ($this->targets->list() as $t) {
 			try {
 				$this->targets->repository($t)->updateWrappedKey($wrapped);
+				$this->keys->setWrappedKeyPending($t->getId(), false);
 			} catch (\Throwable $e) {
 				$failed[] = $t->getName();
+				$this->keys->setWrappedKeyPending($t->getId(), true);
 			}
 		}
 		$label = '';
@@ -55,7 +57,7 @@ final class KeySlotService {
 		}
 		$this->alerts->securityEvent($event, ['slot' => (string)$slot, 'label' => $label]);
 		if ($failed !== []) {
-			throw new \RuntimeException('Saved, but these locations could not be updated (they still accept the previous passphrases): ' . implode(', ', $failed));
+			throw new \RuntimeException('Saved, but these locations could not be updated (they still accept the previous passphrases; the change is tried again at their next backup): ' . implode(', ', $failed));
 		}
 	}
 }

lib/Service/TargetService.php

@@ -27,6 +27,9 @@ use OCP\Server;
  * classes but its enabled/disabled state is left as the admin set it.
  */
 final class TargetService {
+	/** Deletion delay taken when a location's own cannot be read: nothing leaves the Bin sooner than on the old server. */
+	public const LONGEST_DELETE_DELAY = 365;
+
 	public function __construct(
 		private TargetMapper $mapper,
 		private KeyService $keys,
@@ -172,7 +175,7 @@ final class TargetService {
 	 *
 	 * @param array<string, mixed> $options
 	 * @param ?callable(int, int): void $progress
-	 * @return array{target: Target, created: bool, deleteDelayDays: ?int} the deletion delay the location had stored, if any
+	 * @return array{target: Target, created: bool, deleteDelayDays: ?int, settingsUnreadable: bool} the deletion delay the location had stored, if any, and whether its settings could not be read
 	 * @throws \OCA\NgBackup\Crypto\CryptoException wrong passphrase
 	 */
 	public function addWithPassphrase(string $name, string $backend, string $auth, array $options, string $basePath,
@@ -194,13 +197,31 @@ final class TargetService {
 		if (!Repository::madeWithKey($storageBackend, $keys)) {
 			throw new \RuntimeException('The key in the config at this location does not open its backups: the config is damaged or was replaced. Only the recovery kit can help now: occ backup:key:import <kit file>, then this command again.');
 		}
-		$delay = Repository::settingsAt($storageBackend, $keys)['delete_delay_days'] ?? null;
-		$delay = is_int($delay) ? $delay : null;
-		$this->keys->adoptKey($keys, $wrapped, $delay, $replaceUnusedKey);
+		$settings = Repository::settingsAt($storageBackend, $keys);
+		$stored = $settings['delete_delay_days'] ?? null;
+		$delay = is_int($stored) && $stored >= 1 && $stored <= 365 ? $stored : null;
+		// Settings that are there but cannot be read, or hold no valid delay (also none at all): the old server's delay
+		// is unknown, so take the longest one; a shorter guess could empty the Bin too soon.
+		$unknown = ($settings['unreadable'] ?? false) === true || ($settings !== [] && $delay === null);
+		$this->keys->adoptKey($keys, $wrapped, $delay ?? ($unknown ? self::LONGEST_DELETE_DELAY : null), $replaceUnusedKey);
 		if ($old !== null) {
 			$this->alerts->securityEvent('key_replaced', ['old' => $old, 'new' => $this->keys->fingerprint()]);
 		}
-		return $this->add($name, $backend, $auth, $options, $basePath, $progress) + ['deleteDelayDays' => $delay];
+		return $this->add($name, $backend, $auth, $options, $basePath, $progress) + ['deleteDelayDays' => $delay, 'settingsUnreadable' => $unknown];
+	}
+
+	/** A passphrase change that missed this location (offline at the time) reaches it now. A failure is tried again at the next backup. */
+	public function catchUpWrappedKey(Target $target, Repository $repo): void {
+		if (!$this->keys->wrappedKeyPending($target->getId())) {
+			return;
+		}
+		try {
+			$repo->updateWrappedKey($this->keys->wrappedKey());
+			$this->keys->setWrappedKeyPending($target->getId(), false);
+		} catch (\Throwable $e) {
+			Server::get(\Psr\Log\LoggerInterface::class)->warning('NG Backup: the last passphrase change still does not reach ' . $target->getName()
+				. ' (it keeps the previous passphrases); tried again at its next backup: ' . $e->getMessage(), ['exception' => $e]);
+		}
 	}
 
 	/** Seal the settings fixed at installation on the location, once. A failure is tried again at the next backup. */
@@ -402,6 +423,10 @@ final class TargetService {
 		}
 		$new = LocationSchedule::normalize($schedule);
 		$turnedOff = $new === '' && (string)$target->getSchedule() !== '';
+		if ($new === (string)$target->getSchedule() && $zone === $target->getScheduleZone()) {
+			// Saved again unchanged: a moment that already passed still gets its backup
+			return $target;
+		}
 		$target->setSchedule($new);
 		$target->setScheduleZone($zone);
 		$target->setScheduleSince(time());
@@ -425,10 +450,29 @@ final class TargetService {
 	/** Remove the target from NG Backup. The backups on the target itself are not touched. */
 	public function remove(Target $target): void {
 		$this->mapper->delete($target);
+		// The location is gone now: tidying up must not fail the removal, or the caller would skip
+		// the removal event and a retry would no longer find the location
+		$this->tidyUp($target, fn () => $this->keys->setWrappedKeyPending($target->getId(), false));
 		// The cached index of its repository is only of use while a location points at it
-		$repositoryId = $target->getRepositoryId();
-		if ($repositoryId !== null && !array_filter($this->list(), fn (Target $t) => $t->getRepositoryId() === $repositoryId)) {
-			$this->indexCache->forget($repositoryId);
+		$this->tidyUp($target, function () use ($target): void {
+			$repositoryId = $target->getRepositoryId();
+			if ($repositoryId !== null && !array_filter($this->list(), fn (Target $t) => $t->getRepositoryId() === $repositoryId)) {
+				$this->indexCache->forget($repositoryId);
+			}
+		});
+	}
+
+	/** One tidy-up step after a removal: a failure is logged (if even that works) and never thrown. */
+	private function tidyUp(Target $target, callable $step): void {
+		try {
+			$step();
+		} catch (\Throwable $e) {
+			try {
+				Server::get(\Psr\Log\LoggerInterface::class)->warning('NG Backup: location ' . $target->getName()
+					. ' removed, tidying up after it failed: ' . $e->getMessage(), ['exception' => $e]);
+			} catch (\Throwable) {
+				// nothing left to tell it to
+			}
 		}
 	}
 

src/components/LocationScheduleRow.vue

@@ -6,7 +6,7 @@
 	<div class="ngb-row">
 		<strong class="ngb-name">{{ target.name }}</strong>
 		<NcSelect v-model="kind" :options="kinds" label="label" :input-label="t('ng_backup', 'Schedule')" :clearable="false" />
-		<NcTextField v-if="kind.id !== 'off'" v-model="time" class="ngb-time" :label="kind.id === 'daily' ? t('ng_backup', 'At (HH:MM, {zone})', { zone: browserZone }) : t('ng_backup', 'From (HH:MM, {zone})', { zone: browserZone })" />
+		<NcTextField v-if="kind.id !== 'off'" v-model="time" class="ngb-time" :label="kind.id === 'daily' ? t('ng_backup', 'At (HH:MM, {zone})', { zone }) : t('ng_backup', 'From (HH:MM, {zone})', { zone })" />
 		<NcTextField v-if="kind.id === 'hours'" v-model="hours" class="ngb-hours" type="number" min="1" max="23" :label="t('ng_backup', 'Every … hours')" />
 		<NcButton :disabled="busy || wanted === current" @click="save">{{ t('ng_backup', 'Save') }}</NcButton>
 	</div>
@@ -19,7 +19,6 @@ import NcButton from '@nextcloud/vue/components/NcButton'
 import NcSelect from '@nextcloud/vue/components/NcSelect'
 import NcTextField from '@nextcloud/vue/components/NcTextField'
 import api from '../api.js'
-import { toZone } from '../format.js'
 
 const props = defineProps({ target: { type: Object, required: true } })
 const emit = defineEmits(['changed', 'error'])
@@ -29,9 +28,11 @@ const kinds = [
 	{ id: 'daily', label: t('ng_backup', 'Once a day') },
 	{ id: 'hours', label: t('ng_backup', 'Every few hours') },
 ]
-// The time is saved in the administrator's own zone (the browser's); a schedule saved in another
-// zone is shown in this one, so it reads as the moment it runs here.
+// A schedule is shown and edited in the zone it was saved in, named next to the time: "every 6
+// hours from 02:00" runs until midnight of that zone, so moving it to another zone would change
+// how often it runs. A location without a schedule gets the administrator's own zone (the browser's).
 const browserZone = Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC'
+const zone = computed(() => props.target.schedule !== '' && props.target.scheduleZone ? props.target.scheduleZone : browserZone)
 const kind = ref(kinds[0])
 const time = ref('02:00')
 const hours = ref('6')
@@ -39,7 +40,7 @@ const busy = ref(false)
 
 const current = computed(() => {
 	const [at, every] = props.target.schedule.split('/')
-	return at === '' ? '' : (props.target.scheduleZone !== browserZone ? toZone(at, props.target.scheduleZone, browserZone) : at) + (every ? '/' + every : '')
+	return at === '' ? '' : at + (every ? '/' + every : '')
 })
 const wanted = computed(() => {
 	if (kind.value.id === 'off') {
@@ -59,7 +60,7 @@ async function save() {
 	busy.value = true
 	emit('error', '')
 	try {
-		await api.setTargetSchedule(props.target.id, wanted.value, browserZone)
+		await api.setTargetSchedule(props.target.id, wanted.value, zone.value)
 		emit('changed')
 	} catch (e) {
 		emit('error', e.message)

src/format.js

@@ -26,30 +26,3 @@ export function formatSize(bytes) {
 	}
 	return i === 0 ? `${b} B` : `${b.toFixed(1)} ${units[i]}`
 }
-
-/**
- * A time of day "HH:MM" in zone `from`, as "HH:MM" in zone `to`, at today's offsets.
- *
- * @param {string} hhmm the time
- * @param {string} from IANA zone it is in
- * @param {string} to IANA zone to show it in
- * @param {Date} now the day to convert on (today)
- * @return {string}
- */
-export function toZone(hhmm, from, to, now = new Date()) {
-	const [h, m] = hhmm.split(':').map(Number)
-	const parts = (zone, date) => Object.fromEntries(new Intl.DateTimeFormat('en-GB', {
-		timeZone: zone, hourCycle: 'h23', year: 'numeric', month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit',
-	}).formatToParts(date).map((p) => [p.type, p.value]))
-	const offsetAt = (at) => {
-		const seen = parts(from, new Date(at))
-		return Date.UTC(+seen.year, +seen.month - 1, +seen.day, +seen.hour, +seen.minute) - at
-	}
-	const today = parts(from, now)
-	const wall = Date.UTC(+today.year, +today.month - 1, +today.day, h, m)
-	// the offset at the wall time itself: on a day the clocks change it differs from the one at
-	// midnight, so it is looked up a second time at the moment found first
-	const at = wall - offsetAt(wall - offsetAt(wall))
-	const there = parts(to, new Date(at))
-	return `${there.hour}:${there.minute}`
-}

tests/Unit/Crypto/KeyRingTest.php

@@ -22,6 +22,27 @@ class KeyRingTest extends TestCase {
 		KeyRing::unwrap($wrapped, 'wrong');
 	}
 
+	public function testInvalidBase64IsADamagedKey(): void {
+		$wrapped = KeyRing::generate()->wrap('right');
+		$wrapped['salt'] = '***not base64***';
+		$this->expectException(CryptoException::class);
+		$this->expectExceptionMessage('Damaged key file');
+		KeyRing::unwrapAny($wrapped, 'right');
+	}
+
+	public function testAShortSaltOrNonceIsADamagedKey(): void {
+		foreach (['salt', 'nonce'] as $part) {
+			$wrapped = KeyRing::generate()->wrap('right');
+			$wrapped[$part] = base64_encode('short');
+			try {
+				KeyRing::unwrapAny($wrapped, 'right');
+				$this->fail("a short $part was accepted");
+			} catch (CryptoException $e) {
+				$this->assertStringContainsString('Damaged key file', $e->getMessage(), $part);
+			}
+		}
+	}
+
 	public function testBlobIdsAreKeyed(): void {
 		$this->assertNotSame(KeyRing::generate()->blobId('same'), KeyRing::generate()->blobId('same'));
 		$k = KeyRing::generate();
@@ -34,6 +55,20 @@ class KeyRingTest extends TestCase {
 		new KeyRing('short');
 	}
 
+	public function testADamagedSlotDoesNotStopTheNextOne(): void {
+		$keys = KeyRing::generate();
+		$broken = $keys->wrap('passphrase in the safe');
+		$broken['salt'] = '*** not base64 ***';
+		$field = ['slots' => [
+			['slot' => 1, 'label' => 'Safe', 'key' => $broken],
+			['slot' => 2, 'label' => 'Missing parts', 'key' => ['v' => 1]],
+			['slot' => 3, 'label' => 'CTO', 'key' => $keys->wrap('passphrase of the cto')],
+		]];
+		$this->assertSame($keys->blobId('x'), KeyRing::unwrapAny($field, 'passphrase of the cto')->blobId('x'));
+		$this->expectException(CryptoException::class);
+		KeyRing::unwrapAny($field, 'passphrase in the safe');
+	}
+
 	public function testAnySlotOpensTheSameKey(): void {
 		$keys = KeyRing::generate();
 		$field = ['slots' => [

tests/Unit/Repository/KeyFromLocationTest.php

@@ -51,7 +51,9 @@ class KeyFromLocationTest extends TestCase {
 		$this->assertSame(30, Repository::settingsAt($this->backend, $this->keys)['delete_delay_days']);
 		Repository::openWithKey($this->backend, $this->keys)->recordSettings(['delete_delay_days' => 1]);
 		$this->assertSame(30, Repository::settingsAt($this->backend, $this->keys)['delete_delay_days']);
-		$this->assertSame([], Repository::settingsAt($this->backend, KeyRing::generate()));
+		$this->assertSame(['unreadable' => true], Repository::settingsAt($this->backend, KeyRing::generate()), 'another key: there, but not readable');
+		unlink($this->dir . '/settings');
+		$this->assertSame([], Repository::settingsAt($this->backend, $this->keys), 'none at all: a location from before 1.1.0');
 	}
 
 	public function testAlteredSettingsAreNotBelieved(): void {
@@ -59,7 +61,7 @@ class KeyFromLocationTest extends TestCase {
 		$raw = file_get_contents($file);
 		$raw[strlen($raw) - 1] = $raw[strlen($raw) - 1] ^ "\x01";
 		file_put_contents($file, $raw);
-		$this->assertSame([], Repository::settingsAt($this->backend, $this->keys));
+		$this->assertSame(['unreadable' => true], Repository::settingsAt($this->backend, $this->keys));
 	}
 
 	public function testTheKitWritesALostConfigAgainAndTheBackupsOpen(): void {

tests/Unit/Service/LocationScheduleTest.php

@@ -48,7 +48,10 @@ class LocationScheduleTest extends TestCase {
 
 	public function testAClockChangeInTheNightStillGivesOneMoment(): void {
 		$this->assertSame(self::at('2026-03-29 01:30 UTC'), S::lastMoment('02:30', self::BERLIN, self::at('2026-03-29 12:00 UTC')), '02:30 does not exist that night');
-		$this->assertNotNull(S::lastMoment('02:30', self::BERLIN, self::at('2026-10-25 12:00 UTC')));
+		$autumn = S::lastMoment('02:30', self::BERLIN, self::at('2026-10-25 12:00 UTC'));
+		$this->assertNotNull($autumn);
+		$local = (new \DateTimeImmutable('@' . $autumn))->setTimezone(new \DateTimeZone(self::BERLIN));
+		$this->assertSame('2026-10-25 02:30', $local->format('Y-m-d H:i'), '02:30 happens twice that night: one of them, on that day');
 	}
 
 	public function testChoosingATimeDoesNotStartABackup(): void {

tests/integration/recovery-scenarios.sh

@@ -10,6 +10,7 @@
 #                       changes nothing; backups wait for a new kit
 #   no-kit-old          as no-kit, on a location backed up only before 1.1.0 (no settings file):
 #                       the deletion delay is the default, and the admin is told so
+#   no-kit-damaged      as no-kit, with a damaged settings file: the longest deletion delay, and why
 #   no-config-no-kit    the location's config is gone and there is no kit: told that only the kit helps
 #   no-config-kit       config gone, kit there: --repair-config writes it again, the backups open
 #   other-kit           the kit of another server: refused, told to use the old server's kit
@@ -19,6 +20,8 @@
 #   unused-key-no-kit   the same without a kit: target:add with --replace-unused-key and a passphrase
 #                       of the old server; a wrong one keeps the unused key
 #   used-key            a key that protected a location is never replaced, also after the location was removed
+#   slot-catch-up       a passphrase added while a location was unreachable reaches it at its next
+#                       backup; a new server then gets the key from it with that passphrase
 set -euo pipefail
 IMAGE="nextcloud:${1:-35-apache}"
 APP=$(cd "$(dirname "$0")/../.." && pwd)
@@ -148,6 +151,15 @@ expect "$OUT" "7 days (the default" "no-kit-old: the default delay and why"
 docker exec ngb-rs-new test -f /mnt/shared/no-kit-old/repo/settings || fail "no-kit-old: the settings were not written when the location was added"
 ok "no-kit-old: key from the location, default delay with the reason, settings written now"
 
+# no-kit-damaged: the settings file is there but damaged: the longest delay, and the admin is told
+scenario no-kit-damaged
+docker exec ngb-rs-new sh -c 'rm /tmp/kit.json && printf garbage >> /mnt/shared/no-kit-damaged/repo/settings'
+# shellcheck disable=SC2046
+OUT=$(run_on ngb-rs-new backup:target:add offsite $(location no-kit-damaged) --passphrase-file=/tmp/pass 2>&1) || { printf '%s\n' "$OUT"; fail "no-kit-damaged: target add"; }
+expect "$OUT" "fingerprint $FP" "no-kit-damaged"
+expect "$OUT" "365 days (the longest" "no-kit-damaged: the longest delay and why"
+ok "no-kit-damaged: key from the location, the longest delay with the reason"
+
 # no-config-no-kit
 scenario no-config-no-kit
 docker exec ngb-rs-new rm /tmp/kit.json /mnt/shared/no-config-no-kit/repo/config
@@ -269,4 +281,31 @@ expect "$OUT" "never replaced" "used-key key:import"
 [ "$(key_of ngb-rs-new)" = "$OWN" ] || fail "used-key: the key changed"
 ok "used-key: never replaced, by kit or passphrase, also after its location was removed"
 
+# slot-catch-up: a passphrase change that missed a location reaches it at the next backup
+start ngb-rs-new
+docker exec ngb-rs-new sh -c "printf '%s\n' 'catch up passphrase of the cto' > /tmp/pass2 && chmod 644 /tmp/pass2 && rm -rf /mnt/shared/catchup && mkdir -p /mnt/shared/catchup && chown www-data /mnt/shared/catchup"
+run_on ngb-rs-new backup:key:init --passphrase-file=/tmp/pass --label=Safe >/dev/null || fail "slot-catch-up: key init"
+CODE=$(run_on ngb-rs-new backup:key:kit | php -r 'echo json_decode(stream_get_contents(STDIN), true)["confirmation_code"];')
+run_on ngb-rs-new backup:key:confirm -u admin --code="$CODE" --confirm="Yes, I confirm" >/dev/null || fail "slot-catch-up: confirm"
+# shellcheck disable=SC2046
+run_on ngb-rs-new backup:target:add offsite $(location catchup) >/dev/null || fail "slot-catch-up: target add"
+run_on ngb-rs-new backup:run offsite >/dev/null || fail "slot-catch-up: first backup"
+BEFORE=$(docker exec ngb-rs-new md5sum /mnt/shared/catchup/repo/config | cut -d' ' -f1)
+docker exec ngb-rs-new chmod 000 /mnt/shared/catchup/repo
+OUT=$(must_fail ngb-rs-new "slot-catch-up: slot add with the location unreachable" backup:key:slot:add --label=CTO --passphrase-file=/tmp/pass2)
+expect "$OUT" "tried again at their next backup" "slot-catch-up: says the change follows"
+docker exec ngb-rs-new chmod 755 /mnt/shared/catchup/repo
+[ "$(docker exec ngb-rs-new md5sum /mnt/shared/catchup/repo/config | cut -d' ' -f1)" = "$BEFORE" ] || fail "slot-catch-up: the location changed while unreachable"
+CODE=$(run_on ngb-rs-new backup:key:kit | php -r 'echo json_decode(stream_get_contents(STDIN), true)["confirmation_code"];')
+run_on ngb-rs-new backup:key:confirm -u admin --code="$CODE" --confirm="Yes, I confirm" >/dev/null || fail "slot-catch-up: confirm the new kit"
+run_on ngb-rs-new backup:run offsite >/dev/null || fail "slot-catch-up: backup after the location came back"
+[ "$(docker exec ngb-rs-new md5sum /mnt/shared/catchup/repo/config | cut -d' ' -f1)" != "$BEFORE" ] || fail "slot-catch-up: the backup did not bring the new passphrase to the location"
+CATCHFP=$(key_of ngb-rs-new)
+start ngb-rs-other
+docker exec ngb-rs-other sh -c "printf '%s\n' 'catch up passphrase of the cto' > /tmp/pass2 && chmod 644 /tmp/pass2"
+# shellcheck disable=SC2046
+OUT=$(run_on ngb-rs-other backup:target:add offsite $(location catchup) --passphrase-file=/tmp/pass2 2>&1) || { printf '%s\n' "$OUT"; fail "slot-catch-up: a new server with the new passphrase"; }
+expect "$OUT" "fingerprint $CATCHFP" "slot-catch-up: the new server"
+ok "slot-catch-up: a passphrase that missed a location reaches it at the next backup and opens it on a new server"
+
 echo "RECOVERY SCENARIOS PASS"

tests/integration/upgrade-from-release.sh

@@ -56,6 +56,7 @@ occ backup:key:kit --output=/tmp/kit.json >/dev/null
 CODE=$(occ backup:key:kit | php -r 'echo json_decode(stream_get_contents(STDIN), true)["confirmation_code"];')
 occ backup:key:confirm -u admin --code="$CODE" --confirm="Yes, I confirm" >/dev/null || fail "confirm"
 occ config:app:set ng_backup schedule_time --value=03:15 >/dev/null
+occ config:app:set ng_backup schedule_timezone --value=America/Toronto >/dev/null
 occ backup:target:add offsite local -a null::null -o datadir=/mnt/shared/loc --path=repo >/dev/null || fail "target add"
 docker exec -u www-data $N sh -c 'mkdir -p data/admin/files/Docs && head -c 3000000 /dev/urandom > data/admin/files/Docs/before.bin'
 occ files:scan admin >/dev/null
@@ -76,9 +77,12 @@ OUT=$(occ upgrade 2>&1) || { printf '%s\n' "$OUT"; fail "occ upgrade"; }
 VER=$(occ app:list --output=json | php -r '$a = json_decode(stream_get_contents(STDIN), true); echo $a["enabled"]["ng_backup"] ?? "";')
 [ -z "$NEWVER" ] || [ "$VER" = "$NEWVER" ] || fail "after the upgrade the app has version '$VER'"
 ok "occ upgrade to $VER"
+# Before anything else touches the key: only the migration can have marked it as used
+[ "$(occ config:app:get ng_backup master_key_used 2>/dev/null)" = 1 ] || [ "$(occ config:app:get ng_backup master_key_used 2>/dev/null)" = true ] || fail "the migration did not mark the key from before the upgrade as used"
+ok "the key from before the upgrade counts as used"
 
-LIST=$(occ backup:target:list)
-printf '%s\n' "$LIST" | grep offsite | grep -q "03:15" || { printf '%s\n' "$LIST"; fail "the location did not keep 03:15 as its schedule"; }
+SCHED=$(occ backup:target:schedule offsite)
+printf '%s\n' "$SCHED" | grep -qx "offsite: 03:15 (America/Toronto)" || { printf '%s\n' "$SCHED"; fail "the location did not keep 03:15 as its schedule"; }
 occ backup:list offsite | grep -q "$OLDSNAP" || fail "the old restore point is not listed"
 occ backup:verify offsite "$OLDSNAP" >/dev/null || fail "the old restore point does not verify"
 occ backup:status >/dev/null || fail "backup:status"
@@ -91,9 +95,15 @@ ok "after the upgrade: schedule kept, old restore point listed, verified, a file
 docker exec -u www-data $N sh -c 'head -c 2000000 /dev/urandom > data/admin/files/Docs/after.bin'
 occ files:scan admin >/dev/null
 occ backup:run offsite >/dev/null || fail "backup after the upgrade"
-[ "$(occ backup:list offsite | grep -o '[0-9a-f]\{32\}' | sort -u | wc -l)" -ge 2 ] || fail "no new restore point after the upgrade"
+NEWSNAP=$(occ backup:list offsite | grep -o '[0-9a-f]\{32\}' | grep -v "$OLDSNAP" | head -1)
+[ -n "$NEWSNAP" ] || fail "no new restore point after the upgrade"
+SUM2=$(docker exec $N sha256sum /var/www/html/data/admin/files/Docs/after.bin | cut -d' ' -f1)
+docker exec $N sh -c 'rm -rf /tmp/rst && mkdir /tmp/rst && chown www-data /tmp/rst'
+occ backup:restore offsite "$NEWSNAP" data/admin/files/Docs/after.bin --to-directory=/tmp/rst >/dev/null || fail "restore from the new restore point"
+GOT=$(docker exec $N sh -c 'find /tmp/rst -name after.bin -exec sha256sum {} \;' | cut -d' ' -f1)
+[ "$GOT" = "$SUM2" ] || fail "the file restored from the new restore point differs"
 docker exec $N test -f /mnt/shared/loc/repo/settings || fail "the location got no settings file"
 OUT=$(occ backup:key:import /tmp/kit.json --passphrase-file=/tmp/pass --replace-unused-key 2>&1) && fail "a used key from before the upgrade was offered for replacement"
 printf '%s\n' "$OUT" | grep -q "never replaced" || { printf '%s\n' "$OUT"; fail "the refusal does not say the key is never replaced"; }
-ok "a new backup runs, the location got its settings, the key counts as used"
+ok "a new backup runs and restores, the location got its settings, the key counts as used"
 echo "UPGRADE $OLDVER -> ${VER:-working tree} PASS"