GithubBackup/BackupX
1
0
Fork 0
mirror of https://github.com/Awuqing/BackupX.git synced 2026-08-30 04:27:20 +08:00
Code Issues Packages Projects Releases Wiki Activity
119 Commits 35 Branches 29 Tags
dfd349de6ad1aa02cd72d7e8aae9f0db03e2401e
Commit Graph
119 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Wu Qing dfd349de6a Merge pull request #111 from Awuqing/dependabot/npm_and_yarn/docs-site/docs-minor-and-patch-afc90954ce 
chore(deps): bump the docs-minor-and-patch group across 1 directory with 3 updates
 2026-08-17 17:56:06 +08:00
Wu Qing a65c643542 Merge pull request #109 from Awuqing/dependabot/docker/container-images-d0276e9342 
chore(deps): bump the container-images group across 1 directory with 3 updates
 2026-08-17 17:56:04 +08:00
Wu Qing b13c3dc068 Merge pull request #115 from Awuqing/dependabot/github_actions/github-actions-bed44877b7 
chore(deps): bump the github-actions group across 1 directory with 12 updates
 2026-08-17 17:56:01 +08:00
dependabot[bot] 921ba24a94 chore(deps): bump the container-images group across 1 directory with 3 updates 
Bumps the container-images group with 3 updates in the / directory: node, golang and alpine.


Updates `node` from 24-alpine to 26-alpine

Updates `golang` from 1.25-alpine to 1.26-alpine

Updates `alpine` from 3.21 to 3.24

---
updated-dependencies:
- dependency-name: alpine
  dependency-version: '3.24'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: container-images
- dependency-name: golang
  dependency-version: 1.26-alpine
  dependency-type: direct:production
  dependency-group: container-images
- dependency-name: node
  dependency-version: 26-alpine
  dependency-type: direct:production
  dependency-group: container-images
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 19:43:00 +00:00
dependabot[bot] 30548a552b chore(deps): bump the docs-minor-and-patch group across 1 directory with 3 updates 
Bumps the docs-minor-and-patch group with 3 updates in the /docs-site directory: [react](https://github.com/react/react/tree/HEAD/packages/react), [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) and [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom).


Updates `react` from 19.2.5 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `@types/react` from 19.2.14 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.5 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `@types/react` from 19.2.14 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

---
updated-dependencies:
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: docs-minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: docs-minor-and-patch
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docs-minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docs-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 19:33:35 +00:00
dependabot[bot] 16d6eedc3c chore(deps): bump the github-actions group across 1 directory with 12 updates 
Bumps the github-actions group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [actions/setup-go](https://github.com/actions/setup-go) | `5` | `7` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4` | `7` |
| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `3` | `5` |
| [actions/deploy-pages](https://github.com/actions/deploy-pages) | `4` | `5` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2` | `3` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3` | `4` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` |
| [docker/login-action](https://github.com/docker/login-action) | `3` | `4` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` |



Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v7)

Updates `actions/setup-go` from 5 to 7
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v5...v7)

Updates `actions/setup-node` from 4 to 7
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v4...v7)

Updates `actions/upload-pages-artifact` from 3 to 5
- [Release notes](https://github.com/actions/upload-pages-artifact/releases)
- [Commits](https://github.com/actions/upload-pages-artifact/compare/v3...v5)

Updates `actions/deploy-pages` from 4 to 5
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](https://github.com/actions/deploy-pages/compare/v4...v5)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)

Updates `actions/download-artifact` from 4 to 8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4...v8)

Updates `softprops/action-gh-release` from 2 to 3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/v2...v3)

Updates `docker/setup-qemu-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/v3...v4)

Updates `docker/setup-buildx-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4)

Updates `docker/login-action` from 3 to 4
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v3...v4)

Updates `docker/build-push-action` from 6 to 7
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/deploy-pages
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-pages-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/setup-qemu-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 19:06:38 +00:00
Wu Qing 74ee1f3694 Merge pull request #126 from Awuqing/feature/demo-showcase 
Improve local demo and refresh documentation images
v2.4.0 		2026-08-11 16:05:58 +08:00
Awuqing d68d336668 fix: preserve successful storage target updates 2026-08-11 16:00:58 +08:00
Awuqing 2e20c511b9 Merge main into feature/demo-showcase 2026-08-11 15:46:58 +08:00
Awuqing 3a181c7416 feat: improve local demo and documentation 2026-08-11 13:34:42 +08:00
Wu Qing 0aa3cc92df feat(admin): 优化访问管理布局与操作流程 (#125) 
统一用户账号与 API Key 管理入口，增强筛选、状态反馈、审计联动及危险操作保护，并补充组件化布局与回归测试。
 2026-08-11 11:42:55 +08:00
Wu Qing 0e615677db feat(docs): 升级文档站界面与导航 (#124) 
重构文档站首页、导航与内容布局，统一 SVG 图标和双语文案，并完善响应式、深色模式与可访问性。
 2026-08-09 22:32:27 +08:00
Wu Qing 9080a47703 chore(repo): 完善仓库维护与自动化 (#108) 
统一 Node.js 24 LTS、CI、文档和发布工作流配置。

完善仓库维护规范、Dependabot 与贡献文档，清理生成产物并统一既有 Go 代码格式。
 2026-08-09 21:18:19 +08:00
Wu Qing bdd16dafa8 docs: 完善部署与运维文档 (#107) 
新增中英文升级恢复、安全加固、监控告警与故障排查手册，校正安装部署、CLI 与 API 参考，并修复安全密钥环境变量注入及其回归测试。
 2026-08-09 13:51:38 +08:00
Wu Qing 5827074334 feat: 优化集群部署与堡垒机接入 (#106) 
支持受限网络、正向代理、私有 CA 与 SSH 堡垒机部署 Agent。

加固 Docker、systemd、Nginx、安装器、Release 校验与可信代理边界，并完善命令队列索引、前端安装向导及中英文运维文档。
 2026-08-09 02:45:17 +08:00
Wu Qing 00151e466c feat: 解决 CDC 去重、集中备份与首次初始化问题 (#105) 
实现 CDC 内容寻址仓库、远程 Agent 中央中转备份与首次初始化体验，并补充安全校验、测试及双语文档。

Closes #94
Closes #101
Closes #104
 2026-08-07 23:01:29 +08:00
Wu Qing 50ce6587d8 feat(restore): 恢复到指定目录（文件类型本机恢复 + 确认弹窗输入） (#86) 
* feat(restore): 支持恢复到指定目录（文件类型本机恢复）

恢复此前只能覆盖原始源路径。新增「恢复到指定目录」：把文件备份还原到任意目录，
用于测试恢复、迁移、并排恢复而不覆盖现网数据。

- backup.TaskSpec +RestoreTargetPath；FileRunner.Restore 非空时把归档解压到该目录。
- model.RestoreRecord +TargetPath（持久化/审计）。
- RestoreService.Start 增加 targetPath 参数与校验：仅文件类型、需绝对路径、
  远程节点暂不支持（清晰报错）；executeLocally 透传到 spec。
- 恢复触发端点接受可选请求体 {targetPath}（无 body 时恢复到原始路径）。
- 测试：恢复到指定目录后文件落在该目录；相对路径被拒。

* feat(restore): 恢复确认弹窗支持指定恢复目录

文件类型 + 本机恢复时，恢复确认弹窗新增「恢复到指定目录」输入（可选、绝对路径、
留空=原位置），并实时反映在「恢复目标」摘要中；经 startRestoreFromBackup 透传 targetPath。
 2026-06-01 00:39:17 +08:00
Wu Qing f7599dd9bd Update README.md (#95) 2026-06-01 00:34:09 +08:00
Wu Qing bf0e91db57 chore(ci): 为工作流声明最小权限 (contents: read) (#96) 
修复 CodeQL actions/missing-workflow-permissions 告警：ci.yml 未显式声明
GITHUB_TOKEN 权限，默认可写。构建/测试仅需读取仓库内容，故收敛为 contents: read。
 2026-06-01 00:27:24 +08:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 37092f3167 build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#93) 
Bumps the npm_and_yarn group with 2 updates in the /web directory: [ws](https://github.com/websockets/ws) and [axios](https://github.com/axios/axios).


Updates `ws` from 8.19.0 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/8.19.0...8.21.0)

Updates `axios` from 1.15.2 to 1.16.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.15.2...v1.16.0)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-31 23:37:13 +08:00
Wu Qing 51e4b0b0ce fix(backup): 修复差异/清单设计评审发现的三处问题 (#92) 
1) DeleteRecord 拒绝删除仍被成功差异依赖的全量（+CountDependentDifferentials），堵住手动删除孤立差异链的数据完整性缺口；2) 列表查询 Omit(Manifest)，差异基线改按需 FindByID 加载，避免清单大列拖累热路径；3) FileRunner.Run 每文件即时关闭句柄，杜绝大目录 FD 泄漏。含仓储层单测。
 2026-05-28 13:38:10 +08:00
Wu Qing 493e1faff5 feat(backup): 新增按需（选择性）文件恢复 (#91) 
在内容浏览基础上支持仅恢复勾选的文件/目录到原位置。FileRunner.Restore 按选中集合过滤提取与删除；RestoreService.StartSelective（Start 委托，零破坏）；恢复端点接受可选 selectedPaths；前端内容弹窗支持勾选恢复。
 2026-05-27 19:50:50 +08:00
Wu Qing 68bb964350 feat(backup): 新增备份内容浏览 (#90) 
查看每次备份捕获的文件清单（路径/大小/目录），核对完整性、排查遗漏。清单取自全量备份记录，无需下载解压；差异记录回退基线清单。只读端点 + 前端可筛选弹窗。
 2026-05-27 19:33:44 +08:00
Wu Qing 65cf3a04d4 feat(backup): 新增 zstd 压缩选项 (#89) 
备份压缩在 gzip 之外新增 zstd（更高压缩率、更快解压）。pkg/compress 新增 ZstdFile/UnzstdFile，Master 与 Agent 压缩/解压按后缀分流，任务校验与前端下拉同步；往返单测覆盖。
 2026-05-27 19:15:06 +08:00
Wu Qing 90b58d58d6 feat(backup): 新增差异备份（differential）模式 (#88) 
文件备份新增差异模式：仅打包自上次全量以来的变更并记录删除，恢复自动按全量+差异链还原。含基线解析、链式恢复、保留链保护与本机文件任务校验；清单/比对/删除/往返/保留保护单测全覆盖。
 2026-05-27 19:03:40 +08:00
Wu Qing f584a0802a feat(backup): 新增 MongoDB 备份与恢复支持 (#87) 
通过 mongodump/mongorestore --archive 流式管线接入 MongoDB 数据源，与现有数据库运行器架构一致；注册到 Master 与 Agent，含任务校验、默认端口与前端表单/恢复确认。5 个单测覆盖参数构造、全库、空产物与缺工具分支。
 2026-05-27 18:35:10 +08:00
Wu Qing 992fc24150 feat(backup): GFS 分层保留策略（祖父-父-子）+ 任务表单配置 (#85) 
新增 GFS 分层保留：按天/周/月/年保留代表性备份，各层级并集；任一>0 启用、全0 维持原策略（兼容），锁定记录豁免。后端 retention 算法+任务字段贯通，前端任务表单 GFS 配置。go test、tsc+vite 通过。
 2026-05-27 15:36:58 +08:00
Wu Qing 386f12a11b feat(backup): 备份保留锁定 / 法律保留（豁免清理删除 + 记录页锁定） (#84) 
新增保留锁定：锁定的备份豁免保留期清理与手动删除（迁移基线/合规快照/取证）。model+Locked、retention 剔除锁定记录、DeleteRecord 拒绝删除、PUT /backup/records/:id/lock、记录页锁定/解锁操作与标识。go test、tsc+vite、运行时路由验证均通过。
 2026-05-27 13:59:05 +08:00
Wu Qing f807ce10e6 feat(audit): 审计日志保留期清理（后端自动清理 + 审计页配置） (#83) 
审计日志新增可配置保留期：AuditLogRepository.DeleteBefore + AuditService 保留期监控（每 6h 读取 audit_retention_days，0/缺省=永久保留）；审计页新增管理员保留天数配置控件。后端 go test、前端 tsc+vite 通过。
 2026-05-27 08:37:34 +08:00
Wu Qing a0d1e66199 feat(reports): 企业合规报表（后端聚合 + CSV 导出 + 前端页面） (#82) 
新增合规报表：ReportService 逐任务聚合备份合规证据（成功率/最近成功/SLA 判定/加密/受保护量）+ JSON/CSV API；前端新增 /reports 页面（汇总卡片+明细表+CSV 导出）。后端 go test、前端 tsc+vite、端到端路由验证均通过。
 2026-05-27 08:14:56 +08:00
dependabot[bot] 74e29a0753 build(deps): bump go_modules group in /server (#71) 
dependabot 安全更新：rclone 1.73.3→1.73.5、golang.org/x/crypto 0.48→0.50、otel 1.39→1.41、aws-sdk 等（均为 minor/patch）。#71 CI（go build/test）通过。
 2026-05-27 01:23:34 +08:00
dependabot[bot] 01ce536ca8 build(deps): bump npm_and_yarn group in /docs-site (#72) 
dependabot 安全更新（docs-site 站点依赖），CI 通过。
 2026-05-27 01:23:26 +08:00
Wu Qing ef2e15f500 test(replication): 为零覆盖的备份复制服务补齐测试 (#80) 
新增 replication_service_test.go：备份→复制到目标存储（目标出现对象、源保留、终态 success）+ 同源拒绝。纯测试新增。
 2026-05-27 01:19:49 +08:00
Wu Qing bdf68eef7a test(verify): 为零覆盖的验证服务补齐测试 (#79) 
新增 verification_service_test.go：合法压缩备份验证通过（回归保护 #77）+ 损坏对象验证必失败。纯测试新增。
 2026-05-27 01:07:12 +08:00
Wu Qing 8747d6a21b fix(security): 节点文件浏览限制为非 viewer (#78) 
GET /api/nodes/:id/fs/list 加 RequireNotViewer() 守卫，杜绝只读 viewer 枚举节点文件系统目录（信息泄露）；与备份任务配置的权限级别对齐。
 2026-05-27 00:54:44 +08:00
Wu Qing 04ad3c29f4 feat(verify): 验证流程同样比对备份 SHA-256，对齐恢复路径强度 (#77) 
验证流程在解压前比对下载对象的 SHA-256（复用恢复路径实现），移除 verifyByType 失效的 checksum 形参。备份/恢复/验证三路径完整性校验一致。
 2026-05-27 00:49:27 +08:00
Wu Qing e63b8f0be8 feat(agent): Agent 远程恢复同样校验备份 SHA-256（补全 #75） (#76) 
AgentRestoreSpec/RestoreSpec 新增 Checksum 并由 GetAgentRestoreSpec 透传；Agent ExecuteRestore 在解压前比对 SHA-256，不匹配即中止还原。两条恢复路径完整性保证一致。
 2026-05-27 00:40:49 +08:00
Wu Qing 45bc210313 feat(restore): 还原前校验备份 SHA-256，拒绝损坏/被篡改的备份 (#75) 
恢复路径在解密/解压前比对下载对象的 SHA-256（与备份记录一致），不匹配即中止还原且不触碰源数据；早期无 checksum 的备份跳过（向后兼容）。新增单元+集成测试。
 2026-05-27 00:27:41 +08:00
Wu Qing 0f30e7bf52 refactor: 消除集群执行服务冗余逻辑 + 修复节点状态滞后缺陷 (#74) 
抽取备份/恢复/验证/复制四服务的复制粘贴逻辑到 execution_helpers.go（净减约 250 行）；节点状态改为按 LastSeen 实时推导，消除过期 online 误判；Agent systemd 单元补齐 LimitNOFILE 与单机端一致。go build/test 全绿。
 2026-05-26 14:12:39 +08:00
Wu QingokwnClaude Opus 4.7
 		e4c52fd8f4 docs: 新增 CONTRIBUTING 贡献指南 (#73) 
补充开发环境搭建、构建/测试命令、Conventional Commits（中文）规范、
PR 流程与编码约定。内容与仓库实际一致（Go 1.25、make 目标、vitest
前端测试、后端自动托管 web/dist）。

承接 #64 的思路并重写为与代码库一致的准确版本（不含 #63/#64 中关于
`-e PORT` 等不准确的 troubleshooting 内容）。

Co-authored-by: okwn <13228820+okwn@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-26 12:56:43 +08:00
Wu QingandClaude Opus 4.7 17f4ec63ae fix: 后端直接托管 Web 控制台修复 #62，并修复 CodeQL 安全告警 (#70) 
* fix(server): 后端直接托管 Web 控制台，修复无 nginx 时 404 (#62)

问题 #62：在未安装 nginx 的服务器上，访问 :8340/ 返回
"route not found"（404），Web 控制台完全无法打开；同时 systemd
服务以 backupx 用户启动时因无权读取 root:root 0640 的配置文件
而反复退出（exit 1）。

修复：
- 后端新增 SPA 静态托管：自动探测前端目录（./web、./web/dist、
  /opt/backupx/web 等，或 server.web_root 显式指定），命中后直接
  提供静态文件与 index.html 回退，无需额外 nginx 反向代理即可访问
  控制台。/api、/health、/metrics、/install 等保留前缀仍返回结构化
  JSON 404，不会被 SPA 回退污染（沿用 issue #46 的约定）。
- 含 ".." 的请求路径由文件服务层直接拒绝，叠加 filepath.Rel 容器
  校验，杜绝目录穿越。
- install.sh 以 backupx:backupx 安装配置文件并显式 chown，修复历史
  版本 root:root 0640 导致服务无法读取配置而启动失败的问题；安装
  完成提示同步说明可直接通过 :8340 访问，并给出 journalctl 排查命令。
- 新增 spa_test.go 覆盖目录探测、保留前缀判定、SPA 回退与穿越防护。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(security): 修复邮件头注入，加固 webhook 与整数转换

CodeQL 静态扫描在 main 上的真实告警修复：
- 邮件通知（email.go）：From/To/Subject 头部此前直接拼接用户可控
  内容（备份任务名会进入 Subject），存在 SMTP 头注入风险（可注入
  Bcc 等额外头部或伪造正文）。新增 buildRawMessage/sanitizeHeaderValue
  剔除头部值中的 CR/LF；正文保持原样。新增 email_test.go 覆盖。
- webhook 通知（webhook.go）：Validate 增加 URL 解析与 http/https
  协议校验，杜绝 file://、gopher:// 等可用于 SSRF 的协议。
- 整数转换（auth_service.go、storage_target_handler.go、
  backup_record_handler.go）：将 ParseUint 的 bitSize 由 64 改为 0
  （即 uint 宽度），消除 uint64→uint 的潜在截断（32 位平台上为越界
  拒绝而非静默截断），并清除 go/incorrect-integer-conversion 告警。

注：archive.go/file_runner.go 的 zipslip 告警为误报（已有 HasPrefix
容器校验且不解压符号链接）；node FS 浏览与 webhook 目标主机由设计上
的鉴权用户控制，不在本次行为变更范围内。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-26 12:50:57 +08:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 5a936ee162 build(deps): bump the npm_and_yarn group across 2 directories with 7 updates (#59) 
Bumps the npm_and_yarn group with 1 update in the /docs-site directory: [fast-uri](https://github.com/fastify/fast-uri).
Bumps the npm_and_yarn group with 6 updates in the /web directory:

| Package | From | To |
| --- | --- | --- |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.11` | `1.16.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` |
| [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.4` |
| [postcss](https://github.com/postcss/postcss) | `8.5.8` | `8.5.14` |
| [axios](https://github.com/axios/axios) | `1.13.6` | `1.15.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.1` | `6.4.2` |



Updates `fast-uri` from 3.1.0 to 3.1.2
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.11...v1.16.0)

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4)

Updates `postcss` from 8.5.8 to 8.5.14
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.8...8.5.14)

Updates `axios` from 1.13.6 to 1.15.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.13.6...v1.15.2)

Updates `vite` from 6.4.1 to 6.4.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.14
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 6.4.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-26 12:47:09 +08:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> d39335bdde build(deps): bump golang.org/x/image (#36) 
Bumps the go_modules group with 1 update in the /server directory: [golang.org/x/image](https://github.com/golang/image).


Updates `golang.org/x/image` from 0.32.0 to 0.38.0
- [Commits](https://github.com/golang/image/compare/v0.32.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/image
  dependency-version: 0.38.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-26 12:43:21 +08:00
Wu Qing 7084d47c4b feat(BackupX): harden agent cluster backup workflow 
Squash merge PR #61
v2.3.5 		2026-05-13 14:24:45 +08:00
Wu Qing 7a6ffd4ddd feat(BackupX): 修复跨节点备份恢复终态处理 (#60) 
* feat(BackupX): 修复集群部署管理逻辑

* feat(BackupX): 修复节点池任务运行归属

* feat(BackupX): 修复跨节点恢复路由

* feat(BackupX): 修复跨节点备份恢复终态处理

* test(BackupX): 稳定安装流HTTP测试
v2.3.4 		2026-05-09 23:03:25 +08:00
Wu Qing 61709dd4c9 fix(cluster): support external master URL 
- add server.external_url / BACKUPX_SERVER_EXTERNAL_URL for Agent install URL generation
- pass the configured external Master URL into install script and compose rendering
- document cluster deployment requirements for Docker, bare-metal, and multi-node setups

Fixes #55
 2026-05-09 07:41:51 +08:00
Wu Qing f6bd185b9f feat: improve agent install release layout support 
- fix bare-metal Agent install config and executor path handling
- support release package layout in deploy/install.sh and release workflow
- add regression tests for Agent execution and deploy install script behavior
 2026-05-09 00:00:53 +08:00
Wu Qing af0e8f5c1f fix: respect local timezone for scheduler (#54) v2.3.1 2026-05-01 14:39:16 +08:00
Wu Qing 63fde903d2 feat: add complete MFA support 
Add complete MFA support with TOTP, recovery codes, WebAuthn, trusted-device cookie flow, and email/SMS OTP delivery via notification channels. Security follow-up: trusted device tokens are stored in HttpOnly cookies, and SMS OTP reuses the existing Webhook notifier to avoid introducing a new dynamic URL sink.
v2.3.0 		2026-04-25 22:14:50 +08:00
Wu Qing 67a42b09ba fix: make agent install command proxy independent (#50) v2.2.1 2026-04-25 13:43:30 +08:00