v0.289.0: off-site key cannot delete — append-only rclone transport, box sends only its public key (hub registrar), retention only inside a hub window behind the fake-snapshot guard (decisions 68-69, R-820, R-822)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-03 17:01:36 +02:00
parent 09453325d1
commit 55bb6c3d32
15 changed files with 1039 additions and 386 deletions
@@ -772,14 +772,30 @@ func main() {
 	// reconcile between placing a recovered key and reading the repository (R-219). nil when off-site
 	// is not configured for this customer, which the web seam treats as "skip".
 	var offsiteBridge *offsiteapply.Bridge
+	offsiteRegistrar := offsiteapply.HubRegistrar{HubURL: cfg.Hub.URL, CustomerID: cfg.Customer.ID, APIKey: cfg.Hub.APIKey}
+	if backupMgr != nil && cfg.Hub.URL != "" && cfg.Hub.APIKey != "" {
+		// The orphan move-aside is the HUB's now (decision 69): the box's pinned key reaches only the
+		// append-only rclone server and cannot rename a directory.
+		backupMgr.SetOffsiteMoveAside(offsiteRegistrar.MoveAside)
+		// Decision 68: retention on the append-only tier happens only inside a hub-opened window.
+		backupMgr.SetOffsiteWindowClient(offsiteapply.HubWindowClient{Registrar: offsiteRegistrar})
+	}
 	if backupMgr != nil && cfg.Offsite.Enabled && cfg.Hub.URL != "" && cfg.Hub.APIKey != "" {
 		bridge := &offsiteapply.Bridge{
 			Cfg:       cfg,
-			Consumer:  offsiteapply.HTTPConsumer{HubURL: cfg.Hub.URL, CustomerID: cfg.Customer.ID, APIKey: cfg.Hub.APIKey},
+			// Decision 69 (v0.289.0): the box sends its PUBLIC key to the hub's registrar, which pins it
+			// append-only; the box never receives the sub-account password.
+			Registrar: offsiteRegistrar,
 			Scanner:   offsiteapply.KeyscanScanner{},
 			KeyGen:    offsiteapply.ED25519KeyGen{},
-			Installer: offsiteapply.SSHCopyIDInstaller{},
-			Prober:    offsiteapply.SFTPKeyAuthProber{KeyPath: filepath.Join(cfg.Paths.DataDir, "offbox", "ssh_key")},
+			Prober:    offsiteapply.PinnedProber{},
+			Existing: func() string {
+				b, err := os.ReadFile(filepath.Join(cfg.Paths.DataDir, "offbox", "ssh_key"))
+				if err != nil {
+					return ""
+				}
+				return string(b)
+			},
 			Enabler: offsiteapply.EnablerFunc(func(ctx context.Context, host, user string, port int, repoPath, priv, kh string, quotaGB int) error {
 				tgt := &settings.OffboxTarget{Enabled: true, Host: host, User: user, Port: port, RepoPath: repoPath, Schedule: "daily", QuotaGB: quotaGB}
 				stage := func(ctx context.Context, pw string) error {
@@ -1306,6 +1322,11 @@ func main() {
 			case "offbox_repo_reset":
 				notifier.PushEvent("offbox_repo_reset", "info",
 					"A távoli mentési tároló visszaállítva: a régi előzmény félretéve (nem törölve), és egy üres, új tároló jött létre a mostani kulccsal.", map[string]string{"renamed_to": renamedTo})
+			case "offbox_abandon_deferred":
+				// v0.289.0 (decision 69): the box's off-site key cannot delete, so the customer-chosen
+				// deletion of the set-aside history is the operator's (R-823). Operator-only on the hub.
+				notifier.PushEvent("offbox_abandon_deferred", "warning",
+					"A félretett régi távoli mentések törlése esedékes, de a doboz távoli kulcsa csak hozzáadni tud (69. döntés): semmi nem törlődött. A félretett másolatot az üzemeltető távolítja el.", map[string]string{"set_aside_path": renamedTo})
 			case "offbox_abandon_completed":
 				// R-241: the ONLY event in the product that reports a customer's off-site history
 				// being deleted. It is fired after the deletion, not before — the operator wants to