julian
0c218179c4
The SQLite DB is the signed append-only ledger, so a disk failure / stolen or destroyed PC means total revenue-history loss (open-question #5). This is the first slice of the backup-recovery design: the engine + a local/mounted target + a daily timer + a manual route. Engine (apps/server/src/backup.ts): - Consistent online copy of the live WAL DB via better-sqlite3's native .backup() (not a raw file copy, which can capture a torn WAL) — the restored copy is a byte-identical, queryable DB. - AES-256-GCM with a scrypt-derived key from BACKUP_KEY; self-describing header (magic|version|salt|iv|...|authTag) so a restore tool needs only the key + file. Zero new dependencies (Node crypto). - The plaintext intermediate is kept in scratch (not the removable/network target) and wiped in a finally, success or fail. - Retention: keep-last-N + one-per-day within N days. Wiring: - BackupService (env config, single in-flight guard, last-success/last-error). - routes/backup.ts: GET /api/backup/status (backup:read), POST /api/backup/run (backup:create), 409 when unconfigured. No restore route — restore is an out-of-band runbook action on a fresh appliance, not a console call. - New permission resource in @parking/shared. - server.ts: an unref'd daily timer, a no-op until BACKUP_TARGET_DIR + BACKUP_KEY are set, deliberately not run at startup (a just-power-cut booth shouldn't write to a possibly-unmounted disk). - openRawDb() added to @parking/db/testing (open a file without migrating, for restore-verification tests). BACKUP_KEY is deliberately SEPARATE from EVENT_SIGNING_KEY (independent rotation; backups travel, the signing key shouldn't). SMB/NFS work as mount paths; SFTP + admin UI + restore runbook are deferred slices. Tests: round-trip byte-identical, GCM tamper/wrong-key fail, short-key rejected, scratch cleaned, route auth/RBAC + 409. build/lint/test green (212 server tests). Wiki + open-question #5 updated. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
43 lines
2.1 KiB
TypeScript
43 lines
2.1 KiB
TypeScript
import { fileURLToPath } from "node:url";
|
|
import { dirname, resolve } from "node:path";
|
|
import Database from "better-sqlite3";
|
|
import { drizzle } from "drizzle-orm/better-sqlite3";
|
|
import { migrate } from "drizzle-orm/better-sqlite3/migrator";
|
|
import * as schema from "./schema.js";
|
|
import type { Db } from "./index.js";
|
|
|
|
// Test-only helper: a fresh, fully-migrated SQLite database with NO live-DB risk.
|
|
// Every server/integration test spins one of these so suites are isolated and
|
|
// deterministic — never the real parking.sqlite. Not exported from the package
|
|
// root (`@parking/db`); import it from `@parking/db/testing` in test code only.
|
|
|
|
// The migrations live next to this package's compiled output. From dist/testing.js
|
|
// that's ../drizzle; resolve it off import.meta.url so it works regardless of the
|
|
// caller's cwd (tests run from apps/server, packages/devices, etc.).
|
|
const MIGRATIONS_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "../drizzle");
|
|
|
|
/**
|
|
* Open an in-memory SQLite (or a temp file if `url` is given), apply every Drizzle
|
|
* migration in order, and return a typed Drizzle handle plus the raw better-sqlite3
|
|
* connection (so a test can assert raw rows or `.close()` it). The schema matches
|
|
* production exactly because it's the SAME migration set, not a hand-rolled DDL.
|
|
*/
|
|
export function createTestDb(url = ":memory:"): { db: Db; sqlite: Database.Database; close: () => void } {
|
|
const sqlite = new Database(url);
|
|
sqlite.pragma("journal_mode = WAL");
|
|
sqlite.pragma("foreign_keys = ON");
|
|
const db = drizzle(sqlite, { schema }) as Db;
|
|
migrate(db, { migrationsFolder: MIGRATIONS_DIR });
|
|
return { db, sqlite, close: () => sqlite.close() };
|
|
}
|
|
|
|
/**
|
|
* Open an EXISTING SQLite file raw, WITHOUT running migrations — for tests that need to
|
|
* inspect a file produced elsewhere (e.g. a restored backup) exactly as written, without
|
|
* mutating it. Returns the raw better-sqlite3 handle so the caller depends only on
|
|
* `@parking/db/testing`, never on `better-sqlite3` directly.
|
|
*/
|
|
export function openRawDb(url: string): Database.Database {
|
|
return new Database(url);
|
|
}
|