6 Commits

Author	SHA1	Message	Date
Maurice	8864edda18	feat(budget): link existing expenses to bookings and places, several per booking ... Discussion #2084: a cost bought later (the seat upgrade for a flight) could not be tied to the booking it belongs to, and a booking held one expense. - The Costs block of the booking, transport and place forms lists every linked expense with edit, unlink (the expense stays in Costs) and delete, and offers the expenses that belong nowhere yet under Link existing expense. The phone sheets get the same block in their own design, and their Files row lists the attached files and links an existing one. - PUT /budget/:id, update_budget_item (MCP) and costs.update (plugin RPC) take reservation_id / place_id; create and update refuse an id from another trip on all three paths. - The booking's mirrored price is the sum of its expenses when they share one currency (none counts as the trip's), else the first one, with that currency, and follows every change to a linked expense. The booking form's price field leaves a booking with several expenses alone. - Deleting a booking deletes all of its linked expenses and broadcasts each one, also from the MCP delete tools. - Cards show the price with its currency. - Booking and transport dialogs: Booking Type and Travelers as dropdowns at the top, the URL beside Files (transports gain the URL field). The row is one shared component; linking and unlinking files go through the store. Help center pictures and texts for the booking, transport and expense guides are redone in all 27 languages, five Costs labels that were still English in 16 languages are translated, and the wiki follows.	2026-09-25 15:34:32 +02:00
Maurice	c7c9ba24a3	fix(journey): select all takes every photo in the range and imports keep their order ... The photo picker's Select all took only the pages already loaded, 50 at a time, and replaced whatever had been picked on another tab. It now loads the rest of a day, trip or date-range search before selecting (cancelled by closing the picker or switching tab), adds to earlier picks, and Deselect all only clears what is in view. Add stays disabled until that loading is done. The whole-library tab keeps selecting what is loaded and shows the count as "N+". A date-filtered Immich search stopped at 1,000 photos without a word, because its page budget was absolute; it is now relative to the page asked for, with an absolute ceiling of 270 raw pages sized so the picker's deepest page still gets a full answer. Adds go out in batches of 500 ids, under the JSON body limit, and each batch is sent oldest first, so photos land in an entry in the order they were taken. When a later batch fails, the photos already saved are counted and the journey reloads while the error still shows, through one hook for desktop and phone. After a provider add, the capture-time lookup runs at most four at a time per user, shared by all of that user's batches. When it fills a row, a journey:photos:updated event reloads open journeys once per batch, from the REST routes and the MCP add tool alike. Device uploads, which arrive one file per request, get the same lookup without the event. Addresses discussion #1587.	2026-09-24 23:48:49 +00:00
Maurice	661777f81f	feat(plugins): let a plugin attach a photo to a journal entry ... A journal importer can create the journey, create its entries and write their stories, and then it stops: there was no way to give an entry a picture. The seven journal.* methods cover text and nothing else, so an importer reading an export archive could only upload its photos as trip files, which live on a trip and never reach the journey's gallery. journal.addEntryPhoto takes the bytes. Deliberately not a link to an existing gallery photo and not a provider asset: an importer holding an archive has neither, it has a file it just unpacked. The access decision stays where it already was. addPhoto answers null unless the acting user may edit the journey the entry belongs to, and null becomes RESOURCE_FORBIDDEN here, so a plugin reaches exactly the entries its acting user does. Everything the REST upload refuses, this refuses too: images only and no SVG, the operator's allowed-file-types setting, 10MB decoded, demo mode. The stored filename is the host's, never the plugin's, because the gallery dedupes on file_path. The object is written before any row points at it and removed again when the link is refused. JournalRpc moves into its own module for this. It now needs StorageService and the EXIF backfill out of MemoriesModule, and JourneyDomainModule exists precisely so places, assignments and the plugin host can reach a few journey functions without dragging both photo providers into their graphs. Discussion #1365	2026-08-28 18:04:25 +02:00
jubnl	305b113d5f	Feat/storage driver (#1949) ... * feat(storage): storage key validation, driver contract suite, LocalDriver * feat(storage): MirrorDriver composite backend * feat(server): add TREK_UPLOADS_DIR env var for the uploads root * feat(storage): settings-backed registry, StorageService facade, module wiring * test(storage): pin src/nest/storage coverage thresholds * feat(storage): multer upload options factory * refactor(files): spool trip-file uploads through storage * refactor(collab): spool note attachments through storage; normalize files/ prefix * refactor(journey): spool journey media uploads through storage * refactor(trips): spool trip cover upload through storage * refactor(places): spool place-image and collection uploads through storage * refactor(auth): spool avatar upload through storage * fix(server): consolidate allowed_file_types onto AllowedFileTypesService * fix(storage): default defParamCharset to utf8 in the upload factory * test(db): re-point the trailing-migration guard at the trip_files prefix strip * fix(storage): age-gate the boot spool sweep * test(files): key FILE-P02 residue checks on upload size * test(storage): raise src/nest/storage coverage pin * refactor(platform): serve /uploads routes through storage * refactor(files): serve trip-file downloads through storage * refactor(memories): serve photo bytes through storage * refactor(maps): stream place-photo bytes through storage * refactor(share): stream shared place-photo bytes through storage * refactor(journey): serve public journey assets through storage * fix(share): answer place-photo cache miss with 204 like the maps proxy * test(server): close serving-swap gaps surfaced by the full tier * test(storage): raise src/nest/storage branches pin * refactor(place-photos): route place-photo cache through storage * refactor(places): reclaim place images and collection covers through storage * refactor(trips): trip covers through storage * refactor(auth): avatar reclaim through storage * refactor(collab): note-file deletion through storage * refactor(files): trash deletion through storage * refactor(memories): trek photo cache internals through storage * refactor(memories): thumbnail service category-addressed * refactor(memories): immich upload reads through storage; drop uploads-root * refactor(journey): photo deletion through storage * fix(memories): reclaim orphaned trek photo cache objects in the ttl sweep * feat(journey): journey-thumbs orphan sweep and delete-site derived-artifact reclaim * test(server): close slice-4 gaps surfaced by the full tier * test(coverage): raise slice-4 domain pins * refactor(backup): list, existence and delete through storage * refactor(backup): download through storage sendToResponse * refactor(backup): create backup through per-category storage enumeration * refactor(backup): restore and upload-restore through storage * refactor(backup): auto-backup retention through storage * refactor(server): boot dir-creation to driver init * test(server): close slice-5 gaps surfaced by the coverage tier * test(coverage): raise slice-5 backup pin * test(server): resolve async backupFileExists mocks for the tests typecheck * test(server): pin ranged-read stat and zero-byte roundtrip in the storage driver contract * feat(server): TREK_S3_* env wiring — schema, s3 namespace, all-or-nothing boot rule * feat(server): S3 driver core — aws-lite client seam, stat/delete, driver-owned deadlines * refactor(server): type the aws-lite S3 client via s3-types reference * feat(server): S3 driver getStream and list — ranged full-object stat, iterator pagination * feat(server): S3 driver put — bounded-peek routing, Upload inactivity deadline * fix(server): S3 driver Upload monitoring — Transform interposition, stream cleanup * feat(server): env-declared s3-main storage backend; settings-declared s3 rejected * test(server): env-gated S3 driver contract suite against MinIO * fix(server): S3 driver zero-byte put — work around aws4 duplicate Content-Length signing defect * fix(server): scope the zero-byte put workaround to buffered bodies; bind test MinIO to localhost * ci(server): MinIO-backed S3 driver contract job * ci(server): align s3-contract shim comment and MinIO bind with references * docs: S3 storage backend configuration and off-box backup mirroring * docs: restore README formatting, keep S3 additions only * ci(server): make live-MinIO contract runs manual-only (AIStor licensing) MinIO's community line is discontinued entirely; the maintained successor, AIStor, requires a license key that can't safely live in a shared CI runner. The s3-contract CI job is removed; live-provider contract runs against MinIO/AIStor are now a manual, license-gated procedure documented in docker-compose.minio-test.yml's header. * chore(server): final-review polish — stale CI refs, dockerignore key, boundary pins, zero-byte tempfile contract case * expose admin ui * feat(shared): storage backend type registry, wire schemas, category relocation * feat(server): accept settings-declared s3 backends — shared-schema options, decrypt-at-build, registry preview() * feat(server): remove TREK_S3_*/TREK_UPLOADS_DIR — tombstone boot rule, built-in override as the relocation path * feat(server): deriveSecurity.encryptionKeySet and storage secret plumbing (gate, encrypt, unmask, mask, redact) * chore(server): drop storage-secrets import that only Task 8's probe helper will use * feat(server): seed-once storage-config.json boot import — fail closed on any invalid seed * feat(server): registry snapshot() — effective storage config with provenance * feat(server): api/admin/storage GET/PUT — masked secrets, preview-gated saves, wired reload, audits * feat(server): api/admin/storage/test — per-target ephemeral probes, mirror targets probed individually * test(server): e2e coverage for api/admin/storage — guards, managed refusal, envelope, probes * test(server): give e2e harness DBs the app_settings table the storage registry reads at boot * test(coverage): raise pins after the storage admin-config slice * fix(server): final-review polish — encryption-gate wording, all-field sentinel guard, README/e2e notes * test(server): storage slice-1 review follow-ups — mirror s3-replica probe decrypt, all-encrypted seed without key, test-route 401 * feat(i18n): storage admin domain + tab label in every locale * feat(client): adminApi storage endpoints — getStorage, updateStorage, testStorageBackend * feat(client): storage admin draft-document helpers + relative-time util * feat(client): schema-driven storage BackendForm — fields by kind, mask echo, encryption banner * feat(client): admin storage panel — backends list, category map, health strip, one-PUT save * feat(client): storage tab on the admin page * feat(client): storage admin panel and section on the phone shell * fix(client): block renaming a storage backend onto an existing name * feat(server): allow mirrors on any storage category — lift the backups-only rule * feat(i18n): replicas-on-primary mirror strings in every locale * feat(client): mirror fold/synthesize model helpers for replicas-on-primary * feat(client): BackendForm mirror-targets composer; raw mirror type hidden * feat(client): desktop storage panel folds mirrors into their primaries * feat(client): phone storage panel folds mirrors into their primaries * fix(client): strip removed backends from remaining mirror replicas — no phantom refs * feat(storage): retire photos as a configurable category — served-only via the ServedCategory seam * feat(i18n): descriptive storage category names and descriptions in every locale * feat(client): descriptive category names, descriptions and id badges in the storage panel * docs(storage): fix stale nine-category comments after the eight-category shrink * docs: storage configuration via the admin UI and seed file — README + compose * docs(wiki): Admin Storage page and storage cross-links * docs(server): storage domain blueprint entry; TREK_PLACE_PHOTO_DIR tombstone clarifier * refactor(server): drop the storage env-var tombstones — the variables never shipped * docs: storage config is simply new in v4 — drop the removed-variables story * feat(shared): backfill-status and usage wire schemas on the storage admin state * feat(server): MirrorDriver.backfill — prefix-scoped, size-compared, cancellable replica catch-up * feat(server): one-at-a-time storage backfill jobs + the storage events bridge * feat(server): storage usage scan — nightly cron, on-demand service, persisted with computedAt * feat(server): replica_failure admin notifications — events bridge, hourly debounce, channel registration * feat(i18n): replica-failure notification text in every locale * feat(server): storage backfill and stats-refresh admin endpoints * feat(client): adminApi backfill and stats-refresh endpoints * feat(i18n): storage sync and usage strings in every locale * feat(client): desktop storage panel — sync now, usage display, backfill polling * feat(client): phone storage panel — sync now, usage display, backfill polling * fix(client): per-category usage line on the phone storage panel * docs: sync now, usage stats and replica-failure notifications * test(server): admin scope now includes replica_failure, not just version_available Commit 6db135da added replica_failure to ADMIN_SCOPED_EVENTS but left NPREF-005b asserting the admin scope contained only version_available. Update the expectation to match. * test(server): cover storage backfill/stats/jobs branches to hold the coverage pin * fix(client): guard storage admin polling against stale responses racing a save A poll GET issued before a save's PUT resolves could land after the save applied its fresher response, overwriting it with the pre-save world and re-deriving the draft from that stale snapshot. useStorageAdmin now tracks a state-application sequence number and drops any refreshState() response whose sequence has moved on, or that resolves while a save is in flight. Also guard the fire-and-forget refreshState() calls in startBackfill/ cancelBackfill against unhandled rejections, matching the poll's style. * fix(server): report 404 before 409 when a backfill start names an unknown mirror startBackfill checked the global busy flag before validating that :name is a mirror routed by some category, so POST .../backends/garbage/backfill answered 409 instead of 404 whenever a sync was already running. Resolve and validate the target first (BackfillTargetError -> 404), then check busy (BackfillBusyError -> 409). * feat(client): two-column category grid on the storage panel * feat(server): plugin files.getContent reads through the storage layer * feat(server): plugin files.create writes through the storage layer * refactor(server): drop FilesService.resolveFilePath, last direct-fs seam in the plugin surface * fix(server): map StorageInvalidKeyError to the plugin file accessibility envelope * feat(storage): allow credentialed backends without an explicit ENCRYPTION_KEY Secrets are still always encrypted at rest; without an explicit key the implicit data-directory key is used. Removes the plaintext-secret refusal from the admin PUT and the seed import, the encryptionReady GET field, the save-blocking banner in both admin shells, and the now-consumerless security.encryptionKeySet env derivation. Docs now recommend (not require) an explicit key, since the implicit key rides inside backup archives. * test(client): pin the stale-poll release to the pre-save GET in FE-ADMIN-STOR-024 The stub deferred EVERY poll GET and rebound the release handle to the newest one, so a tick landing after the save was released with the pre-save payload — a response no real backend can produce, which the seq guard rightly applied. Only the first (genuinely stale) GET is held now; later GETs answer with the world the mock server currently holds. Also drops the encryptionReady fixture field removed from the schema in the previous commit. * fix(storage): backfill puts carry content-type, stat failures report op stat, progress clamps * feat(storage): category migration job — copy, flip, delta sweep, reclaimable tally * feat(storage): migration start/cancel endpoints and client API * test(client): storage admin fixtures carry the new migrations field * fix(storage): migration POST answers 200 and validates its body via the shared schema * fix(storage): cancel running storage jobs when a config save removes their backend * fix(notifications): in-app replica-failure row carries the suppressed count * feat(client): migration prompt, queue, and progress on the storage panel * fix(client): migration queue holds a synchronous single-flight lock * feat(client): migration prompt and progress on the mobile storage panel * fix(server): register category-migration routes in the managed-route allow list StorageAdminController.migrationStart/migrationCancel were added under the controller-level @ManagedForbidden() decorator but never added to MANAGED_ROUTE_ALLOW_LIST, so validateManagedRoutes() threw "Managed surface changed" on every buildApp() call, failing 46 test files (any test booting the real app). * test(server): cover category-migration copy/sweep branches to hold the storage coverage pin Adds MIG-005 (a target object already matching size/key is skipped in the copy phase itself, not just the delta sweep) and MIG-006 (a copy failure during the delta sweep is counted without undoing the flip that already happened). src/nest/storage/**'s branch coverage was 83.91%, just under the 84% pin. * docs(storage): category migration — move existing objects on reassign * fix(storage): close the pre-flip cancel window and cancel re-routed migrations A cancel landing between the last copy iteration and the category flip was silently ignored, and a config save that re-routed the migrating category to a third, still-defined backend never stopped the in-flight migration. Also guards assignCategory against writing an unknown backend name, and fixes a missing `suppressed` notification param being treated as truthy suppression. * fix(client): migrations keep mirrors, queue waits on backfills, sweep failures surface Reassigning a category onto a mirrored primary now posts the migration to the mirror's wire name instead of the bare primary, so replication survives the move. The queued-migration effect also waits out a running backfill (the server's one-job rule spans both), and a done migration with sweep failures now surfaces a doneFailures line in both shells, translated into every locale. * ci(server): run the S3 contract suite against MinIO Resurrects the s3-contract job removed in 6fbff835, adapted for AIStor: writes the MINIO_LICENSE_KEY secret to a license file, boots the licensed container, and runs the contract suite hermetically (no --coverage) so the storage coverage pin keeps holding from unit tests alone. Gated to same-repo PRs since fork PRs have no access to the license secret. * fix(server): backup archives uploads from a remote primary createBackup() enumerated uploads through withLocalFile, which downloads a remote object to a temp file, hands it to the callback, then deletes it before archiver ever reads it — archiver reads entries lazily during finalize(), so a remote (S3) primary silently backed up zero upload bytes. Add StorageService.getLocalPathOrNull(category, name): a narrow locality probe that returns a real path only when one exists on disk right now (the fs-existence check is the fail-safe half of the contract — a driver-reported path that vanished between list() and here falls back too, not just a path-less remote driver). The enumeration loop uses it directly when available (zero-copy, unchanged for a local primary) and otherwise streams the object into a per-backup staging dir under the backups spool, cleaned up in the existing finally alongside zipSpool/dbSnap. Also wire archive.on('warning', reject): archiver treats a missing/unreadable entry as a warning, not an error, and skips it by default — which would silently drop the entry from an otherwise "successful" backup. * fix(server): client aborts stop 500ing and leaking streams storage.service.ts sendToResponse: the local res.sendFile branch now treats ECONNABORTED/ECONNRESET/ERR_STREAM_PREMATURE_CLOSE/syscall=write as success, mirroring res.sendFile's own default callback (the contract storageStaticHandler already implements caller-side). The remote branch replaces the hand-rolled pipe+Promise with pipeline(stream, res), which destroys the source stream on any failure — fixing the leaked S3 keep-alive socket on a client abort — while swallowing the same client-abort error set; a real source error still rejects so callers keep their miss contracts. This centralizes the fix for every caller that streams through sendToResponse: files-download, journey-public, photo-resolver, trek-photo-cache, backup downloads, and /uploads/photos. trek-exception.filter.ts now no-ops (destroying the socket) when headers are already sent, so no filter path ever writes onto a response in flight. maps.controller.ts and share.controller.ts's place-photo bytes proxies switch their direct getStream+pipe to pipeline() with the same abort-tolerant catch, keeping the existing 204-empty fallback for pre-header failures. * fix(storage): mirror read fallback consults replicas on primary miss MirrorDriver.getStream/stat now fall back to replicas on a primary miss (StorageNotFoundError / null stat), not just an infra error — binding decision: a read succeeds if ANY member holds the object. Only a deterministic StorageInvalidKeyError skips fallback. stat() gets a dedicated fallback loop instead of reusing fromReplicas: a replica returning null means "keep looking," which the generic catch-and-continue helper would have short-circuited on. StorageService.sendToResponse/withLocalFile stop treating composite driver.stat() as proof the object is at localPath; both now fs-check the path itself and fall through to the stream branch when it's missing, which is what actually reaches a MirrorDriver's replicas. * feat(storage): remote serving parity — content-type, validators, range Local backends get content type, ETag/Last-Modified, conditional GET, Range and HEAD for free from res.sendFile; the proxying branch every remote backend (and a local primary whose file vanished) falls through to had none of it — every request re-streamed the whole object with no cache validator and no way to seek. sendStreamed() reproduces the contract from ONE pre-flight driver.stat(): a miss throws before any header is set (the caller's 404/204/next() contract), and that same stat then answers 304s, 416s, HEADs and suffix ranges without ever opening a body. The decisions live in a new pure module, http-serving.ts: - validatorsFor: the driver's ETag, else express/send's weak W/"<size hex>-<mtime hex>". mtimeMs 0 (S3 can report it) means no Last-Modified and no derived tag — serving uncached beats a 1970 header that reads as fresh forever. - isNotModified: If-None-Match (weak compare, *, list) wins over If-Modified-Since, per RFC 9110 §13.2.2. - decideRange: single range only, inclusive clamp, suffix computed from the pre-stat size, unsatisfiable → 416, If-Range strong-exact or full entity. A multi-range or malformed spec is answered with the full object rather than multipart/byteranges. If-Match/If-Unmodified-Since stay out of scope. Range math uses the pre-stat size as the single source of truth, the ranged getStream stat is never re-consulted, and the pipeline abort semantics are unchanged. S3Driver now surfaces the bucket's ETag on stat()/getStream() (on a ranged GET it is still the full object's tag). aws-lite strips the tag's surrounding quotes — verified live against AIStor RELEASE.2026-08-07 — and an unquoted entity-tag is not a valid HTTP ETag, so the driver restores exactly the quotes the SDK removed and nothing else. * fix(server): key rotation covers storage.backends The S3 storage backend's secretAccessKey is encrypted at rest inside the app_settings row keyed storage.backends, but scripts/migrate-encryption.ts didn't know about it — after a key rotation that secret stayed encrypted under the old key and silently failed to decrypt on the next read. The script now re-encrypts secretAccessKey for every s3 backend inside the storage.backends JSON array, using a pinned copy of the secret-field list (it deliberately can't import @trek/shared). The parity test pins that copy against storageSecretFields('s3') so a new secret field can't be missed silently. * fix(server): restore reloads the storage registry restoreFromZip closed and reopened the DB but never reloaded the storage registry, so uploads rehydration ran against the STALE pre-restore driver/category map instead of the config the restored archive's own travel.db carries (audit #4, major). StorageService gains reloadConfig(), a narrow passthrough to the (unexported) registry's reload() — same shape as health(). backup.impl's restoreFromZip now calls it right after reinitialize() and right before the uploads wipe/rehydrateUploads/plugin staging, so rehydrated bytes land where the restored config says. When reopen fails (reinitFailed), reload and rehydration are skipped entirely — already reported as "restart required", and there is no live DB handle for the registry to read anyway. * fix(server): category migration rewrites keys across prefix changes Category migration copied objects to the destination backend using the SOURCE key verbatim. A mode-A ('' prefix) source migrating onto a prefixed backend (or vice versa) landed objects at keys the registry could never resolve post-flip (audit #8). Extracts StorageRegistryService.keyPrefixFor(category, backendName) from build()'s inline conditional so startMigration can compute the destination prefix before the flip. runMigration now maps every destination key (destPrefix + key.slice(sourcePrefix.length)) in the copy skip-check, the put, and the delta sweep; the reclaimable tally stays source-keyed. Equal-prefix migrations are unaffected (identity mapping). * fix(plugins): await the now-async place/collection services in RPCs PlacesService.update/remove and CollectionsService.deletePlace became async when they started deleting storage objects, but their plugin RPC handlers still called them synchronously: the null/false refusal check compared against an always-truthy Promise, and places.update broadcast a Promise instead of the resolved place. Both handlers now await the service call; mapCollectionError is async-aware (accepts a sync-or- async thunk) so the sync callers (create/update/savePlace/copyToTrip) keep working through the same path. Verified the RPC host already awaits handler results, so no change was needed there. * fix(storage): backfill Sync now gains a deletion sweep The Sync now backfill copied primary objects to replicas but never removed replica objects the primary no longer has, leaving mirror read-fallback able to serve stale data indefinitely after a failed replica delete. backfill() now sweeps each replica post-copy: any replica key absent from the primary key-set is re-checked against primary.stat (a race gate against the primary regaining the key) before being deleted. Adds a deleted counter end-to-end (driver, jobs service, shared schema, both admin shells, all 23 locales) and a new ReplicaFailure 'list' op for a replica whose listing itself fails during the sweep. * feat(storage): optimistic concurrency for admin config saves A stale admin PUT of storage settings could silently undo a category migration's just-flipped assignment. Adds a version counter (app_settings row storage.config_version) bumped inside the same transaction by both writers — applyConfig and the migration flip (assignCategory). applyConfig compares the submitted version first and throws StorageConflictError, mapped to 409 ahead of the blanket 400. The client carries the draft's loaded version through every local edit and maps a 409 to a distinct "settings changed underneath you" message, refreshing state while preserving the dirty draft for review. * fix(storage): surface a failed config load + redact secretAccessKey Registry load() now records the exact parse/validate failure as lastLoadError() instead of silently falling back to last-good config or built-in defaults; StorageAdminService exposes it as configError on the admin state (storageAdminStateSchema extended additively), and AdminStoragePanel renders it as a warning banner naming the error. Save stays enabled — it's the recovery path — but an admin can no longer save over a broken stored config without knowing. Also adds 'secretaccesskey' to globalMiddleware's SENSITIVE_KEYS request-log redaction list, so storage admin PUT bodies never leak the S3 secret into debug logs. * fix(client): admin storage panel state races Migration prompt now recomputes computeMigrationCandidates(draft, state) on render and again at confirm time, so a stale open-time snapshot never drives stripCategories or the migration queue; adds a Cancel button to the dialog. A failed startMigration POST explicitly clears the remaining queue with a toast naming the dropped categories and refreshes state, instead of leaving it invisibly stranded; a "Queued: X, Y" line renders while the queue is non-empty. Testing a mirrored row now expands the draft primary + replicas client-side and probes each individually, instead of sending the mirror stub to the server (which resolved targets from its own live snapshot, silently testing saved options over unsaved draft edits). A completed/cancelled/errored backfill now renders its terminal status alongside the Sync now button instead of hiding it, so it can be re-run without a page reload. * fix(storage): refuse shared replica backends so the sync sweep cannot cross categories A mirror's "Sync now" sweep makes each replica MATCH the primary: it lists the replica under every prefix the mirror's categories occupy and deletes the keys the primary doesn't hold. The backups category's prefix is '' — the replica's entire root — so making a category-serving backend (say uploads-local) a replica of a backups mirror meant the first sync deleted every user upload. Nothing forbade the config: validateConfig only checked that mirror targets existed and weren't nested, and the admin picker offered every backend. The sweep is correct, so the fix is at the config level: - validateConfig refuses a backend that is both a mirror replica and a category target (directly, or as the primary of a mirror a category routes to), and refuses a backend replicating two mirrors whose swept prefixes overlap — '' overlaps everything. Disjoint prefixes stay legal. - assignCategory (the migration flip, the other writer of the settings rows) refuses routing a category onto a backend that is currently a replica. - The admin mirror-target picker (both shells) only offers backends that serve no category; already-selected targets stay listed so they can be unchecked. A category assigned to a replica still surfaces the server's 400 verbatim. Existing shared-replica fixtures were rewritten onto dedicated replicas. * fix(client): a 409 conflict save is recoverable without a page reload After a 409 the admin storage panel was a dead end. refreshState leaves a dirty draft's version alone on purpose (audit #7: the background poll must never float a mid-edit draft past a migration flip it never carried), setDraft re-attaches that same version to every later edit, and save() resubmits it — so every retry 409s again and only a full page reload got the operator out, while the banner told them to "review and save again". The version block stays. Instead the conflict banner now offers the one action that can clear it: discard the local edits and reload the saved settings — a fresh GET applied through applyState, re-deriving the draft (and its version) and clearing dirty/saveError. Bumping the version in refreshState, or only in the 409 branch, was rejected: either resurrects audit #7, since a full-document save would then revert a flip the draft never carried. storage.saveConflict now points at that action instead of implying a plain re-save works (all 23 locales). The escape lives in the shared hook, so the phone panel renders it too. * fix(client): deflake the queued-migration-waits-out-backfill panel test FE-ADMIN-STOR-037 seeds a running backfill, so the panel polls GET from first render — but the stub served the post-save world (files: off-box) before the PUT had landed, which no real server would do. A poll resolving while the confirm dialog was open made the confirm-time candidate recompute see from === to, so nothing was queued and the migration never POSTed. The GET stub now stays faithful (pre-save world until the PUT lands, usage included so candidates keep their object counts), and the test deterministically forces the once-flaky interleaving: it waits for polls to land while the dialog is open and asserts the candidate survives them. * fix(storage): surface the underlying cause in probe target errors The admin storage Test probe reported only the driver wrapper's outer message ("put failed for '…' on 'probe-s3'"), dropping the cause that says WHY — connection refused vs missing bucket. Flatten the error's cause chain into the probe result, appending an S3-style code when it isn't already in the message. * fix(storage): surface the underlying cause in replica-failure reports Same defect as the probe fix, one layer over: MirrorDriver's reportReplicaFailure captured only the wrapper's message, so replica-failure notifications said "put failed" without the why. Move the probe's cause-chain flattener into storage.types.ts as describeError and use it in both call sites. * fix(storage): strip ContentType from multipart Upload calls (MalformedXML) Every multipart S3 put carrying a contentType — every backup zip and photo over the 10MB threshold — failed with 400 MalformedXML. Upstream @aws-lite/s3's Upload leaks the ContentType param into its final CompleteMultipartUpload headers ({ ...xml, ...paramHeaders }), clobbering application/xml, which flips @aws-lite/client's payload serializer to JSON — so the server receives a JSON parts list where XML belongs. Confirmed live against MinIO AIStor; any S3 refuses the same. uploadMonitored now drops ContentType before s3.Upload. Multipart objects are stored without a content-type, which TREK never reads back (serving derives Content-Type from the key/caller, never object metadata); single-request PutObject paths keep sending it. Also closes the coverage gap that let this ship: the live contract suite never crossed MULTIPART_THRESHOLD, so s3.Upload had never run against a real server — it now round-trips a >10MB put carrying a contentType. --------- Co-authored-by: Maurice <mauriceboe@icloud.com>	2026-08-22 11:33:55 +02:00
jubnl	079064fdcd	refactor(server): delete trips.bridge via leaf membership reads and prompt relocation	2026-08-11 20:28:49 +02:00
Maurice	294cfcd8d7	Move the addon-gated domains onto the decorators ... collab, journal, atlas, vacay and collections: 32 more methods, so the registry owns 93 of 113. rpc-host.ts is at 565 lines, down from 1332, and the deps factory at 384, down from 944. These five are the risky group, because their addon gates lived inside the deps factory's closure rather than in the router. A handler that calls its service directly still works, just without the check, and neither the compiler nor the router tests would notice. So addon-gates.rpc.test.ts walks all 37 gated methods as one table and asserts two things for each: with the addon off it is refused with that addon's message, and the service is never reached. The table length is pinned, so a later method added without a row is a failure rather than a silent gap. One ordering detail worth knowing: on the atlas writes the router evaluated its params before the addon gate inside the closure, so a malformed country code still reports BAD_PARAMS rather than the addon. The handlers keep that order. The collections service reports refusals as status-tagged errors rather than typed ones, so mapCollectionError came across with the handlers: 403 and 404 become RESOURCE_FORBIDDEN, 400 and 409 become BAD_PARAMS, and anything untagged stays a HOST_ERROR instead of being dressed up as a permission problem.	2026-08-09 16:38:43 +02:00