Spaces:
Sleeping
Sleeping
| import { createHmac, hkdfSync, timingSafeEqual } from "node:crypto"; | |
| import { | |
| constants, | |
| copyFile, | |
| mkdir, | |
| readFile, | |
| rm, | |
| stat, | |
| writeFile, | |
| } from "node:fs/promises"; | |
| import { join } from "node:path"; | |
| import { backup, DatabaseSync } from "node:sqlite"; | |
| import type { Clock } from "../kernel/clock.js"; | |
| import { | |
| canonicalizeJson, | |
| sha256Hex, | |
| type JsonValue, | |
| } from "../kernel/canonical-json.js"; | |
| import type { IdGenerator } from "../kernel/id-generator.js"; | |
| const BACKUP_HKDF_CONTEXT = "oloka/backup-manifest/v1"; | |
| export interface BackupManifest { | |
| manifestVersion: 1; | |
| createdAt: number; | |
| sourceSchemaVersion: number; | |
| targetSchemaVersion: number; | |
| appBuildSha: string; | |
| databaseFilename: "database.sqlite"; | |
| databaseSizeBytes: number; | |
| databaseChecksumSha256: string; | |
| migrationVersionsPending: number[]; | |
| objectManifestVersion: 1; | |
| objects: []; | |
| keyVersion: 1; | |
| } | |
| export interface CreateBackupOptions { | |
| database: DatabaseSync; | |
| backupRoot: string; | |
| applicationKey: Uint8Array; | |
| appBuildSha: string; | |
| clock: Clock; | |
| idGenerator: IdGenerator; | |
| sourceSchemaVersion: number; | |
| targetSchemaVersion: number; | |
| migrationVersionsPending: number[]; | |
| } | |
| export async function createPreMigrationBackup( | |
| options: CreateBackupOptions, | |
| ): Promise<string> { | |
| if (options.applicationKey.length !== 32) { | |
| throw new Error("Application key must contain exactly 32 bytes"); | |
| } | |
| const parentDirectory = join(options.backupRoot, "pre-migration"); | |
| const backupDirectory = join(parentDirectory, options.idGenerator.generate()); | |
| await mkdir(parentDirectory, { recursive: true }); | |
| await mkdir(backupDirectory, { recursive: false }); | |
| try { | |
| const databaseFilename = "database.sqlite"; | |
| const databasePath = join(backupDirectory, databaseFilename); | |
| await backup(options.database, databasePath); | |
| const bytes = await readFile(databasePath); | |
| const manifest: BackupManifest = { | |
| manifestVersion: 1, | |
| createdAt: options.clock.now(), | |
| sourceSchemaVersion: options.sourceSchemaVersion, | |
| targetSchemaVersion: options.targetSchemaVersion, | |
| appBuildSha: options.appBuildSha, | |
| databaseFilename, | |
| databaseSizeBytes: bytes.length, | |
| databaseChecksumSha256: sha256Hex(bytes), | |
| migrationVersionsPending: [...options.migrationVersionsPending], | |
| objectManifestVersion: 1, | |
| objects: [], | |
| keyVersion: 1, | |
| }; | |
| const canonicalManifest = canonicalizeJson( | |
| manifest as unknown as JsonValue, | |
| ); | |
| const signature = signManifest(canonicalManifest, options.applicationKey); | |
| await writeFile(join(backupDirectory, "manifest.json"), canonicalManifest, { | |
| encoding: "utf8", | |
| flag: "wx", | |
| }); | |
| await writeFile(join(backupDirectory, "manifest.hmac"), signature, { | |
| encoding: "utf8", | |
| flag: "wx", | |
| }); | |
| await verifyBackupDirectory(backupDirectory, options.applicationKey); | |
| return backupDirectory; | |
| } catch (error) { | |
| await rm(backupDirectory, { recursive: true, force: true }); | |
| throw error; | |
| } | |
| } | |
| export async function verifyBackupDirectory( | |
| backupDirectory: string, | |
| applicationKey: Uint8Array, | |
| ): Promise<BackupManifest> { | |
| const manifestBytes = await readFile(join(backupDirectory, "manifest.json")); | |
| const manifestText = manifestBytes.toString("utf8"); | |
| const parsed = JSON.parse(manifestText) as BackupManifest; | |
| if (canonicalizeJson(parsed as unknown as JsonValue) !== manifestText) { | |
| throw new Error("Backup manifest is not canonical JSON"); | |
| } | |
| assertManifestShape(parsed); | |
| const expectedSignature = signManifest(manifestText, applicationKey); | |
| const actualSignature = ( | |
| await readFile(join(backupDirectory, "manifest.hmac"), "utf8") | |
| ).trim(); | |
| const expectedBytes = Buffer.from(expectedSignature, "hex"); | |
| const actualBytes = Buffer.from(actualSignature, "hex"); | |
| if ( | |
| expectedBytes.length !== actualBytes.length || | |
| !timingSafeEqual(expectedBytes, actualBytes) | |
| ) { | |
| throw new Error("Backup manifest authentication failed"); | |
| } | |
| const databasePath = join(backupDirectory, parsed.databaseFilename); | |
| const databaseDetails = await stat(databasePath); | |
| const databaseBytes = await readFile(databasePath); | |
| if ( | |
| databaseDetails.size !== parsed.databaseSizeBytes || | |
| sha256Hex(databaseBytes) !== parsed.databaseChecksumSha256 | |
| ) { | |
| throw new Error("Backup database checksum verification failed"); | |
| } | |
| const database = new DatabaseSync(databasePath, { readOnly: true }); | |
| try { | |
| const quickCheck = database.prepare("PRAGMA quick_check").get() as | |
| | Record<string, string> | |
| | undefined; | |
| if (quickCheck === undefined || Object.values(quickCheck)[0] !== "ok") { | |
| throw new Error("Backup database quick_check failed"); | |
| } | |
| if (database.prepare("PRAGMA foreign_key_check").all().length > 0) { | |
| throw new Error("Backup database foreign_key_check failed"); | |
| } | |
| } finally { | |
| database.close(); | |
| } | |
| return parsed; | |
| } | |
| export async function restoreVerifiedBackup( | |
| backupDirectory: string, | |
| destinationDatabasePath: string, | |
| applicationKey: Uint8Array, | |
| ): Promise<void> { | |
| const manifest = await verifyBackupDirectory(backupDirectory, applicationKey); | |
| await mkdir(join(destinationDatabasePath, ".."), { recursive: true }); | |
| await copyFile( | |
| join(backupDirectory, manifest.databaseFilename), | |
| destinationDatabasePath, | |
| constants.COPYFILE_EXCL, | |
| ); | |
| const restored = new DatabaseSync(destinationDatabasePath, { | |
| readOnly: true, | |
| }); | |
| try { | |
| const result = restored.prepare("PRAGMA quick_check").get() as Record< | |
| string, | |
| string | |
| >; | |
| if (Object.values(result)[0] !== "ok") { | |
| throw new Error("Restored database quick_check failed"); | |
| } | |
| } catch (error) { | |
| restored.close(); | |
| await rm(destinationDatabasePath, { force: true }); | |
| throw error; | |
| } | |
| restored.close(); | |
| } | |
| function signManifest(manifest: string, applicationKey: Uint8Array): string { | |
| const derivedKey = Buffer.from( | |
| hkdfSync( | |
| "sha256", | |
| applicationKey, | |
| new Uint8Array(), | |
| BACKUP_HKDF_CONTEXT, | |
| 32, | |
| ), | |
| ); | |
| return createHmac("sha256", derivedKey) | |
| .update(manifest, "utf8") | |
| .digest("hex"); | |
| } | |
| function assertManifestShape(value: BackupManifest): void { | |
| if ( | |
| value.manifestVersion !== 1 || | |
| value.objectManifestVersion !== 1 || | |
| value.keyVersion !== 1 || | |
| value.databaseFilename !== "database.sqlite" || | |
| value.objects.length !== 0 || | |
| !Array.isArray(value.migrationVersionsPending) || | |
| !Number.isSafeInteger(value.createdAt) || | |
| !Number.isSafeInteger(value.databaseSizeBytes) || | |
| !/^[0-9a-f]{64}$/.test(value.databaseChecksumSha256) | |
| ) { | |
| throw new Error("Backup manifest shape is invalid"); | |
| } | |
| } | |