v0.25.4

docs/API.md

@@ -66,6 +66,7 @@ framework extraction failures are not guaranteed to have that JSON shape.
 | `GET /healthz` | Public process health/version; not a backend health probe |
 | `GET /api/config` | `{revision, config}` |
 | `GET /api/config/history` | Retained revision metadata; `?revision=N` returns that document plus the previous retained document |
+| `POST /api/config/history/restore` | Input `{revision, expected_revision}`; validates the older retained document and publishes it as a new configuration revision |
 | `PUT /api/config` | Input `{expected_revision, config}`; returns the applied envelope; retained for atomic multi-section changes |
 | `PUT /api/config/{section}` | Input `{expected_revision, value}`; replaces one validated section and returns the applied envelope |
 | `GET /api/backends` | Authenticated per-vhost backend observations and active/desired frontend plans |
@@ -87,7 +88,7 @@ and rechecks session validity. It does not queue an unlimited per-viewer event l
 or guarantee replay. The browser falls back to polling. An active dashboard renews
 idle activity, not the absolute session deadline.
 
-Configuration history retains the newest 512 successful manual/configuration revisions in SQLite schema 8. `GET /api/config/history` is session-protected like the rest of the administration API; `limit` is bounded to 512 and `revision` selects one retained revision for diff/inspection.
+Configuration history retains the newest 512 successful manual/configuration revisions in SQLite schema 8. `GET /api/config/history` is session-protected like the rest of the administration API; `limit` is bounded to 512 and `revision` selects one retained revision for diff/inspection. `POST /api/config/history/restore` also requires the normal CSRF/request-marker protections, rejects stale `expected_revision`, and never rewinds the revision counter: restoring revision 85 while current revision is 120 creates revision 121.
 
 Configuration updates return 409 for a stale revision, 422 for validation failure
 and 429 when the eight-operation update admission bound is reached. Persistence and

docs/API_ACCESS.md

@@ -1,4 +1,4 @@
-# Administration API access - 0.25.3
+# Administration API access - 0.25.4
 
 ## Sign-in boundary
 

docs/INSTALL.md

@@ -1,4 +1,4 @@
-# Installing and updating RustProxy 0.25.3
+# Installing and updating RustProxy 0.25.4
 
 The scripts prepare a Linux/systemd installation. This source archive is **not a
 verified production build**: Rust/Cargo, real CA operations, live systemd startup

docs/MIGRATION.md

@@ -1,5 +1,9 @@
 # Deployment and configuration migration history
 
+## 0.25.3 -> 0.25.4
+
+There is no SQLite schema or saved-configuration migration. Schema 8 and the existing 512-row `configuration_history` retention remain unchanged. Version 0.25.4 adds an authenticated restore operation that validates a retained document and saves it as a new revision; existing history is not rewound or overwritten.
+
 ## 0.25.2 -> 0.25.3
 
 SQLite schema 7 is upgraded automatically to schema 8. The migration adds `configuration_history`; on first open the current revision is seeded into history, and subsequent successful configuration saves retain the newest 512 revisions for the dashboard revision-history view. No manual SQL is required.

docs/README.md

@@ -8,7 +8,8 @@ This is the canonical index for the current project documentation. The authentic
 - [ROADMAP](../ROADMAP.md) - planned and completed release scope.
 - [CHANGELOG](../CHANGELOG.md) - user/operator-visible changes by release.
 - [TODO](TODO.md) - open work only; completed work is not retained as TODO.
-- [0.25.3 release audit](V0.25.3_AUDIT.md) - request-method policy, location ACL/country controls, hashed request IDs and configuration-history scope plus release gates.
+- [0.25.4 release audit](V0.25.4_AUDIT.md) - retained configuration restore, CAS/audit behavior and release gates.
+- [0.25.3 release audit](V0.25.3_AUDIT.md) - historical request-method policy, location ACL/country controls, hashed request IDs and configuration-history scope.
 - [0.25.2 release audit](V0.25.2_AUDIT.md) - historical live backup, internal symlink and resumed-origin recovery scope.
 - [0.25.1 release audit](V0.25.1_AUDIT.md) - historical Traffic/module-split release scope and compiler-regression guards.
 - [0.25.0 specification audit](V0.25.0_AUDIT.md) - Web Server foundation point-by-point implementation status.
@@ -58,7 +59,7 @@ This is the canonical index for the current project documentation. The authentic
 
 ## Historical or version-labelled context
 
-Version-labelled `V*.md` files are retained as historical implementation/audit records. Their version number describes the audited milestone; they are not current-release documentation. The current audit is [V0.25.3_AUDIT.md](V0.25.3_AUDIT.md); [V0.25.2_AUDIT.md](V0.25.2_AUDIT.md) records the prior backup/session hardening milestone and [V0.25.1_AUDIT.md](V0.25.1_AUDIT.md) records the prior Traffic/module-split milestone and [V0.25.0_AUDIT.md](V0.25.0_AUDIT.md) remains the Web Server foundation audit.
+Version-labelled `V*.md` files are retained as historical implementation/audit records. Their version number describes the audited milestone; they are not current-release documentation. The current audit is [V0.25.4_AUDIT.md](V0.25.4_AUDIT.md); [V0.25.3_AUDIT.md](V0.25.3_AUDIT.md) records the prior request-policy/history milestone and [V0.25.2_AUDIT.md](V0.25.2_AUDIT.md) records the prior backup/session hardening milestone and [V0.25.1_AUDIT.md](V0.25.1_AUDIT.md) records the prior Traffic/module-split milestone and [V0.25.0_AUDIT.md](V0.25.0_AUDIT.md) remains the Web Server foundation audit.
 
 Older context documents such as [INTEGRATIONS_040](INTEGRATIONS_040.md), [MANAGEMENT](MANAGEMENT.md), [SECURITY_AUDIT](SECURITY_AUDIT.md), [ACME_RFC2136](ACME_RFC2136.md) and older version audits remain available for traceability but should not override the current functional/technical documents above.
 

docs/SETTINGS.md

@@ -35,7 +35,7 @@ This is a settings fragment, not a replacement for the existing routing/vhost do
 A complete opt-in example is in `examples/cache-dashboard.json`.
 
 The dashboard exposes the complete raw JSON editor under **Settings -> Manual config**.
-The same card exposes **Revision history**, which reads the newest 512 retained configuration revisions from SQLite schema 8 and groups them by month/day. Selecting a revision shows timestamp, actor and a bounded path-level before/after diff against the previous retained revision.
+The same card exposes **Revision history**, which reads the newest 512 retained configuration revisions from SQLite schema 8 and groups them by month/day. Selecting a revision shows timestamp, actor and a bounded path-level before/after diff against the previous retained revision. An older retained revision can be restored from the same dialog; RustProxy validates it through the normal configuration update path and saves it as a new revision, preserving the prior history.
 The historical `/configuration` browser route is retained only as a compatibility alias and
 opens that Settings block; it is no longer a primary-navigation item. Prefer the structured
 section editors for routine changes so unrelated sections are not republished.

docs/TEST_REPORT.md

@@ -1,8 +1,8 @@
-# Verification report - RustProxy 0.25.3
+# Verification report - RustProxy 0.25.4
 
 ## Scope
 
-RustProxy 0.25.3 adds vhost/location HTTP method policy, location-scoped ACL-profile/IP/country controls, hashed end-to-end request IDs and retained manual-configuration history on top of 0.25.2. SQLite advances from schema 7 to schema 8 through an additive `configuration_history` migration; existing configuration remains compatible and new policy fields default to disabled/inherited behavior. The dashboard adds a calendar-style revision-history dialog without changing the existing Manual config editor workflow.
+RustProxy 0.25.4 adds restore from the retained manual-configuration history introduced in 0.25.3. Selecting an older retained revision validates that historical document through the normal configuration update pipeline and saves it as the next revision instead of rewinding history. SQLite remains at schema 8 with the existing 512-revision retention limit, so upgrading from 0.25.3 requires no database migration.
 
 ## Source contracts reviewed
 
@@ -10,7 +10,9 @@ RustProxy 0.25.3 adds vhost/location HTTP method policy, location-scoped ACL-pro
 - Custom locations can select an `acl_profile_id` and add inline IP ACL plus country access policy. Profile and inline rules are compiled with the route and checked before authentication/backend selection; a location cannot weaken a vhost denial.
 - Every observed exchange receives a fresh 64-hex SHA-256 `request_id`, overwrites inbound `X-Request-ID` before forwarding, and reuses the same value for diagnostics/logging. Custom header rules continue to protect `X-Request-ID`.
 - SQLite schema 8 stores revision/time/actor/document in bounded `configuration_history`; successful CAS writes record history transactionally and retain the newest 512 revisions. The session-protected `/api/config/history` API supports metadata listing and one-revision detail with the previous retained document.
-- The Manual config history UI groups retained revisions by month/day, lists revisions for a selected day and renders a bounded recursive path-level before/after diff using text-only DOM operations.
+- `POST /api/config/history/restore` accepts an older retained revision plus the currently observed `expected_revision`. It rejects stale or non-older targets, reloads the retained document and passes it through the same startup-lock, certificate-removal, compile, cache-invalidation, persistence and hot-publish path as a normal configuration update.
+- Restore persistence uses the existing storage CAS and appends the restored document as the next monotonic revision. The same transaction records `config.restore` with `source_revision=<old> revision=<new>`; the selected historical row is never overwritten.
+- The Manual config history UI groups retained revisions by month/day, lists revisions for a selected day and renders a bounded recursive path-level before/after diff using text-only DOM operations. An older selected revision exposes a confirmation-gated restore action; success refreshes the active envelope and history.
 - `Config.web_services` is a separate persisted collection; vhost/location `source` defaults to Reverse Proxy for old documents and Web Server stores only `web_service_id`.
 - Full configuration compilation validates Web Service IDs, absolute/existing document roots, index names, duplicate IDs and every active Web Service reference. A pure static vhost does not require a backend pool; mixed Web Server and Reverse Proxy locations do.
 - Web Server dispatch occurs after normal frontend routing, ACL and Basic/Tinyauth authorization and before backend selection/DNS/cache/upstream work. Static responses continue through the existing custom error-page, response-header/security, compression and transport pipeline.
@@ -49,7 +51,7 @@ RustProxy 0.25.3 adds vhost/location HTTP method policy, location-scoped ACL-pro
 
 ## Implemented automated coverage
 
-Rust unit tests in `src/web_server/tests.rs` cover GET/HEAD/index/slash redirect, MIME/length, validators, valid/invalid range handling, If-Range, escaped/repeated directory listings, per-directory index-before-listing fallback, generic 403/HEAD behavior, MIME overrides/default MIME, cache rules, source headers, `try_files`, rewrite redirect/internal behavior, `.htaccess` WordPress-style front-controller routing, nested DirectoryIndex/MIME/Header/Expires behavior, strict-mode rejection and PHP-source protection, hardening probe/method blocking and fingerprint-header stripping, precompressed representations/ranges, download headers, PHP FastCGI fixture execution/failure-source-disclosure behavior, request-body 413 enforcement, custom FastCGI/PHP_VALUE validation and reserved-parameter rejection, direct traversal rejection and Unix/Linux symlink policy. `src/traffic/tests.rs` includes bounded-table and effective-client-IP view coverage. Configuration tests cover pure static vhosts without a pool, mixed Web Server/Reverse Proxy routing, reuse of one Web Service by multiple vhosts, unknown service references and backward-compatible default source behavior. Vhost tests cover method-policy normalization/allow/block behavior, and database tests cover retained configuration revision documents, actor metadata and previous-revision lookup. ACL tests include encoded traversal/separator/malformed-encoding cases.
+Rust unit tests in `src/web_server/tests.rs` cover GET/HEAD/index/slash redirect, MIME/length, validators, valid/invalid range handling, If-Range, escaped/repeated directory listings, per-directory index-before-listing fallback, generic 403/HEAD behavior, MIME overrides/default MIME, cache rules, source headers, `try_files`, rewrite redirect/internal behavior, `.htaccess` WordPress-style front-controller routing, nested DirectoryIndex/MIME/Header/Expires behavior, strict-mode rejection and PHP-source protection, hardening probe/method blocking and fingerprint-header stripping, precompressed representations/ranges, download headers, PHP FastCGI fixture execution/failure-source-disclosure behavior, request-body 413 enforcement, custom FastCGI/PHP_VALUE validation and reserved-parameter rejection, direct traversal rejection and Unix/Linux symlink policy. `src/traffic/tests.rs` includes bounded-table and effective-client-IP view coverage. Configuration tests cover pure static vhosts without a pool, mixed Web Server/Reverse Proxy routing, reuse of one Web Service by multiple vhosts, unknown service references and backward-compatible default source behavior. Vhost tests cover method-policy normalization/allow/block behavior, database tests cover retained configuration revision documents, actor metadata and previous-revision lookup, and admin tests cover restoring revision 1 as revision 3 while preserving the previous document and emitting `config.restore`. ACL tests include encoded traversal/separator/malformed-encoding cases.
 
 Rust-independent release checks additionally validate UI/JSON/language/source contracts and reproducible packaging.
 

docs/V0.25.4_AUDIT.md

@@ -0,0 +1,27 @@
+# RustProxy 0.25.4 release audit
+
+RustProxy 0.25.4 adds restore from retained manual-configuration history on top of the schema-8 history introduced in 0.25.3. There is no SQLite schema change.
+
+## Configuration history restore
+
+| Requirement | Status | Evidence |
+| --- | --- | --- |
+| Restore an older retained revision | IMPLEMENTED | `POST /api/config/history/restore` loads the retained document and passes it through the normal configuration validation/update path. |
+| Preserve monotonic revision history | IMPLEMENTED | Restore uses the current `expected_revision` and commits the restored document as the next revision; it never updates or deletes the selected historical row. |
+| Reject stale restore actions | IMPLEMENTED | The endpoint compares `expected_revision` with the current published revision and returns conflict before restore when configuration changed. The storage write retains the existing CAS guard. |
+| Keep restore private and CSRF-protected | IMPLEMENTED | The endpoint is outside the anonymous allowlist and is routed through the existing administrator session, Origin/request-marker and CSRF guard. |
+| Audit restores distinctly | IMPLEMENTED | Restore persistence records `config.restore` with `source_revision=<old> revision=<new>` in the same SQLite transaction as the configuration write/history insert. |
+| Reuse hot-publish behavior | IMPLEMENTED | Restore calls the same compile, listener-lock, certificate-removal, cache-invalidation and immutable snapshot publication path used by ordinary configuration updates. |
+| Provide dashboard restore UX | IMPLEMENTED | The revision-history detail view exposes a restore action only for an older revision, shows an explicit confirmation, refreshes the current envelope after success and reloads history. |
+
+## Compatibility
+
+SQLite remains at schema version 8 and the history capacity remains 512 revisions. Upgrading from 0.25.3 requires no SQL migration. History retention still begins with the schema-8 migration introduced in 0.25.3.
+
+A restore can fail current validation when an older document is no longer valid in the current runtime environment, for example because referenced certificate files, listener constraints or other external prerequisites changed. In that case the active configuration and revision remain unchanged.
+
+## Verification gates
+
+Rust-independent source, language, documentation, OpenAPI, browser JavaScript, security-contract and release-smoke checks are included in the release tree. Rust tests include an authenticated end-to-end restore case that applies two configurations, restores the first as revision 3 and checks the `config.restore` audit entry and retained previous document.
+
+This packaging workspace does not provide the Rust/Cargo toolchain. Compiler-enabled `cargo fmt --all`, `cargo check --locked --all-targets` and `cargo test --locked --all-targets` therefore remain mandatory on a release host before production deployment.