v0.24.9

src/db.rs

@@ -9,7 +9,7 @@ use sqlx::{
 };
 use std::{path::Path, time::Duration};
 
-pub const SCHEMA_VERSION: i64 = 6;
+pub const SCHEMA_VERSION: i64 = 7;
 pub const CERTIFICATE_API_CREDENTIAL_CAPACITY: i64 = 32;
 pub const AUDIT_CAPACITY: i64 = 10_000;
 
@@ -91,16 +91,50 @@ impl Store {
         sqlx::raw_sql(include_str!("../migrations/0006_certificate_api_credentials.sql"))
             .execute(&mut *tx)
             .await?;
+        sqlx::raw_sql(include_str!("../migrations/0007_secret_store.sql"))
+            .execute(&mut *tx)
+            .await?;
         sqlx::query("INSERT OR IGNORE INTO configuration(id, revision, document) VALUES(1, 0, ?)")
             .bind(serde_json::to_string(initial)?)
             .execute(&mut *tx)
             .await?;
-        sqlx::query("PRAGMA user_version = 6")
+        sqlx::query("PRAGMA user_version = 7")
             .execute(&mut *tx)
             .await?;
         tx.commit().await?;
         Ok(Self { pool })
     }
+    pub async fn backup_to(&self, path: &Path) -> Result<()> {
+        ensure!(!path.exists(), "backup database destination already exists");
+        let path_text = path
+            .to_str()
+            .context("backup database path must be valid UTF-8")?;
+        sqlx::query("VACUUM INTO ?")
+            .bind(path_text)
+            .execute(&self.pool)
+            .await
+            .context("could not create consistent SQLite snapshot")?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600))?;
+        }
+        let options = SqliteConnectOptions::new()
+            .filename(path)
+            .read_only(true)
+            .busy_timeout(Duration::from_secs(5));
+        let check_pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect_with(options)
+            .await?;
+        let result: String = sqlx::query_scalar("PRAGMA quick_check")
+            .fetch_one(&check_pool)
+            .await?;
+        check_pool.close().await;
+        ensure!(result == "ok", "SQLite snapshot integrity check failed");
+        Ok(())
+    }
+
     pub async fn load(&self) -> Result<Envelope> {
         let row = sqlx::query("SELECT revision, document FROM configuration WHERE id = 1")
             .fetch_one(&self.pool)