dillard
eb9100a74d
Catalog: forgetting a user export or purging trash now writes the catalog before deleting the objects, so a crash leaves at most an unreferenced file instead of a catalog entry pointing at nothing. Per-user backup and the safety export reopen the repository inside the catalog lock, so they build on the latest catalog generation. Commands: backup:user:backup and backup:user:restore resolve the location before asking to install user_migration, and a successful install always stops with a rerun instruction. backup:retention rejects a malformed --user-last before changing any policy. backup:key:import fails clearly when the passphrase file cannot be read.
70 lines
3.0 KiB
PHP
70 lines
3.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
// SPDX-FileCopyrightText: 2026 Dillard Blom
|
|
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
namespace OCA\NgBackup\Service;
|
|
|
|
use OCA\NgBackup\Db\Target;
|
|
use OCA\NgBackup\UserMigration\RepositoryExportDestination;
|
|
use OCA\NgBackup\UserMigration\UserMigrationServiceLocator;
|
|
use OCP\IUser;
|
|
use OCP\Lock\LockedException;
|
|
use OCP\UserMigration\UserMigrationException;
|
|
|
|
/**
|
|
* Per-user backup via user_migration: every registered migrator's export streams straight into
|
|
* the encrypted repository (no zip, no copy in the user's own storage, see
|
|
* RepositoryExportDestination). Shares blobs with the full backup; prune() keeps a user export's
|
|
* blobs referenced through its manifest under users/<uid>/.
|
|
*
|
|
* user_migration is an optional dependency (unlike files_external): without it, only this
|
|
* per-user backup/restore is unavailable, the full backup still works.
|
|
*/
|
|
final class UserBackupService {
|
|
public function __construct(
|
|
private TargetService $targets,
|
|
private LeaseService $leases,
|
|
private UserMigrationServiceLocator $locator,
|
|
) {
|
|
}
|
|
|
|
/** @throws UserMigrationException when user_migration is not enabled, or the export itself fails */
|
|
public function backupUser(Target $target, IUser $user): string {
|
|
$service = $this->locator->get();
|
|
return $this->withSharedLock($target, function () use ($target, $user, $service) {
|
|
$repo = $this->targets->repository($target);
|
|
$dest = new RepositoryExportDestination($repo, $user->getUID());
|
|
$service->export($dest, $user);
|
|
// A short exclusive lock around the catalog write only: the shared lock above
|
|
// allows another concurrent backup (full or per-user) to be writing the catalog at
|
|
// the same time. The repository is reopened inside the lock, so the write builds on
|
|
// the latest catalog generation instead of the one loaded before the lock was taken.
|
|
$this->withCatalogLock($target, fn () => $this->targets->repository($target)->recordUserExport($dest->manifestPath()));
|
|
return $dest->manifestPath();
|
|
});
|
|
}
|
|
|
|
private function withSharedLock(Target $target, callable $fn): mixed {
|
|
try {
|
|
// UserMigrationService::export() exposes no progress, so unlike
|
|
// RestoreService::restoreUserFiles() this lease cannot be refreshed mid-call; a very
|
|
// large account could in theory outrun this TTL. Resumable, step-based per-user
|
|
// backup (like the main BackupService run) is a possible future improvement.
|
|
return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 3600, $fn);
|
|
} catch (LockedException) {
|
|
throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');
|
|
}
|
|
}
|
|
|
|
private function withCatalogLock(Target $target, callable $fn): mixed {
|
|
try {
|
|
return $this->leases->with(PruneService::catalogLockKey($target), LeaseService::EXCLUSIVE, 30, $fn);
|
|
} catch (LockedException) {
|
|
throw new \RuntimeException('Another catalog write for ' . $target->getName() . ' is in progress; try again');
|
|
}
|
|
}
|
|
}
|