Skip to content

feat: account data export and users.db backup - #2141

Merged
efiten merged 76 commits into
Kpa-clawbot:masterfrom
efiten:feat/account-export-backup
Oct 8, 2026
Merged

feat: account data export and users.db backup#2141
efiten merged 76 commits into
Kpa-clawbot:masterfrom
efiten:feat/account-export-backup

Conversation

@efiten

@efiten efiten commented Oct 8, 2026

Copy link
Copy Markdown
Collaborator

A small follow-up to parts A to E of #2128: users can download all data the instance holds about them, and the server backs up users.db.

Stacked on #2140. Review the commits after that branch.

The situation

  • An instance with accounts holds personal data, but a user has no way to get a copy (GDPR articles 15 and 20). Self-delete already exists.
  • users.db is the only file the server writes, and nothing backs it up: GET /api/backup snapshots the analyzer database only.

What this PR adds

Data export. GET /api/account/export and a "Download my data" button on the account page give one JSON file with:

  • the profile, including activation and a pending email change;
  • sessions (times and user agent);
  • synced settings, own proposals, notification prefs and watches;
  • audit rows where the user is actor or target, with other accounts as an id only;
  • the mail log.

Password hash, session and link tokens and the unsubscribe token are left out: they are credentials. Each export is audited as user.export.

users.db backup

  • Daily VACUUM INTO snapshots through internal/users, on by default when user management is on. They go to backups/ next to users.db, the 7 newest are kept, the directory is 0700 and the files 0600. Rotation only touches users-<timestamp>.db files and never the snapshot it just wrote. Config: userManagement.backup {enabled, dir, keep}.
  • GET /api/admin/users-backup: an admin downloads a fresh snapshot to keep off the server; audited as user.backup.
  • docs/user-guide/accounts.md gains a restore procedure. It covers what a restore brings back (accounts deleted after the snapshot, old passwords, revoked sessions) and how to clean that up afterwards.

Spec: docs/specs/2026-10-08-account-export-and-users-backup-design.md.

Verification

  • internal/users with -race and the cmd/server suite pass locally, 30 new Go tests. The file-mode tests skip on Windows.
  • sh test-all.sh exits 0; the XSS gate in diff mode passes.
  • User-management E2E: 27 of 27 steps locally.
  • On our production instance since 8 October 2026; the first snapshot there was 143 kB.

Not in this PR

  • Importing an export into another instance.
  • Off-site upload of the snapshots. The admin download covers that by hand.

efiten and others added 30 commits October 7, 2026 12:00
@efiten @claude
docs(specs): admin dashboard for optional user management (sub-projec…
9ae870e 
…t C)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
docs(specs): admin dashboard amendments from the implementation plan
e5971e8 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): global audit list with keyset paging, login-row pruning,…
dd3bc4d 
… schema v3

AuditList filters by action (exact or a ".*" group), user as actor or
target, and an inclusive period, newest first, keyset-paginated on id
(default 100, at most 500). PruneAudit deletes rows of the listed actions
older than an age and keeps every other action. UsersByID resolves the
users of a page in one query. Schema v3 adds an index on audit_log(at).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): Stats for the admin overview
ca25630 
Account counts by status, active admins, stuck pending accounts (older
than 24 hours), bouncing addresses, registrations over 7 and 30 days and
per UTC day for 30 days (from user.register audit rows), active users,
logins and failed logins in 24 hours, mail of the last 7 days by latest
delivery event, and accounts with 5 or more failed logins in 24 hours.
Thresholds are constants for now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): audit logins, keep login rows 90 days
32a8a11 
A successful login writes user.login; a refused login for an existing
account writes user.login.failed with reason wrong_password, pending or
disabled. An unknown address writes nothing and no IP is stored. The
audit write follows the decided answer and a failure is only logged, so
every failure answer stays identical. The hourly janitor deletes login
rows older than 90 days and keeps all other actions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): GET /api/admin/audit, the global audit log
3a8341d 
Admin-only and registered only with user management on. Filters by
action or a ".*" group, user as actor or target, and an RFC 3339
period; keyset-paginated with next/before, default 100, capped at 500.
Actor and target are resolved in one query, a removed account becomes
{id, deleted: true}. Invalid parameters answer 400.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): GET /api/admin/stats for the admin overview
41617f9 
Admin-only and registered only with user management on. Serves the
users.Stats figures as a typed struct; newPerDay always holds 30 days
and guessing is always an array.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(users): write login audit rows in the background
4e4758a 
The login audit INSERT ran before the buffered answer reached the client,
so a refusal for an existing account took one extra SQLite commit (up to
the 5 s busy timeout on a locked users.db) that an unknown address never
paid: a timing signal for account existence. user.login and
user.login.failed are now written by auditAsync after the answer is
decided, best-effort, tracked by a WaitGroup that closeUserManagement
drains after stopping the janitor. Response bytes, session creation,
rate limiting and the dummy hash are unchanged. Spec amendment 7 now
says so, including that a row can be lost if the process stops right
after a login.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(admin): audit tab module
e3f0114 
Filters (action or group, period, numeric user id) live in the hash and
are validated on read; filter changes use replaceState. Rows are rendered
newest first, Load more appends the next keyset page and hides at the
end. Account names link to the Users tab. Not reachable yet: the admin
shell mounts it in a later commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(admin): audit tab clears its message and stale rows on filter change
98286a5 
load() clears auditMsg first. A filter change drops the paging cursor,
hides Load more and empties the table before the new request, so a click
cannot mix pages and a failed request leaves no rows of the old filter.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(admin): overview tab module
a63e37d 
Needs attention (stuck activations, bouncing mail, password guessing,
MQTT sources down for 10 minutes or never heard), the Users card from
/api/admin/stats with a 30-day registrations chart, and the System card
composed from /api/health, /api/healthz, /api/mqtt/status and
/api/observers. A failing source shows Could not load in its own block;
healthz 503 while warming up is shown as warming up. Refreshes every
60 s while the browser tab is visible; the timer skips /api/healthz,
which is read on open and on Refresh only. Not reachable yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(admin): admin area with Overview, Users and Audit tabs
ed6c634 
Page admin is now a tab shell at #/admin?tab=overview|users|audit; the
user table becomes the Users tab and gains a Bouncing mail only filter.
Old #/admin/users links are rewritten to the Users tab with
replaceState, filters and detail id kept. The account menu entry and
the account page button read Admin. Non-admins see Admins only; with
the feature off the page stays Not found. The shell unmounts the
active tab on every init and on destroy, and an init whose auth check
resolves after the page was left mounts nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
test(e2e): admin overview, audit tab, legacy users link and axe
28e53cd 
An admin sees the user figures and a five-attempt failed-login burst
under Needs attention, follows it to the audit tab and finds the row.
The old #/admin/users link lands on the Users tab with its filter. Axe
runs on all three admin tabs. Menu assertions now look for Admin.

The axe steps park the mouse at 0,0 first: a hovered row tints its
cells to the row-hover colour, where the active status text is 4.48:1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(admin): AA contrast for green status text on the hovered row
aa59a7b 
Green status words in the user and admin tables used --status-green-text
(green-700 #15803d), which is 4.48:1 on the row-hover tint #eef2ff. A
scoped token --status-green-tint-text (light green-800 #166534, dark
keeps #22c55e in both dark blocks) now colours them: measured 6.38:1 on
#eef2ff, 6.54:1 on --surface-0 in light, 5.75:1 on #2d2d50 in dark.
The global --status-green-text is unchanged.

The token is mapped in the customizer THEME_CSS_MAP. The contrast unit
test gains the hovered-row pairs for green, yellow and red, and the E2E
mouse-park comment now says parking only avoids hover noise.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(admin): audit user filter accepts only account ids from 1 up
996a2b4 
The audit tab accepted /^\d+$/ for the user id, so user=0 in the hash
reached the server and came back as a 400 message instead of being
ignored like other invalid URL filters. Both the hash reader and the
user id input now accept /^[1-9]\d*$/: user=0 and leading zeros such
as 007 are ignored in the hash and rejected in the input (the previous
value is restored, no reload).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(admin): Users tab search debounce does nothing after unmount
c922edc 
The 250 ms debounced search read #umQ without a guard, so typing and
then switching to another admin tab within 250 ms threw a TypeError
when the timer fired. The callback now carries a mount token: it
returns when the tab was unmounted or remounted since, or when #umQ is
gone. Two unit tests cover type then unmount (no throw, no request, hash
untouched) and a stale timer from a previous mount.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(admin): one full overview refresh at a time
a0cb653 
Every Refresh or Retry click started a full refresh including
/api/healthz, which walks the packet store under its read lock, so
repeated clicks queued repeated walks. Open, Refresh and Retry now go
through one guard: while a full refresh is in flight further clicks are
ignored and the Refresh button is disabled until it settles. The
60-second timer is unchanged (it never reads /api/healthz).

Unit test: clicks during the mount refresh start nothing, the button is
disabled then re-enabled, and two rapid clicks make one /api/healthz
request.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
docs(admin): amendment 7 names the single-connection timing residual
bc2e8e6 
The amendment said neither the audit write nor a locked users.db
changes response timing. That holds for the login response itself, but
users.db uses one connection (internal/users/store.go SetMaxOpenConns(1)),
so the background INSERT can delay the next users.db request by one
commit. The text now says so, and that the login rate limits (10 per
15 minutes per address, and per IP when IPs can be told apart) keep it
from being a useful signal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(admin): filter bouncing addresses on the server
59c988a 
The Users tab applied bouncing=1 in the browser to the list the server
returns, which is capped at 1000 rows, so on a large instance it could
show fewer users than the overview's bouncing count. users.ListFilter
gains Bouncing (email_bouncing != 0, combined with the other filters),
GET /api/admin/users accepts bouncing=1 (any other value is 400, like
the status and role filters), and the Users tab sends it instead of
filtering client-side. OpenAPI and docs/api-spec.md describe the
parameter.

Tests: internal/users List with Bouncing alone and with Role,
cmd/server bouncing=1 rows and 400 for 0/yes/true, UI request carries
bouncing=1 and the browser no longer drops rows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
docs(specs): proposals and approved hashtag channels (sub-project D)
48f5e09 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(channel): hashtag channel name rules
c8a39f2 
ValidateHashtagName: 31-byte firmware limit, no invisible or control
characters except ZWJ, case preserved, Public refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): proposals table and state machine (schema v4)
dc22e11 
One generic proposals table, kind hashtag_channel. Propose, Decide,
ListProposals, ProposalsByUser, ApprovedSubjects, PruneProposals; limits
are checked inside the state-change transaction.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(server): channel proposal routes behind userManagement.channelPr…
f61895d 
…oposals

POST /api/proposals, GET /api/account/proposals, GET /api/admin/proposals
and approve/reject/revoke, audited as proposal.*; the janitor prunes
decisions after 90 days. Off by default: no routes registered.

A name config.json already decrypts (hashChannels, channelKeys) is
refused with 409; the server reads channelKeys for its names only and
drops the key values. Every decision reloads the approved-name snapshot
from users.db under a mutex.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(server): ignore a non-object channelKeys instead of failing confi…
0155430 
…g load

LoadConfig falls back to pure defaults on any parse error, so the
names-only channelKeys type made a string or array value start the
server without apiKey or userManagement. It now logs and keeps no names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(server): list approved hashtag channels in /api/channels
947ac9c 
approvedChannels from an in-memory snapshot refreshed on approve and
revoke, capped at maxApproved like the ingestor; client config gains
userManagement.channelProposals. Absent when the feature is off.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(ingestor): decrypt approved hashtag channels from users.db
9467fbf 
Reads users.db read-only once a minute, re-validates every name, merges
below the configured keys and swaps the key map atomically; a failed read
keeps the last good set. Off by default.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(ui): channel proposals module and My proposals
fe8e34a 
window.CSProposals mirrors the hashtag name rules, posts proposals,
merges approved channels into the channel list, and renders the account
page's My proposals. Inert unless the server advertises the feature.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(channels): propose for everyone, approved channels in the list
7a5b932 
The Add Channel dialog gains Propose for everyone; approved hashtag
channels are listed with an approved marker, also without traffic.
Channel names are now escaped in row data attributes and in the
timestamp timer's selectors, since approved names may contain quotes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(admin): Proposals tab
09cef5a 
Approve, reject or revoke proposed hashtag channels with an optional
note; approving asks first because the channel becomes readable for every
visitor. Shown only with channel proposals on; deep link
#/admin?tab=proposals&status=. The audit filter gains proposal.*.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(admin): guard proposal decisions against double submit and stale …
610340c 
…rows

A decision in flight ignores a second click on the same row and disables
its buttons until it settles. A refused decision (for example another admin
decided first) reloads the list and keeps the error message.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
efiten and others added 27 commits October 7, 2026 22:28
@efiten @claude
fix(notify): wait for the whole startup load before the first check
1e08be8 
readiness is set before the background fill of the packet store ends, so
a first check could see a partial store and mail "offline" and then
"back online". ready() now also requires StartupLoadDone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(notify): strip control and bidi characters from names in mails
82b3aeb 
Node names are chosen by node owners, observer names come from MQTT
status payloads, and a line break in one forged a separate line in the
plain-text part. One sanitiser (mailSafeText) turns control characters
and bidi overrides/isolates into a space, collapses runs and trims; the
evaluator applies it to node and observer names and render to every
mail line, so both parts get the same text.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(notify): default maxMailsPerDay to 100
3775359 
The limit counts notification mail only, and 300 was Brevo's whole free
daily quota: on a day notifications reached it, activation, reset and
address-change mail would fail at the provider. 100 leaves room for
them; the docs and config example say why.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
refactor(notify): one DefaultNotifyPrefs constructor
3ccb525 
The evaluator, the notifier and NotifyPrefsFor each spelled out the
default preferences (on, node events); they must agree, so they now
share users.DefaultNotifyPrefs. It copies NodeNotifyEvents, so a caller
cannot change the package default.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(notify): stop mailing once the server shuts down
4bfa373 
After the loop context was cancelled, deliver kept going and logged one
failed send per remaining user. It now stops at the next user and logs
how many were not mailed; their changes are already stored.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(notify): pause offline checks while ingest is stale
1b1148c 
An MQTT or ingestor outage longer than a role's silent window made every
watched node look offline, so every watcher got an "offline" mail and
later a "back online" one. When the newest packet in the store is older
than 30 minutes (read from the tail of the sorted packet slice, O(1)),
the evaluator now skips node.offline and observer.offline: states stay,
nothing is mailed. Battery and foreign nodes go on. The pause and the
resume are each logged once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(notify): log one line per tick with the store lock time
408ba2f 
"[notify] tick: users=N changes=M mails=K took=Xms lock=Yms". lock is
how long LastHeardMap held the packet store's read lock, timed inside
the locked section and returned with the map, so staging and live report
the number that was only estimated before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(notify): size the Notify me toggle like its neighbours; space the…
0a96e81 
… account form

The toggle was a plain btn-primary, larger than the node page buttons
next to it. It now takes their sizes (side pane 11px / 2px 8px, full
page 12px / 4px 10px), carries a 16px icon like they do so the heights
match, never breaks its label, and drops the extra margin on the full
page row, which spaces its buttons with gap. The "Watched nodes" heading
gets space above it instead of touching the Save button.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
test(e2e): wait for a positive signal before asserting absence
813b4e1 
The two "no toggle" steps slept 500 ms before counting toggles. They now
wait until the node page has rendered its paths section, a round trip
that starts after the toggle mount decided, and for the auth round trip.
axeClean waits for finite animations (the .page-enter fade) to finish:
a fade in flight blended the Save button colour and failed
color-contrast in 2 of 9 local runs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(notify): wait one silent window after a feed outage before offline
64b69dc 
Pausing offline checks while ingest was stale only moved the false mails:
the first check after recovery still mailed every watcher "offline". The
notifier now remembers when the stale period ended (also a store that was
stale at startup) and the evaluator treats older evidence of a node or
observer whose stored state is good as heard at that moment, so nothing
goes offline until a full silent window has passed after recovery. A bad
state is not lifted. A node that died during the outage is reported up to
one window late; a restart inside the window loses the grace (in memory).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
docs(notify): grace is also lost when the server starts after an outa…
76ec62e 
…ge ended

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
docs(spec): account data export and users.db backup
39148ed 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): snapshot and uncapped per-user accessors
a07e5bb 
Store.Snapshot writes a 0600 VACUUM INTO copy of users.db and refuses an
existing target. AuditAllFor, MailAllForUser and AllProposalsByUser drop
the admin-detail caps for the account export; SettingsRecordFor adds the
write time and StoredNotifyPrefs reads preferences without creating them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): account data export
79739e1 
GET /api/account/export answers one typed JSON file with the profile
(including activatedAt and the activating admin's id), sessions, synced
settings, proposals, notification prefs and watches, audit and mail rows
(with their to-address) of the logged-in user, uncapped. Password hash and
every token are left out; other accounts appear as ids. A user.export
audit row is written after the file is built.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): scheduled users.db snapshots with rotation
f603028 
The janitor takes a snapshot at startup when the newest one is 24 hours
old or missing, then every 24 hours, into userManagement.backup.dir
(default backups/ next to users.db) as users-<YYYYMMDD-HHMMSS>.db, 0600,
written under a .tmp name and renamed. The oldest snapshots beyond keep
(default 7) are deleted; other files are never touched. On by default,
backup.enabled false turns it off.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): admin download of a users.db snapshot
3cb8ff4 
GET /api/admin/users-backup streams a fresh VACUUM INTO copy of
users.db from a temp directory that is removed afterwards, and records
a user.backup audit row. Admin only: the file holds password hashes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): Download my data on the account page; backup docs
7cd1122 
The account page gets a My data section with a plain link to
GET /api/account/export. The admin audit filter lists user.export and
user.backup. The user guide documents the scheduled users.db snapshots,
the admin download and the restore procedure; config.example.json
carries the userManagement.backup block.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(users): backup rotation never deletes the snapshot just written
6618060 
Rotation removed snapshots from the oldest name. With future-dated names
(a clock that ran ahead) numbering keep or more, the new snapshot sorted
first and was deleted right after it was written, while the log said
"backup written". Rotation now skips the file just written; the logged
kept count is the number actually left.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(users): sweep orphaned temporary snapshots in the backup dir
4ccf5d8 
A process killed during VACUUM INTO leaves users-YYYYMMDD-HHMMSS.db.tmp
behind, with every password hash in it, and rotation never matched it.
Each backup run now removes regular files with exactly that name pattern
that were last modified more than 24 hours ago. Other files, directories
and recent temporary files are left alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
feat(users): export the address of an unconfirmed email change
dd69f05 
profile.pendingEmail holds the new address of the account's unused,
unexpired email change (Store.PendingEmailChange), null when there is
none. Only the address leaves users.db: the secret-absence test now also
checks the email change token and its hash.

A new test pins notifications.prefs.events to [] when no event is
chosen. The store already returns an empty, non-nil list
(canonicalEvents), so no code change was needed for that.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
docs(users): what a users.db restore brings back, and how to undo it
07ef4d3 
The Backups section and the config comment now say that snapshots run
about every 24 hours, that a restore brings back accounts deleted after
the snapshot (also self-deletions), old passwords, revoked sessions and
used links, and give the procedure: list deletions from the current
audit log before overwriting, disable those accounts and clear sessions
and tokens with the server stopped, delete them again in the admin area.
Also: deleted accounts stay in snapshots for up to keep days, an existing
backup.dir is not tightened to 0700, and the export leaves out internal
notification state but includes an unconfirmed address change. The spec
gets an Amendments section for this fix wave.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten @claude
fix(account): say that backups can hold a deleted account for a few days
38d631e 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGYZDCxPrcM9FC6VHksY71
@efiten
Merge remote-tracking branch 'upstream/master' into feat/admin-dashboard
9f164df
@efiten
Merge branch 'feat/admin-dashboard' into feat/channel-proposals
258deb3
@efiten
Merge branch 'feat/channel-proposals' into feat/notifications
a92b576
@efiten
Merge branch 'feat/notifications' into feat/account-export-backup
7b77f89
@efiten
Merge upstream/master (Kpa-clawbot#2140 squash of the part E branch) …
5420087 
…into feat/account-export-backup
@efiten
efiten merged commit 2456762 into Kpa-clawbot:master Oct 8, 2026
12 checks passed
@efiten
efiten deleted the feat/account-export-backup branch October 8, 2026 20:16
@efiten efiten mentioned this pull request Oct 8, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@efiten