Backups: write-only off-site credentials, redaction that doesn't depend on rclone's wording, and the audio archive's path #795

New issue

Closed

opened 2026-09-24 01:57:15 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-09-24 01:57:15 +00:00

Collaborator

Follow-ups from #790 (#753), which fixed the read-back and two worse bugs. Owner, 2026-09-24 (R3): lane 9 builds this (#735), server change first, as the build plan says, since lane 9 rebuilds the admin backups surface anyway.

1. Off-site credentials go back to the browser

GET /api/admin/backup/config returns the raw remote so the admin form can round-trip it. If the remote carries inline credentials (:s3,access_key_id=…,secret_access_key=…:bucket, or a named remote with parameters), they reach the admin's browser on every load.

Fix: make them write-only, as the per-campaign AI keys already are.

The read returns the remote with its parameter block redacted, plus a credentials_set flag.
A save that leaves the redacted form untouched keeps what's stored.
"Remove it" clears it.

backup_offsite_service.redact_remote (fixed in #790) already produces the redacted form.

2. Redaction depends on rclone repeating the remote verbatim

_redact_text scrubs the remote from rclone's output only when rclone echoes it exactly as configured. If rclone prints the parameters split up, re-quoted or reordered, they get through into the log row and error text.

Fix: redact by known secret values as well as by the remote's shape. Pull each parameter value out of the configured remote, and scrub any occurrence of any of them from whatever rclone printed. Test it with an rclone error message that quotes a parameter on its own.

3. The log doesn't record where the audio archive went

A backup row records the dump's local path (and, since #790, the remote). The audio archive written alongside it can only be found by deriving its name from the dump's timestamp. A restore helper, or ADMIN-14's instance health, would have to know that.

Fix: record the archive's path on the row too (a column and a migration), and read it back the way verify reads the dump.

None of this is urgent. Only an admin sees the form, and the admin typed the credentials. But (1) and (2) are credential hygiene and belong in the rebuild rather than after it.

🤖 Generated with Claude Code

Follow-ups from #790 (#753), which fixed the read-back and two worse bugs. **Owner, 2026-09-24 (R3): lane 9 builds this** (#735), server change first, as the build plan says, since lane 9 rebuilds the admin backups surface anyway. ### 1. Off-site credentials go back to the browser `GET /api/admin/backup/config` returns the raw `remote` so the admin form can round-trip it. If the remote carries **inline credentials** (`:s3,access_key_id=…,secret_access_key=…:bucket`, or a named remote with parameters), they reach the admin's browser on every load. **Fix:** make them **write-only**, as the per-campaign AI keys already are. - The read returns the remote with its parameter block redacted, plus a `credentials_set` flag. - A save that leaves the redacted form untouched keeps what's stored. - "Remove it" clears it. `backup_offsite_service.redact_remote` (fixed in #790) already produces the redacted form. ### 2. Redaction depends on rclone repeating the remote verbatim `_redact_text` scrubs the remote from rclone's output only when rclone echoes it exactly as configured. If rclone prints the parameters split up, re-quoted or reordered, they get through into the log row and error text. **Fix:** redact by **known secret values** as well as by the remote's shape. Pull each parameter value out of the configured remote, and scrub any occurrence of any of them from whatever rclone printed. Test it with an rclone error message that quotes a parameter on its own. ### 3. The log doesn't record where the audio archive went A backup row records the dump's local path (and, since #790, the remote). The audio archive written alongside it can only be found by deriving its name from the dump's timestamp. A restore helper, or ADMIN-14's instance health, would have to know that. **Fix:** record the archive's path on the row too (a column and a migration), and read it back the way verify reads the dump. None of this is urgent. Only an admin sees the form, and the admin typed the credentials. But (1) and (2) are credential hygiene and belong in the rebuild rather than after it. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot referenced this issue

2026-09-24 01:57:27 +00:00

Build lane 9: Admin (ADMIN-1 to ADMIN-15) #735

claude-bot referenced this issue

2026-09-26 15:54:24 +00:00

Build lane 9: Admin (ADMIN-1 to ADMIN-15) #735

rbrooks referenced this issue from a commit

2026-09-26 16:31:43 +00:00

feat(webapp): backups audit — write-only credentials, value redaction, archive path (#795, lane 9 PR C)

claude-bot referenced this issue from a pull request that will close it,

2026-09-26 16:31:56 +00:00

feat(webapp): backup credentials write-only, redaction by value, the audio archive's path, and the missing audit events (#795, lane 9 C) #848

claude-bot closed this issue

2026-09-26 17:15:14 +00:00

claude-bot referenced this issue from a commit

2026-09-26 17:15:15 +00:00

Merge PR #848: backup credentials write-only, redaction by value, the audio archive's path, and the missing audit events (#795, lane 9 C)

rbrooks referenced this issue from a commit

2026-09-26 17:21:11 +00:00

Merge origin/main into lane 9 B1; re-chain c4e6a8b0d2f1 onto a2c4e6f8b0d1 (#795)

claude-bot commented

2026-09-26 17:22:05 +00:00

Author

Collaborator

Done in #848, merged 2026-09-26.

The backup destination's credentials are write-only. The read returns the destination (remote) redacted, plus credentials_set. Sending the redacted form back unchanged keeps the stored credentials, and "" clears them. The config's audit event carries no destination value.
rclone output is redacted by value. Every configured parameter value longer than 4 characters is scrubbed wherever it appears, as well as by the destination's shape.
Each backup row records its audio archive's path. Migration a2c4e6f8b0d1 adds backup_logs.audio_archive_path. Verify reads the archive back from that path, or from a path derived from the dump's name for older rows, with the same containment check the dump gets.

Uploaded images in the backup (IS-396) wait for the owner's lane 9 A6.

Done in #848, merged 2026-09-26. 1. **The backup destination's credentials are write-only.** The read returns the destination (`remote`) redacted, plus `credentials_set`. Sending the redacted form back unchanged keeps the stored credentials, and `""` clears them. The config's audit event carries no destination value. 2. **rclone output is redacted by value.** Every configured parameter value longer than 4 characters is scrubbed wherever it appears, as well as by the destination's shape. 3. **Each backup row records its audio archive's path.** Migration `a2c4e6f8b0d1` adds `backup_logs.audio_archive_path`. Verify reads the archive back from that path, or from a path derived from the dump's name for older rows, with the same containment check the dump gets. Uploaded images in the backup (IS-396) wait for the owner's lane 9 A6.

claude-bot referenced this issue

2026-09-26 17:58:26 +00:00

Build lane 9: Admin (ADMIN-1 to ADMIN-15) #735