feat(backup): config-driven walker via backup_paths table

Stage B of the three-stage backup-hardening plan (Stage A:
inline-DB-dump + fail-loud guard already landed). The file-backup
walker used to hard-code its subdirectory list inside
`getFilesToBackupInternal`, which is the same footgun that hid the
`business-docs` gap for ~6 months — a new feature drops artefacts
under STORAGE_PATH and the maintainer has to remember to edit the
walker.

Now driven by a `backup_paths` table:

  - Migration 108 creates the table and seeds the 7 canonical
    defaults (events/active, events/archived, thumbnails, previews,
    heroes, uploads, business-docs). Seed data lives on the
    migration as `DEFAULT_PATHS` so the boot self-heal can re-use it.
  - `_backupPathsBoot.js` mirrors `_emailTemplateBoot.js`: on every
    boot it diffs the canonical list against the current rows and
    `INSERT ... ON CONFLICT DO NOTHING`s the missing ones. Keeps
    admin edits intact, picks up new defaults shipped after the
    install (Knex won't re-run migration 108). Wired into server.js
    just before `startBackupService()`.
  - Walker now calls `resolveBackupPaths(config)` which:
      * reads `backup_paths WHERE include_in_default=true ORDER BY
        display_order`
      * falls back to a hard-coded `LEGACY_BACKUP_PATHS` if the
        table is missing OR empty (defense in depth — never silently
        scans nothing)
      * gates each row by its `feature_flag` column (matches how
        `backup_include_archived` already worked; data-driven now)
  - Backward compatible: `getFilesToBackup(true|false)` still works
    for legacy callers and the existing businessDocs test. New
    callers should pass the full config object so feature gates
    other than `backup_include_archived` evaluate correctly.

Tests:
  - new: `backupService.configurableWalker.test.js` — 7 cases
    covering canonical seed, toggling include_in_default, runtime
    INSERT picked up without restart, feature_flag gating both on
    and off, empty-table → LEGACY fallback, boolean backward compat
  - all 15 backup-walker integration tests pass
    (configurableWalker 7 + inlineDbDump 5 + businessDocs 3)
  - frontend build clean
  - 4 pre-existing integration failures (webhookDelivery, storage
    backend, adminPhotos.reference, imageProcessor.storage) confirmed
    unrelated via `git stash` baseline run

Stage C (CRM feature coverage audit + diagnostic UI) follows
in a separate commit.

This commit is contained in:

Luca

2026-05-29 22:09:23 +02:00

parent 7fdf01ad21

commit 302fc6b937

5 changed files with 518 additions and 33 deletions

									
										backend/server.js
									
		+12
		
												View File
												
				@@ -800,6 +800,18 @@ async function startServer() {

				    const { startS3AutoImporter } = require('./src/services/s3AutoImporter');

				    startS3AutoImporter();

				    // Self-heal the `backup_paths` table before the backup service

				    // starts — the file-backup walker reads from it, so missing

				    // canonical rows (a new subdirectory shipped by a future feature)

				    // get re-seeded here on every boot. See _backupPathsBoot.js for

				    // the full rationale; pattern mirrors _emailTemplateBoot.js.

				    try {

				      const { seedBackupPathsAtBoot } = require('./src/services/_backupPathsBoot');

				      await seedBackupPathsAtBoot(db, logger);

				    } catch (err) {

				      logger.warn('backup_paths self-heal failed at boot:', err.message);

				    }

				    // Start backup service

				    await startBackupService();