dorfteich/apps/backup/src/settings.test.ts

import { describe, expect, it } from 'vitest';

import { parseCommand } from './commands.js';
import { resolveRemoteTarget } from './remote.js';
import { parseBackupSettings } from './settings.js';

describe('parseBackupSettings', () => {
  it('returns pure defaults for a database without the keys', () => {
    expect(parseBackupSettings([])).toEqual({
      localRetentionDays: null,
      remoteRetentionDays: 30,
      nextcloud: {
        enabled: false,
        baseUrl: '',
        username: '',
        folder: 'dorfteich-backups',
        uploadSchedule: 'daily',
      },
    });
  });

  it('applies stored rows and falls back per key on invalid values', () => {
    const settings = parseBackupSettings([
      { key: 'backup.localRetentionDays', value: 14 },
      { key: 'backup.remoteRetentionDays', value: 'not-a-number' },
      { key: 'backup.nextcloud.enabled', value: true },
      { key: 'backup.nextcloud.baseUrl', value: 'https://cloud.example.com' },
      { key: 'backup.nextcloud.username', value: 'backupuser' },
      { key: 'backup.nextcloud.uploadSchedule', value: 'weekly' },
    ]);
    expect(settings.localRetentionDays).toBe(14);
    expect(settings.remoteRetentionDays).toBe(30);
    expect(settings.nextcloud).toMatchObject({
      enabled: true,
      baseUrl: 'https://cloud.example.com',
      username: 'backupuser',
      uploadSchedule: 'weekly',
    });
  });
});

describe('resolveRemoteTarget', () => {
  const settings = parseBackupSettings([
    { key: 'backup.nextcloud.enabled', value: true },
    { key: 'backup.nextcloud.baseUrl', value: 'https://cloud.example.com' },
    { key: 'backup.nextcloud.username', value: 'backupuser' },
  ]);

  const allowlist = ['cloud.example.com'];

  it('combines settings with the secret-store app password', () => {
    expect(
      resolveRemoteTarget(settings, { BACKUP_NEXTCLOUD_PASSWORD: 'app-pass' }, allowlist),
    ).toEqual({
      baseUrl: 'https://cloud.example.com',
      username: 'backupuser',
      password: 'app-pass',
      folder: 'dorfteich-backups',
    });
  });

  it('is null when disabled or incompletely configured', () => {
    expect(resolveRemoteTarget(settings, {}, allowlist)).toBeNull();
    expect(
      resolveRemoteTarget(
        parseBackupSettings([]),
        { BACKUP_NEXTCLOUD_PASSWORD: 'app-pass' },
        allowlist,
      ),
    ).toBeNull();
  });

  it('is null when the configured host is outside the deploy allowlist (issue #192)', () => {
    const secrets = { BACKUP_NEXTCLOUD_PASSWORD: 'app-pass' };
    expect(resolveRemoteTarget(settings, secrets, ['other.host'])).toBeNull();
    // The empty allowlist disables the WebDAV target outright.
    expect(resolveRemoteTarget(settings, secrets, [])).toBeNull();
  });
});

describe('parseCommand', () => {
  it('parses run and restore commands', () => {
    expect(parseCommand('{"kind":"run","requestedBy":"admin"}')).toEqual({
      kind: 'run',
      requestedBy: 'admin',
    });
    expect(
      parseCommand('{"kind":"restore","source":"remote","backupId":"20260712-030000"}'),
    ).toEqual({
      kind: 'restore',
      source: 'remote',
      backupId: '20260712-030000',
      requestedBy: null,
    });
  });

  it('rejects malformed payloads and bad backup ids', () => {
    expect(parseCommand('not json')).toBeNull();
    expect(parseCommand('{"kind":"nuke"}')).toBeNull();
    expect(
      parseCommand('{"kind":"restore","source":"remote","backupId":"../../etc/passwd"}'),
    ).toBeNull();
    expect(
      parseCommand('{"kind":"restore","source":"elsewhere","backupId":"20260712-030000"}'),
    ).toBeNull();
  });
});