feat(cloud-backup): make Custom S3-compatible target available on every tier (#1143)

* feat(cloud-backup): make Custom S3-compatible target available on every tier

Sencho Cloud Backup remains an Admiral feature; the bring-your-own-bucket
Custom S3 target is now reachable on Community and Skipper as well.

Backend splits the per-route Admiral gate into two helpers: operations
that touch the saved provider use gateForCurrentProvider, PUT /config
uses gateForRequestedProvider against the body. /provision and /usage
stay requireAdmiral because they are Sencho-only by definition; GET
/config is ungated so any tier can read its own stored configuration.

Frontend drops the AdmiralGate wrapper on the Cloud Backup section,
filters the Sencho provider option out of the dropdown for non-Admiral
users, and gates the per-snapshot cloud-upload affordance on
"cloud-backup configured" instead of Admiral tier. Dashboard
Configuration row is no longer locked on lower tiers.

Sidebar registry tier on cloud-backup goes from 'admiral' to null.
Docs and licensing breakdown restate the rule once per page without
fence-spec.

* fix(cloud-backup): keep downgraded sencho config off the upload surface

If an Admiral configured Sencho Cloud Backup and the license later drops
to Skipper or Community, the saved provider is still 'sencho'. The
FleetSnapshots cloud-upload affordance now requires either provider=
custom (every tier) or provider=sencho with an active Admiral license,
so a downgraded admin never sees an upload button that the backend
would 403 on click.

Also tidies the Fleet Backups doc, which still claimed the cloud-upload
icon was Admiral only; the icon now renders whenever a Cloud Backup
target is configured.

backend/src/__tests__/cloud-backup-routes.test.ts

@@ -3,7 +3,7 @@
  * admin gating, config CRUD round-trip with secret encryption, audit logging.
  * The S3 SDK is mocked at the module level so no network calls happen.
  */
-import { describe, it, expect, beforeAll, afterAll, beforeEach, vi } from 'vitest';
+import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach, vi } from 'vitest';
 import request from 'supertest';
 import { setupTestDb, cleanupTestDb, loginAsTestAdmin } from './helpers/setupTestDb';
 
@@ -58,26 +58,146 @@ beforeEach(() => {
     }
 });
 
+// Sticky mocks (mockReturnValue, not mockReturnValueOnce) so a test that does
+// not actually hit a tier-gated codepath doesn't leak its persona into later
+// tests. The afterEach hook resets back to the Admiral baseline.
+function mockCommunity() {
+    vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue('community');
+}
+
+function mockSkipper() {
+    vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue('paid');
+    vi.spyOn(LicenseService.getInstance(), 'getVariant').mockReturnValue('skipper');
+}
+
+afterEach(() => {
+    vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue('paid');
+    vi.spyOn(LicenseService.getInstance(), 'getVariant').mockReturnValue('admiral');
+});
+
+const customConfigBody = {
+    provider: 'custom',
+    custom: {
+        endpoint: 'https://s3.example.com',
+        region: 'us-east-1',
+        bucket: 'b',
+        access_key: 'a',
+        secret_key: 's',
+        path_prefix: 'p/',
+        auto_upload: false,
+    },
+};
+
 describe('Cloud backup tier gating', () => {
-    it('rejects community tier with PAID_REQUIRED', async () => {
-        vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValueOnce('community');
+    // GET /config is ungated — every tier can read the stored configuration.
+    it('GET /config is readable on Community', async () => {
+        mockCommunity();
         const res = await request(app).get('/api/cloud-backup/config').set('Cookie', authCookie);
+        expect(res.status).toBe(200);
+    });
+
+    it('GET /config is readable on Skipper', async () => {
+        mockSkipper();
+        const res = await request(app).get('/api/cloud-backup/config').set('Cookie', authCookie);
+        expect(res.status).toBe(200);
+    });
+
+    it('GET /config is readable on Admiral', async () => {
+        const res = await request(app).get('/api/cloud-backup/config').set('Cookie', authCookie);
+        expect(res.status).toBe(200);
+        expect(res.body).toHaveProperty('provider', 'disabled');
+    });
+
+    // PUT /config: 'custom' is available on every tier, 'sencho' is Admiral-only.
+    it('PUT /config with provider=custom succeeds on Community', async () => {
+        mockCommunity();
+        const res = await request(app).put('/api/cloud-backup/config').set('Cookie', authCookie).send(customConfigBody);
+        expect(res.status).toBe(204);
+    });
+
+    it('PUT /config with provider=custom succeeds on Skipper', async () => {
+        mockSkipper();
+        const res = await request(app).put('/api/cloud-backup/config').set('Cookie', authCookie).send(customConfigBody);
+        expect(res.status).toBe(204);
+    });
+
+    it('PUT /config with provider=sencho is rejected on Community with PAID_REQUIRED', async () => {
+        mockCommunity();
+        const res = await request(app).put('/api/cloud-backup/config').set('Cookie', authCookie).send({ provider: 'sencho' });
         expect(res.status).toBe(403);
         expect(res.body.code).toBe('PAID_REQUIRED');
     });
 
-    it('rejects skipper tier with ADMIRAL_REQUIRED', async () => {
-        vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValueOnce('paid');
-        vi.spyOn(LicenseService.getInstance(), 'getVariant').mockReturnValueOnce('skipper');
-        const res = await request(app).get('/api/cloud-backup/config').set('Cookie', authCookie);
+    it('PUT /config with provider=sencho is rejected on Skipper with ADMIRAL_REQUIRED', async () => {
+        mockSkipper();
+        const res = await request(app).put('/api/cloud-backup/config').set('Cookie', authCookie).send({ provider: 'sencho' });
         expect(res.status).toBe(403);
         expect(res.body.code).toBe('ADMIRAL_REQUIRED');
     });
 
-    it('admiral tier reaches the handler', async () => {
-        const res = await request(app).get('/api/cloud-backup/config').set('Cookie', authCookie);
-        expect(res.status).toBe(200);
-        expect(res.body).toHaveProperty('provider', 'disabled');
+    // POST /provision is Admiral-only by definition (Sencho Cloud Backup activation).
+    it('POST /provision is rejected on Community', async () => {
+        mockCommunity();
+        const res = await request(app).post('/api/cloud-backup/provision').set('Cookie', authCookie);
+        expect(res.status).toBe(403);
+        expect(res.body.code).toBe('PAID_REQUIRED');
+    });
+
+    it('POST /provision is rejected on Skipper', async () => {
+        mockSkipper();
+        const res = await request(app).post('/api/cloud-backup/provision').set('Cookie', authCookie);
+        expect(res.status).toBe(403);
+        expect(res.body.code).toBe('ADMIRAL_REQUIRED');
+    });
+
+    // GET /usage is Admiral-only (sencho-specific endpoint).
+    it('GET /usage is rejected on Community', async () => {
+        mockCommunity();
+        const res = await request(app).get('/api/cloud-backup/usage').set('Cookie', authCookie);
+        expect(res.status).toBe(403);
+    });
+
+    it('GET /usage is rejected on Skipper', async () => {
+        mockSkipper();
+        const res = await request(app).get('/api/cloud-backup/usage').set('Cookie', authCookie);
+        expect(res.status).toBe(403);
+    });
+
+    // POST /test, GET /snapshots, POST /upload, GET /status, GET /object/.../download,
+    // DELETE /object are gated by the *currently saved* provider.
+    it('POST /test reaches handler on Community when saved provider is custom', async () => {
+        DatabaseService.getInstance().updateGlobalSetting('cloud_backup_provider', 'custom');
+        mockCommunity();
+        const res = await request(app).post('/api/cloud-backup/test').set('Cookie', authCookie);
+        expect(res.status).not.toBe(403);
+    });
+
+    it('POST /test is rejected on Community when saved provider is sencho', async () => {
+        DatabaseService.getInstance().updateGlobalSetting('cloud_backup_provider', 'sencho');
+        mockCommunity();
+        const res = await request(app).post('/api/cloud-backup/test').set('Cookie', authCookie);
+        expect(res.status).toBe(403);
+        expect(res.body.code).toBe('PAID_REQUIRED');
+    });
+
+    it('GET /snapshots reaches handler on Community when saved provider is custom', async () => {
+        DatabaseService.getInstance().updateGlobalSetting('cloud_backup_provider', 'custom');
+        mockCommunity();
+        const res = await request(app).get('/api/cloud-backup/snapshots').set('Cookie', authCookie);
+        expect(res.status).not.toBe(403);
+    });
+
+    it('GET /snapshots is rejected on Community when saved provider is sencho', async () => {
+        DatabaseService.getInstance().updateGlobalSetting('cloud_backup_provider', 'sencho');
+        mockCommunity();
+        const res = await request(app).get('/api/cloud-backup/snapshots').set('Cookie', authCookie);
+        expect(res.status).toBe(403);
+    });
+
+    // Admiral retains access to every endpoint.
+    it('Admiral can configure provider=sencho', async () => {
+        const res = await request(app).put('/api/cloud-backup/config').set('Cookie', authCookie).send({ provider: 'sencho' });
+        expect(res.status).toBe(204);
     });
 });
 

backend/src/routes/cloudBackup.ts

@@ -10,6 +10,22 @@ const SCOPE_MESSAGE = 'API tokens cannot manage cloud backup configuration.';
 const SECRET_REDACTED = '***';
 const VALID_PROVIDERS = new Set(['disabled', 'sencho', 'custom']);
 
+// Provider-aware tier gates. The managed Sencho Cloud Backup target requires
+// Admiral; the bring-your-own-bucket Custom S3 target is available on every
+// tier. These wrappers short-circuit to requireAdmiral only when the operation
+// actually touches the 'sencho' provider.
+
+function gateForCurrentProvider(req: Request, res: Response): boolean {
+    const provider = CloudBackupService.getInstance().getProvider();
+    if (provider === 'sencho') return requireAdmiral(req, res);
+    return true;
+}
+
+function gateForRequestedProvider(req: Request, res: Response, requested: string): boolean {
+    if (requested === 'sencho') return requireAdmiral(req, res);
+    return true;
+}
+
 function parseSnapshotIdParam(req: Request, res: Response): number | null {
     const raw = req.params.id as string | undefined;
     const parsed = parseInt(raw ?? '', 10);
@@ -43,7 +59,6 @@ export const cloudBackupRouter = Router();
 
 cloudBackupRouter.get('/config', (req: Request, res: Response): void => {
     if (rejectApiTokenScope(req, res, SCOPE_MESSAGE)) return;
-    if (!requireAdmiral(req, res)) return;
     try {
         const db = DatabaseService.getInstance();
         const settings = db.getGlobalSettings();
@@ -72,7 +87,6 @@ cloudBackupRouter.get('/config', (req: Request, res: Response): void => {
 cloudBackupRouter.put('/config', (req: Request, res: Response): void => {
     if (rejectApiTokenScope(req, res, SCOPE_MESSAGE)) return;
     if (!requireAdmin(req, res)) return;
-    if (!requireAdmiral(req, res)) return;
     try {
         const body = req.body ?? {};
         const provider = body.provider as string | undefined;
@@ -80,6 +94,7 @@ cloudBackupRouter.put('/config', (req: Request, res: Response): void => {
             res.status(400).json({ error: 'provider must be one of: disabled, sencho, custom' });
             return;
         }
+        if (!gateForRequestedProvider(req, res, provider)) return;
         const db = DatabaseService.getInstance();
         const crypto = CryptoService.getInstance();
         db.updateGlobalSetting('cloud_backup_provider', provider);
@@ -125,7 +140,7 @@ cloudBackupRouter.put('/config', (req: Request, res: Response): void => {
 cloudBackupRouter.post('/test', async (req: Request, res: Response): Promise<void> => {
     if (rejectApiTokenScope(req, res, SCOPE_MESSAGE)) return;
     if (!requireAdmin(req, res)) return;
-    if (!requireAdmiral(req, res)) return;
+    if (!gateForCurrentProvider(req, res)) return;
     try {
         const result = await CloudBackupService.getInstance().testConnection();
         res.json(result);
@@ -171,7 +186,7 @@ cloudBackupRouter.get('/usage', async (req: Request, res: Response): Promise<voi
 
 cloudBackupRouter.get('/snapshots', async (req: Request, res: Response): Promise<void> => {
     if (rejectApiTokenScope(req, res, SCOPE_MESSAGE)) return;
-    if (!requireAdmiral(req, res)) return;
+    if (!gateForCurrentProvider(req, res)) return;
     try {
         const entries = await CloudBackupService.getInstance().listCloudSnapshots();
         res.json(entries);
@@ -184,7 +199,7 @@ cloudBackupRouter.get('/snapshots', async (req: Request, res: Response): Promise
 cloudBackupRouter.post('/upload/:id', async (req: Request, res: Response): Promise<void> => {
     if (rejectApiTokenScope(req, res, SCOPE_MESSAGE)) return;
     if (!requireAdmin(req, res)) return;
-    if (!requireAdmiral(req, res)) return;
+    if (!gateForCurrentProvider(req, res)) return;
     const id = parseSnapshotIdParam(req, res);
     if (id == null) return;
     try {
@@ -203,7 +218,7 @@ cloudBackupRouter.post('/upload/:id', async (req: Request, res: Response): Promi
 
 cloudBackupRouter.get('/status/:id', (req: Request, res: Response): void => {
     if (rejectApiTokenScope(req, res, SCOPE_MESSAGE)) return;
-    if (!requireAdmiral(req, res)) return;
+    if (!gateForCurrentProvider(req, res)) return;
     const id = parseSnapshotIdParam(req, res);
     if (id == null) return;
     res.json(CloudBackupService.getInstance().getUploadStatus(id));
@@ -211,7 +226,7 @@ cloudBackupRouter.get('/status/:id', (req: Request, res: Response): void => {
 
 cloudBackupRouter.get('/object/:keyB64/download', async (req: Request, res: Response): Promise<void> => {
     if (rejectApiTokenScope(req, res, SCOPE_MESSAGE)) return;
-    if (!requireAdmiral(req, res)) return;
+    if (!gateForCurrentProvider(req, res)) return;
     const objectKey = decodeObjectKey(req, res);
     if (!objectKey) return;
     try {
@@ -230,7 +245,7 @@ cloudBackupRouter.get('/object/:keyB64/download', async (req: Request, res: Resp
 cloudBackupRouter.delete('/object/:keyB64', async (req: Request, res: Response): Promise<void> => {
     if (rejectApiTokenScope(req, res, SCOPE_MESSAGE)) return;
     if (!requireAdmin(req, res)) return;
-    if (!requireAdmiral(req, res)) return;
+    if (!gateForCurrentProvider(req, res)) return;
     const objectKey = decodeObjectKey(req, res);
     if (!objectKey) return;
     try {

backend/src/routes/dashboard.ts

@@ -148,7 +148,7 @@ export function buildLocalConfigurationStatus(
     backup: {
       provider: cloudProvider,
       autoUpload: cloudAutoUpload,
-      locked: !isAdmiral,
+      locked: false,
       requiredTier: 'admiral',
     },
   };