fix(ops): repair broken main-DB backup + harden auth (#71 #427 #429 #428) #1311

Merged

bot-backend merged 1 commit from fix/backup-broken-auth-hardening-71 into main

2026-06-13 15:22:17 +00:00

bot-backend commented

2026-06-13 15:13:28 +00:00

Collaborator

Summary

🔴 #71 КРИТИЧНО: main-DB backup сломан — backup.sh committed 100644, git reset --hard на деплое re-asserts non-exec → cron raw-path Permission denied. Последний дамп 27 мая (17 дней), риск 6.83M ДДУ.

#71 fix

Commit backup.sh как 100755 + chmod +x ops/*.sh в deploy.yml (две защиты).
Sanity-check: дамп <50KB → delete+exit (НЕ перезаписать good битым; retention ТОЛЬКО после verified-good — code-reviewer подтвердил P0-защиту).
Retention keep-N, S3 template (redacted), образец backup-tradein-db.sh.
Prod-команды для Anton в commit-body (git reset + cron bash <path> + smoke-test).

#427/#429/#428

#427 username regex ^[a-z][a-z0-9_.-]{1,62}$ + literal-escape dotted.
#429 list_users.sh grep→awk (anchored basic_auth блок, 15 users verified).
#428 PILOT_ACCESS.md email → pilot@gendsgn.ru.

Test plan

code-reviewer ✅ APPROVE (mode bit 100755 verified, sanity-логика держит — битый backup не удалит good, auth regex/awk verified)
bash -n clean все 4 скрипта
post-deploy (Anton): git reset на VPS + cron bash + smoke (fresh >50KB dump)

Closes #71
Closes #427
Closes #429
Closes #428

## Summary 🔴 **#71 КРИТИЧНО**: main-DB backup сломан — `backup.sh` committed 100644, `git reset --hard` на деплое re-asserts non-exec → cron raw-path Permission denied. **Последний дамп 27 мая (17 дней), риск 6.83M ДДУ.** ### #71 fix - Commit `backup.sh` как **100755** + `chmod +x ops/*.sh` в deploy.yml (две защиты). - Sanity-check: дамп <50KB → delete+exit (НЕ перезаписать good битым; retention ТОЛЬКО после verified-good — code-reviewer подтвердил P0-защиту). - Retention keep-N, S3 template (redacted), образец backup-tradein-db.sh. - **Prod-команды для Anton в commit-body** (git reset + cron `bash <path>` + smoke-test). ### #427/#429/#428 - #427 username regex `^[a-z][a-z0-9_.-]{1,62}$` + literal-escape dotted. - #429 list_users.sh grep→awk (anchored basic_auth блок, 15 users verified). - #428 PILOT_ACCESS.md email → pilot@gendsgn.ru. ## Test plan - [x] code-reviewer ✅ APPROVE (mode bit 100755 verified, sanity-логика держит — битый backup не удалит good, auth regex/awk verified) - [x] bash -n clean все 4 скрипта - [ ] post-deploy (Anton): git reset на VPS + cron `bash` + smoke (fresh >50KB dump) Closes #71 Closes #427 Closes #429 Closes #428

bot-backend added 1 commit 2026-06-13 15:13:29 +00:00

fix(ops): repair broken main-DB backup + harden auth scripts/docs (#71 #427 #429 #428 )

CI / changes (push) Successful in 7s

Details

CI / backend-tests (push) Has been skipped

Details

CI / frontend-tests (push) Has been skipped

Details

CI / changes (pull_request) Successful in 6s

Details

CI / backend-tests (pull_request) Has been skipped

Details

CI / frontend-tests (pull_request) Has been skipped

Details

Deploy / build-backend (push) Blocked by required conditions

Details

Deploy / build-worker (push) Blocked by required conditions

Details

Deploy / build-frontend (push) Blocked by required conditions

Details

Deploy / deploy (push) Blocked by required conditions

Details

Deploy / changes (push) Has been cancelled

Details

6883d14177

#71 (CRITICAL): backup.sh committed 100644 → git reset --hard on deploy
re-asserts non-exec mode → raw-path cron fails Permission denied (last good
dump 2026-05-27, no S3). Commit 100755 + chmod ops/*.sh in deploy.yml +
size sanity-check (never prune good dumps for a truncated one) + keep-N
retention + optional S3 (redacted /etc/default template). Modeled on the
working backup-tradein-db.sh.

#427: widen basic_auth username regex ^[a-z][a-z0-9_.-]{1,62}$ + literal-escape
  dotted names in grep probes.
#429: replace list_users.sh false-positive grep with anchored awk over basic_auth block.
#428: PILOT_ACCESS.md support email → pilot@gendsgn.ru.

Closes #71
Closes #427
Closes #429
Closes #428