Marc-André Bombeck 1c7785c23b fix(backup): take off-host copies out with the account, and say which keys backups still need ...

Deleting an account, deleting a managed profile, "Delete all data" and the
admin wipe now write an off-host deletion request in the same transaction
as the deletion. A new job (offhost-backup-purge, kicked straight away and
run nightly as a backstop) lists the bucket once, deletes every
<date>/user-<id>.json.enc object of each pending account and removes the
request only when nothing of the account is left. A refused delete keeps
the request with the bucket's answer and is retried; the off-host card
shows how many deletions are outstanding and why. A copy the nightly run
was writing while the account was deleted is taken back after the upload.

The off-host card also reads the bucket's lifecycle rule and says plainly
when there is none (every nightly copy kept forever) or when the
credential may not read it.

Every stored backup now records the key ids its content was written
under, and every off-host upload records the same per key. The admin
encryption view lists, per key, the stored copies that need it with the
oldest date, and when the last off-host copy needing it expires. The
"safe to drop" badge now requires that no backup still needs a retired
key, instead of only that every row was rotated.

Migration 0358 adds data_backups.inner_key_ids, the key-use table and the
deletion requests.

2026-09-26 19:54:40 +02:00

..

create.ts

feat: let a guardian edit a managed record, and record its sex

2026-09-10 00:01:50 +02:00

guardian-list.ts

fix: answer the managed-profile Guardian routes in one shape

2026-08-07 04:39:50 +02:00

lifecycle.ts

fix(backup): take off-host copies out with the account, and say which keys backups still need

2026-09-26 19:54:40 +02:00