dillard
0f4a238414
Storage and repository:
- Listing skipped every name containing ".part-", directories too, so the
exports of a user like "john.part-time" were invisible to prune on S3,
SFTP, FTP and SMB and their data was deleted. Only real temporary uploads
("<name>.part-<8 hex>") are skipped now.
- prune refuses to run while a recorded per-user export's manifest is
missing, instead of freeing that export's data.
- forget() and untrash() copy first, switch the catalog, and delete the
originals last, so a crash can no longer leave the catalog pointing at a
missing snapshot or database dump.
- Writes are checked against the expected size, so a short upload is an
error instead of a truncated pack; raw restores check rename() and touch().
- A catalog write refuses to overwrite a generation another process just
wrote, and the catalog lock lasts 300 s, so opening a large repository
inside it no longer lets the lease run out.
Backup runs and scheduling:
- A file that keeps changing is read again at most three times; then the
last read is kept and reported, instead of restarting forever and
blocking cleanup.
- Unreadable files and folders are recorded, logged, shown by occ
backup:run, stored in the snapshot and notified to admins, instead of
being skipped silently.
- After a failed scheduled backup, at most three attempts a day, an hour
apart, instead of a new run and notification every five minutes.
- The job no longer spins on a run whose lease another process holds, and
the weekly cleanup catches up after a Sunday spent backing up.
- Notifications for the per-user export retention events.
67 lines
2.8 KiB
PHP
67 lines
2.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
// SPDX-FileCopyrightText: 2026 Dillard Blom
|
|
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
namespace OCA\NgBackup\Service;
|
|
|
|
use OCA\NgBackup\Db\Target;
|
|
use OCA\NgBackup\UserMigration\RepositoryExportDestination;
|
|
use OCA\NgBackup\UserMigration\UserMigrationServiceLocator;
|
|
use OCP\IUser;
|
|
use OCP\Lock\LockedException;
|
|
use OCP\UserMigration\UserMigrationException;
|
|
|
|
/**
|
|
* Per-user backup via user_migration: every registered migrator's export streams straight into
|
|
* the encrypted repository (no zip, no copy in the user's own storage, see
|
|
* RepositoryExportDestination). Shares blobs with the full backup; prune() keeps a user export's
|
|
* blobs referenced through its manifest under users/<uid>/.
|
|
*
|
|
* user_migration is an optional dependency (unlike files_external): without it, only this
|
|
* per-user backup/restore is unavailable, the full backup still works.
|
|
*/
|
|
final class UserBackupService {
|
|
public function __construct(
|
|
private TargetService $targets,
|
|
private LeaseService $leases,
|
|
private UserMigrationServiceLocator $locator,
|
|
) {
|
|
}
|
|
|
|
/** @throws UserMigrationException when user_migration is not enabled, or the export itself fails */
|
|
public function backupUser(Target $target, IUser $user): string {
|
|
$service = $this->locator->get();
|
|
return $this->withSharedLock($target, function (callable $refresh) use ($target, $user, $service) {
|
|
$repo = $this->targets->repository($target);
|
|
$dest = new RepositoryExportDestination($repo, $user->getUID(), LeaseService::throttled($refresh));
|
|
$service->export($dest, $user);
|
|
// A short exclusive lock around the catalog write only: the shared lock above
|
|
// allows another concurrent backup (full or per-user) to be writing the catalog at
|
|
// the same time. The repository is reopened inside the lock, so the write builds on
|
|
// the latest catalog generation instead of the one loaded before the lock was taken.
|
|
$this->withCatalogLock($target, fn () => $this->targets->repository($target)->recordUserExport($dest->manifestPath()));
|
|
return $dest->manifestPath();
|
|
});
|
|
}
|
|
|
|
private function withSharedLock(Target $target, callable $fn): mixed {
|
|
try {
|
|
// Refreshed by RepositoryExportDestination as it writes data, so a long export keeps it.
|
|
return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 3600, $fn);
|
|
} catch (LockedException) {
|
|
throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');
|
|
}
|
|
}
|
|
|
|
private function withCatalogLock(Target $target, callable $fn): mixed {
|
|
try {
|
|
return $this->leases->with(PruneService::catalogLockKey($target), LeaseService::EXCLUSIVE, 300, $fn);
|
|
} catch (LockedException) {
|
|
throw new \RuntimeException('Another catalog write for ' . $target->getName() . ' is in progress; try again');
|
|
}
|
|
}
|
|
}
|