chore: release 1.17.0

fix/storage-encryption

CITATION.cff

@@ -27,5 +27,5 @@ keywords:
   - self-hosted
   - portabase
 license: Apache-2.0
-version: 1.16.0
+version: 1.17.0
 date-released: '2026-02-24'

Cargo.lock

@@ -3503,7 +3503,7 @@ dependencies = [
 
 [[package]]
 name = "portabase-agent"
-version = "1.16.0"
+version = "1.17.0"
 dependencies = [
  "aes",
  "aes-gcm",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portabase-agent"
-version = "1.16.0"
+version = "1.17.0"
 edition = "2024"
 
 [dependencies]

docker-compose.yml

@@ -19,7 +19,7 @@ services:
       APP_ENV: development
       LOG: debug
       TZ: "Europe/Paris"
-      EDGE_KEY: "eyJzZXJ2ZXJVcmwiOiJodHRwOi8vbG9jYWxob3N0Ojg4ODciLCJhZ2VudElkIjoiNDA1MTA4YzQtMDJjYy00NTlhLTkxNjItODExNTc3NjAzMjhjIiwibWFzdGVyS2V5QjY0IjoiMUh0djdtWCtYVkJxL0IzUEV2WDlZZjlQeUdVZW5oRHlXemo5THRqNW90WT0ifQ=="
+      EDGE_KEY: "eyJzZXJ2ZXJVcmwiOiJodHRwOi8vbG9jYWxob3N0Ojg4ODciLCJhZ2VudElkIjoiZWZhYTM0YTQtZDY1NC00OGQ3LTgwNDYtNjRkMWExYTA1M2FlIiwibWFzdGVyS2V5QjY0IjoiMUh0djdtWCtYVkJxL0IzUEV2WDlZZjlQeUdVZW5oRHlXemo5THRqNW90WT0ifQ=="
       #CHUNK_SIZE_MB: "1"
       #POOLING: 1
       #DATABASES_CONFIG_FILE: "config.toml"

src/services/api/models/agent/status.rs

@@ -31,7 +31,12 @@ pub struct DatabaseStatus {
     pub dbms: String,
     #[serde(rename = "generatedId")]
     pub generated_id: String,
+    #[serde(default)]
     pub storages: Vec<DatabaseStorage>,
+    #[serde(default)]
+    pub storages_encrypted: Option<bool>,
+    #[serde(default)]
+    pub storages_ciphertext: Option<String>,
     pub encrypt: bool,
     pub data: DatabaseData,
 }

src/services/backup/uploader.rs

@@ -104,6 +104,7 @@ impl BackupService {
                         method,
                         &storage,
                         Some(encrypt),
+                        &backup_storage_id,
                     )
                     .await;
 

src/services/status.rs

@@ -1,16 +1,18 @@
 #![allow(dead_code)]
 
 use crate::core::context::Context;
+use crate::domain::factory::DatabaseFactory;
 use crate::services::api::endpoints::status::DatabasePayload;
+use crate::services::api::models::agent::status::DatabaseStorage;
 use crate::services::api::models::agent::status::PingResult;
 use crate::services::config::DatabaseConfig;
 use crate::settings::CONFIG;
+use crate::utils::file::decrypt_json_gcm;
+use futures_util::future::try_join_all;
 use reqwest::Client;
 use std::error::Error;
 use std::sync::Arc;
-use futures_util::future::try_join_all;
 use tracing::info;
-use crate::domain::factory::DatabaseFactory;
 
 pub struct StatusService {
     ctx: Arc<Context>,
@@ -28,12 +30,12 @@ impl StatusService {
     pub async fn ping(&self, databases: &[DatabaseConfig]) -> Result<PingResult, Box<dyn Error>> {
         let edge_key = &self.ctx.edge_key;
 
-        let databases_payload: Vec<DatabasePayload> = try_join_all(
-            databases.into_iter().map(|db| async move {
+        let databases_payload: Vec<DatabasePayload> =
+            try_join_all(databases.into_iter().map(|db| async move {
                 let db_engine = DatabaseFactory::create_for_backup(db.clone()).await;
 
                 let reachable = db_engine.ping().await?;
-                info!("Ping {} => {:?}",db.name, reachable);
+                info!("Ping {} => {:?}", db.name, reachable);
 
                 Ok::<DatabasePayload, anyhow::Error>(DatabasePayload {
                     name: &db.name,
@@ -41,16 +43,31 @@ impl StatusService {
                     generated_id: &db.generated_id,
                     ping_status: reachable,
                 })
-            })
-        ).await?;
+            }))
+            .await?;
 
         let version_str = CONFIG.app_version.as_str();
-        let result = self
+        let mut result = self
             .ctx
             .api
             .agent_status(&edge_key.agent_id, &version_str, databases_payload)
             .await?
             .unwrap();
+
+        for db in result.databases.iter_mut() {
+            if db.storages_encrypted == Some(true) {
+                let ciphertext = db
+                    .storages_ciphertext
+                    .as_deref()
+                    .ok_or("storages_encrypted set but storages_ciphertext missing")?;
+
+                let plaintext = decrypt_json_gcm(ciphertext, &edge_key.master_key_b64)
+                    .map_err(|e| format!("Failed to decrypt storages: {e}"))?;
+
+                db.storages = serde_json::from_slice::<Vec<DatabaseStorage>>(&plaintext)
+                    .map_err(|e| format!("Failed to parse decrypted storages: {e}"))?;
+            }
+        }
         Ok(result)
     }
 }

src/services/storage/mod.rs

@@ -22,6 +22,7 @@ pub trait StorageProvider: Send + Sync {
         method: BackupMethod,
         config: &DatabaseStorage,
         encrypt: Option<bool>,
+        backup_storage_id: &str,
     ) -> UploadResult;
 }
 

src/services/storage/providers/azure_blob/mod.rs

@@ -26,6 +26,7 @@ impl StorageProvider for AzureBlobProvider {
         _method: BackupMethod,
         storage: &DatabaseStorage,
         encrypt: Option<bool>,
+        _backup_storage_id: &str,
     ) -> UploadResult {
         let Some(file_path) = result.backup_file else {
             return UploadResult {

src/services/storage/providers/google_cloud_storage/mod.rs

@@ -28,6 +28,7 @@ impl StorageProvider for GoogleCloudStorageProvider {
         _method: BackupMethod,
         storage: &DatabaseStorage,
         encrypt: Option<bool>,
+        _backup_storage_id: &str,
     ) -> UploadResult {
         let Some(file_path) = result.backup_file else {
             return UploadResult {

src/services/storage/providers/google_drive/mod.rs

@@ -26,6 +26,7 @@ impl StorageProvider for GoogleDriveProvider {
         _method: BackupMethod,
         storage: &DatabaseStorage,
         encrypt: Option<bool>,
+        _backup_storage_id: &str,
     ) -> UploadResult {
         let Some(file_path) = result.backup_file else {
             return UploadResult {

src/services/storage/providers/local.rs

@@ -23,6 +23,7 @@ impl StorageProvider for LocalProvider {
         method: BackupMethod,
         storage: &DatabaseStorage,
         encrypt: Option<bool>,
+        backup_storage_id: &str,
     ) -> UploadResult {
         let Some(file_path) = result.backup_file else {
             return UploadResult {
@@ -82,6 +83,10 @@ impl StorageProvider for LocalProvider {
             "X-Generated-Id",
             HeaderValue::from_str(&result.generated_id).unwrap(),
         );
+        extra_headers.insert(
+            "X-Backup-Storage-Id",
+            HeaderValue::from_str(backup_storage_id).unwrap(),
+        );
         extra_headers.insert("X-Status", HeaderValue::from_str(&result.status).unwrap());
         extra_headers.insert(
             "X-Method",

src/services/storage/providers/s3/mod.rs

@@ -34,6 +34,7 @@ impl StorageProvider for S3Provider {
         _method: BackupMethod,
         storage: &DatabaseStorage,
         encrypt: Option<bool>,
+        _backup_storage_id: &str,
     ) -> UploadResult {
         let Some(file_path) = result.backup_file else {
             return UploadResult {

src/tests/services/api_models_tests.rs

@@ -2,7 +2,7 @@ use serde_json::json;
 
 use crate::services::api::models::agent::backup::{BackupResponse, BackupUploadResponse};
 use crate::services::api::models::agent::restore::ResultRestoreResponse;
-use crate::services::api::models::agent::status::PingResult;
+use crate::services::api::models::agent::status::{DatabaseStatus, PingResult};
 
 #[test]
 fn backup_response_deserializes_nested_backup_id() {
@@ -110,3 +110,41 @@ fn ping_result_deserializes_and_normalizes_storage_config_keys() {
     assert!(result.databases[0].data.restore.file.is_none());
     assert!(result.databases[0].data.restore.meta_file.is_none());
 }
+
+#[test]
+fn database_status_legacy_plaintext_storages() {
+    let status: DatabaseStatus = serde_json::from_value(json!({
+        "dbms": "postgres",
+        "generatedId": "gen-1",
+        "storages": [ { "id": "s1", "config": { "bucket": "b" }, "provider": "s3" } ],
+        "encrypt": true,
+        "data": {
+            "backup": { "action": false, "cron": null },
+            "restore": { "action": false, "file": null, "metaFile": null, "size": null }
+        }
+    })).unwrap();
+
+    assert_eq!(status.storages.len(), 1);
+    assert_eq!(status.storages_encrypted, None);
+    assert!(status.storages_ciphertext.is_none());
+}
+
+#[test]
+fn database_status_encrypted_envelope() {
+    let status: DatabaseStatus = serde_json::from_value(json!({
+        "dbms": "postgres",
+        "generatedId": "gen-1",
+        "storages": [],
+        "storages_encrypted": true,
+        "storages_ciphertext": "AQIDBA==",
+        "encrypt": true,
+        "data": {
+            "backup": { "action": true, "cron": null },
+            "restore": { "action": false, "file": null, "metaFile": null, "size": null }
+        }
+    })).unwrap();
+
+    assert!(status.storages.is_empty());
+    assert_eq!(status.storages_encrypted, Some(true));
+    assert_eq!(status.storages_ciphertext.as_deref(), Some("AQIDBA=="));
+}

src/tests/utils/file_tests.rs

@@ -86,3 +86,27 @@ async fn encrypt_stream_starts_with_json_header_line() -> Result<()> {
 
     Ok(())
 }
+
+use crate::utils::file::decrypt_json_gcm;
+
+const VECTOR_KEY_B64: &str = "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc=";
+const VECTOR_ENVELOPE_B64: &str = "AQIDBAUGBwgJCgsM4AfK9w7I2A7UDzMvpJaScfnUYAGDZgPWT5Chrp1pdzMPPQVpNjb6ZEiFea9YdWVFv1UEo9RGmmf+zYUv4I3gE4SU/SBrMwkCHEpJGJOzJtK3tSpJmzLVX3+7EeUNwp4qjZheL8p0pe1x6dRUtx3JmLjz1W/RhWd6zuReDItv6+0jg4CaPOHvFXBreaGNCTRslxbImD+lFBoEOvw8lsbH";
+const VECTOR_PLAINTEXT: &str = "[{\"id\":\"11111111-1111-1111-1111-111111111111\",\"config\":{\"bucket\":\"my-bucket\",\"accessKeyId\":\"AKIA\",\"secretAccessKey\":\"s3cr3t\"},\"provider\":\"s3\"}]";
+
+#[test]
+fn decrypt_json_gcm_decrypts_node_vector() {
+    let plaintext = decrypt_json_gcm(VECTOR_ENVELOPE_B64, VECTOR_KEY_B64).unwrap();
+    assert_eq!(String::from_utf8(plaintext).unwrap(), VECTOR_PLAINTEXT);
+}
+
+#[test]
+fn decrypt_json_gcm_rejects_wrong_key() {
+    let wrong_key = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    assert!(decrypt_json_gcm(VECTOR_ENVELOPE_B64, wrong_key).is_err());
+}
+
+#[test]
+fn decrypt_json_gcm_rejects_short_input() {
+    // 8 bytes base64 -> shorter than nonce(12)+tag(16)
+    assert!(decrypt_json_gcm("AAAAAAAAAAA=", VECTOR_KEY_B64).is_err());
+}

src/tests/utils/normalize_cron_tests.rs

@@ -31,12 +31,60 @@ fn normalized_expression_is_valid_for_cron_schedule() {
 #[test]
 fn next_run_timestamp_returns_future_timestamp() {
     let expr = normalize_cron("*/1 * * * *");
-    let ts = next_run_timestamp(&expr);
+    let ts = next_run_timestamp(&expr).unwrap();
 
     let now = chrono::Local::now().timestamp();
     assert!(ts > now);
 }
 
+#[test]
+fn normalize_converts_unix_sunday_zero_to_crate_dow() {
+    let input = "00 06 * * 0";
+    let normalized = normalize_cron(input);
+
+    assert_eq!(normalized, "0 00 06 * * 1");
+
+    let schedule = Schedule::from_str(&normalized);
+    assert!(schedule.is_ok());
+}
+
+#[test]
+fn normalize_converts_unix_saturday_to_crate_dow() {
+    assert_eq!(normalize_cron("00 06 * * 6"), "0 00 06 * * 7");
+}
+
+#[test]
+fn normalized_sunday_actually_fires_on_sunday() {
+    use chrono::{Datelike, Timelike, Weekday};
+
+    let normalized = normalize_cron("00 03 * * 0");
+    assert_eq!(normalized, "0 00 03 * * 1");
+
+    let schedule = Schedule::from_str(&normalized).unwrap();
+    let next = schedule.upcoming(chrono::Utc).next().unwrap();
+
+    assert_eq!(next.weekday(), Weekday::Sun);
+    assert_eq!(next.hour(), 3);
+    assert_eq!(next.minute(), 0);
+}
+
+#[test]
+fn normalize_converts_unix_dow_range() {
+    assert_eq!(normalize_cron("00 06 * * 0-4"), "0 00 06 * * 1-5");
+}
+
+#[test]
+fn next_run_timestamp_returns_none_for_invalid_cron() {
+    assert!(next_run_timestamp("not a cron").is_none());
+}
+
+#[test]
+fn normalize_leaves_out_of_range_dow_untouched() {
+    let normalized = normalize_cron("* * * * 100");
+    assert_eq!(normalized, "0 * * * * 100");
+    assert!(Schedule::from_str(&normalized).is_err());
+}
+
 #[test]
 fn normalization_does_not_break_schedule_parsing() {
     let input = "0 */10 * * * *";

src/utils/file.rs

@@ -175,3 +175,32 @@ pub async fn decrypt_file_stream_gcm(
     writer.flush().await?;
     Ok(())
 }
+
+/// Decrypt a base64 `nonce(12) ‖ ciphertext ‖ tag(16)` AES-256-GCM envelope
+/// using the raw master key (STANDARD base64). Returns the plaintext bytes.
+pub fn decrypt_json_gcm(ciphertext_b64: &str, master_key_b64: &str) -> Result<Vec<u8>> {
+    let master_key_bytes = general_purpose::STANDARD
+        .decode(master_key_b64)
+        .map_err(|_| anyhow::anyhow!("Invalid base64 master key"))?;
+
+    let data = general_purpose::STANDARD
+        .decode(ciphertext_b64)
+        .map_err(|_| anyhow::anyhow!("Invalid base64 ciphertext"))?;
+
+    if data.len() < 12 + 16 {
+        return Err(anyhow::anyhow!("Ciphertext too short"));
+    }
+
+    let key = Key::<Aes256Gcm>::try_from(master_key_bytes.as_slice())
+        .map_err(|_| anyhow::anyhow!("Invalid AES-256 key length"))?;
+    let cipher = Aes256Gcm::new(&key);
+
+    let nonce = Nonce::try_from(&data[..12])
+        .map_err(|_| anyhow::anyhow!("Invalid nonce length"))?;
+
+    let plaintext = cipher
+        .decrypt(&nonce, &data[12..])
+        .map_err(|e| anyhow::anyhow!("AES-GCM decryption failed: {:?}", e))?;
+
+    Ok(plaintext)
+}

src/utils/task_manager/cron.rs

@@ -10,9 +10,9 @@ use std::str::FromStr;
 use tracing::debug;
 use tracing::info;
 
-pub fn next_run_timestamp(expr: &str) -> i64 {
-    let schedule = Schedule::from_str(expr).unwrap();
-    schedule.upcoming(Local).next().unwrap().timestamp()
+pub fn next_run_timestamp(expr: &str) -> Option<i64> {
+    let schedule = Schedule::from_str(expr).ok()?;
+    Some(schedule.upcoming(Local).next()?.timestamp())
 }
 
 pub async fn check_and_update_cron(
@@ -38,8 +38,9 @@ pub async fn check_and_update_cron(
         }
 
         Some(cron) => {
-            let cron = normalize_cron(&cron);
-            debug!("Task cron (normalized): {:?}", cron);
+            let raw_cron = cron;
+            let cron = normalize_cron(&raw_cron);
+            debug!("Task cron normalized: unix \"{}\" -> crate \"{}\"", raw_cron, cron);
 
             if exists {
                 let raw: String = conn.hget(&redis_key, "data").await.unwrap();
@@ -50,24 +51,21 @@ pub async fn check_and_update_cron(
                 let metadata_changed = stored.metadata != metadata;
 
                 if cron_changed || args_changed || metadata_changed {
-                    upsert_task(conn, &task_name, task, &cron, args.clone(), metadata)
-                        .await
-                        .unwrap_or_else(|e| {
-                            tracing::error!("Failed to update task {}: {:?}", task_name, e);
-                        });
-
-                    info!(
-                        "Task {} updated (cron: {}, args: {}, metadata: {})",
-                        task_name, cron_changed, args_changed, metadata_changed
-                    );
+                    match upsert_task(conn, &task_name, task, &cron, args.clone(), metadata).await {
+                        Ok(()) => info!(
+                            "Task {} updated (cron: {}, args: {}, metadata: {})",
+                            task_name, cron_changed, args_changed, metadata_changed
+                        ),
+                        Err(e) => {
+                            tracing::error!("Failed to update task {}: {:?}", task_name, e)
+                        }
+                    }
                 }
             } else {
-                upsert_task(conn, &task_name, task, &cron, args, metadata)
-                    .await
-                    .unwrap_or_else(|e| {
-                        tracing::error!("Failed to create task {}: {:?}", task_name, e);
-                    });
-                info!("Task {} created", task_name);
+                match upsert_task(conn, &task_name, task, &cron, args, metadata).await {
+                    Ok(()) => info!("Task {} created", task_name),
+                    Err(e) => tracing::error!("Failed to create task {}: {:?}", task_name, e),
+                }
             }
         }
     }

src/utils/task_manager/scheduler.rs

@@ -48,8 +48,17 @@ pub async fn scheduler_loop(mut conn: MultiplexedConnection) {
                         task_clone.task, e
                     );
                 }
-                let next_ts = next_run_timestamp(&task_clone.cron);
-                let _: () = conn_clone.zadd(SCHEDULE_KEY, &key, next_ts).await.unwrap();
+                match next_run_timestamp(&task_clone.cron) {
+                    Some(next_ts) => {
+                        let _: () = conn_clone.zadd(SCHEDULE_KEY, &key, next_ts).await.unwrap();
+                    }
+                    None => {
+                        error!(
+                            "Invalid cron expression for task={}: {}",
+                            task_clone.task, task_clone.cron
+                        );
+                    }
+                }
             });
         }
         tokio::time::sleep(std::time::Duration::from_secs(1)).await;

src/utils/task_manager/tasks.rs

@@ -16,7 +16,16 @@ pub async fn upsert_task(
     metadata: Option<Value>,
 ) -> redis::RedisResult<()> {
     let key = format!("redbeat:{}", name);
-    let next_ts = next_run_timestamp(cron);
+    let next_ts = match next_run_timestamp(cron) {
+        Some(ts) => ts,
+        None => {
+            return Err(redis::RedisError::from((
+                redis::ErrorKind::Client,
+                "invalid cron expression",
+                cron.to_string(),
+            )));
+        }
+    };
 
     let entry = PeriodicTask {
         task: task.to_string(),

src/utils/text.rs

@@ -1,7 +1,55 @@
 pub fn normalize_cron(expr: &str) -> String {
-    if expr.split_whitespace().count() == 5 {
-        format!("0 {}", expr)
+    let fields: Vec<&str> = expr.split_whitespace().collect();
+
+    let (sec, mut rest): (String, Vec<String>) = match fields.len() {
+        5 => ("0".to_string(), fields.iter().map(|s| s.to_string()).collect()),
+        6 => (
+            fields[0].to_string(),
+            fields[1..].iter().map(|s| s.to_string()).collect(),
+        ),
+        _ => return expr.to_string(),
+    };
+
+    if let Some(last) = rest.last_mut() {
+        *last = convert_dow(last);
+    }
+
+    format!("{} {}", sec, rest.join(" "))
+}
+
+fn convert_dow(field: &str) -> String {
+    field
+        .split(',')
+        .map(convert_dow_part)
+        .collect::<Vec<_>>()
+        .join(",")
+}
+
+fn convert_dow_part(part: &str) -> String {
+    let (base, step) = match part.split_once('/') {
+        Some((b, s)) => (b, Some(s)),
+        None => (part, None),
+    };
+
+    let converted = if let Some((start, end)) = base.split_once('-') {
+        match (start.parse::<u8>(), end.parse::<u8>()) {
+            (Ok(a), Ok(b)) if a <= 7 && b <= 7 => {
+                format!("{}-{}", (a % 7) + 1, (b % 7) + 1)
+            }
+            _ => base.to_string(),
+        }
+    } else if let Ok(n) = base.parse::<u8>() {
+        if n <= 7 {
+            ((n % 7) + 1).to_string()
+        } else {
+            base.to_string()
+        }
     } else {
-        expr.to_string()
+        base.to_string()
+    };
+
+    match step {
+        Some(s) => format!("{}/{}", converted, s),
+        None => converted,
     }
 }