@scalio-cloud/ui 0.34.0 → 0.35.0

package/README.md

@@ -356,6 +356,29 @@ to `accountTo` (the profile page) instead of allowing the reset.
 `SettingsField` (label, field, help) and `SettingsRow` (title and help left, a switch or button right; `tone="danger"`)
 keep the fields inside a `SettingsSection` the same in every app.
 
+## Gruppe System: Sicherung (React)
+
+Since 0.35.0 (ADR 0069 W5) Einstellungen → System → Sicherung is the same in every app. Backend: scalio-backup 0.2.0
+`web.backup_router` (`/api/backup/status`, `/api/backup/export…`, `/api/backup/import/…`), the lock for the import is
+scalio-platform 0.14.0 `maintenance`.
+
+```jsx
+import { BackupPanel, MaintenanceNotice, backupApi, isMaintenance } from "@scalio-cloud/ui/react";
+
+const backup = backupApi(api);   // once, outside the component
+<BackupPanel client={backup} lang={lang} accountTo="/profile" link={Link} onSignIn={() => logout()}
+  labels={{ backup: { withDataOn: "Konfiguration plus Scans, Abweichungen und Protokoll." } }} />
+
+// while an import runs the API answers 423: show this instead of the page, it reloads once the lock is gone
+{maintenance && <MaintenanceNotice client={backup} lang={lang} />}   // maintenance = isMaintenance(axiosError)
+```
+
+Two areas: «Verschlüsselter Export» (data and secrets switches, file password twice, note, password and code of the
+admin, one download) and «Import» (upload in chunks, file password, preview with the warnings of the backend and the
+app's own warnings as `{code, text}`, confirmation word, other tenant tick, password and code, progress, checklist
+after the import, «Import rückgängig machen» for 7 days). Like the reset, an account without a second factor cannot
+start either and is sent to `accountTo`. `BackupExport` and `BackupImport` are the two areas on their own.
+
 ## Updates im SaaS-Betrieb: Banner und Einstellungen → Updates (React)
 
 Since 0.30.0 (scalio-docs ADR 0074) a SaaS instance shows the update Compass offers it. Server side: scalio-connect

package/nav.css

@@ -814,3 +814,6 @@
 .scalio-facts dt { color: hsl(var(--muted-foreground)); }
 .scalio-facts dd { margin: 0; min-width: 0; overflow-wrap: anywhere; }
 .scalio-page-title .scalio-badge { vertical-align: middle; margin-left: 0.25rem; }
+/* Einstellungen -> Sicherung (BackupPanel, ADR 0069 W5) */
+.scalio-notice > ul, .scalio-notice-body > ul { margin: 0; padding-left: 1.25rem; }
+ul.scalio-notice { flex-direction: column; gap: 0.25rem; padding-left: 2rem; list-style: disc; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalio-cloud/ui",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Scalio Control Room design tokens, Tailwind preset, self-hosted fonts, the shared app header, sign-in layout, sidebar and page blocks",
   "license": "SEE LICENSE IN README.md",
   "private": false,

package/react/backup.js

@@ -0,0 +1,551 @@
+"use strict";
+// Einstellungen -> System -> Sicherung (ADR 0069 wartung/W5; after Nexus BackupSection and ImportSection).
+// Backend: scalio-backup `web.backup_router` (GET /api/backup/status, POST /api/backup/export, /api/backup/import/...).
+const React = require("react");
+const h = React.createElement;
+const Icons = require("./icons");
+const { labelsFor } = require("./labels");
+const { SettingsSection, SettingsField: Field } = require("./settings");
+
+const SMALL_CHUNK = 768 * 1024; // for reverse proxies that keep the 1 MB default body limit
+const CHECKLIST_KEY = "scalio.backupImportChecklist";
+
+function fill(text, vars) {
+  return String(text || "").replace(/\{(\w+)\}/g, (m, k) => (vars && vars[k] !== undefined && vars[k] !== null ? String(vars[k]) : m));
+}
+
+function fmtSize(bytes) {
+  if (!bytes) return "0 B";
+  const u = ["B", "KB", "MB", "GB"];
+  const i = Math.min(u.length - 1, Math.floor(Math.log(bytes) / Math.log(1024)));
+  return `${(bytes / 1024 ** i).toFixed(i ? 1 : 0)} ${u[i]}`;
+}
+
+function fmtDate(iso, lang) {
+  if (!iso) return "–";
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return iso;
+  return d.toLocaleString(lang === "en" ? "en-GB" : "de-CH", { dateStyle: "medium", timeStyle: "short" });
+}
+
+// A backend code (string or {code}) as text; anything unknown is shown as sent.
+function codeText(L, code, fallback) {
+  const E = L.errors || {};
+  if (typeof code !== "string" || !code) return fallback || "";
+  if (E[code]) return E[code];
+  if (code.startsWith("incompatible")) return fill(E.incompatible, { error: code.replace(/^incompatible:\s*/, "") });
+  if (code.startsWith("damaged")) return E.damaged;
+  return fallback || code;
+}
+
+function errText(L, err) {
+  const d = err && err.response && err.response.data && err.response.data.detail;
+  const code = typeof d === "string" ? d : d && d.code;
+  if (code) return codeText(L, code, code);
+  return (err && err.message) || String(err);
+}
+
+// api: axios instance with the app's base URL (/api).
+function backupApi(api) {
+  return {
+    status: () => api.get("/backup/status").then((r) => r.data),
+    startExport: (body) => api.post("/backup/export", body).then((r) => r.data),
+    exportJob: (id) => api.get(`/backup/export/${id}`).then((r) => r.data),
+    download: (id) => api.get(`/backup/export/${id}/download`, { responseType: "blob" }).then((r) => r.data),
+    progress: () => api.get("/backup/import/progress").then((r) => r.data),
+    importStatus: () => api.get("/backup/import/status").then((r) => r.data),
+    newUpload: (body) => api.post("/backup/import/uploads", body).then((r) => r.data),
+    chunk: (id, offset, part) => api.put(`/backup/import/uploads/${id}`, part, {
+      headers: { "Content-Type": "application/octet-stream", "X-Upload-Offset": String(offset) },
+    }).then((r) => r.data),
+    open: (id, password) => api.post(`/backup/import/uploads/${id}/open`, { password }).then((r) => r.data),
+    upload: (id) => api.get(`/backup/import/uploads/${id}`).then((r) => r.data),
+    discard: (id) => api.delete(`/backup/import/uploads/${id}`).then((r) => r.data),
+    apply: (id, body) => api.post(`/backup/import/uploads/${id}/apply`, body).then((r) => r.data),
+    rollback: (body) => api.post("/backup/import/rollback", body).then((r) => r.data),
+  };
+}
+
+function readChecklist() {
+  try { return JSON.parse(window.localStorage.getItem(CHECKLIST_KEY) || "null"); } catch (e) { return null; }
+}
+function writeChecklist(v) {
+  try {
+    if (v) window.localStorage.setItem(CHECKLIST_KEY, JSON.stringify(v));
+    else window.localStorage.removeItem(CHECKLIST_KEY);
+  } catch (e) { /* private mode */ }
+}
+
+function checklistFor(pv) {
+  const codes = new Set(((pv && pv.warnings) || []).map((w) => w.code));
+  const items = ["signIn", "license"];
+  if (codes.has("otherTenant") || codes.has("modeChange")) items.push("connection");
+  if (codes.has("noSecrets")) items.push("secrets");
+  if (codes.has("hostChange")) items.push("address");
+  return items;
+}
+
+// Password (when the account has one) and the second factor, like Zurücksetzen (N21). st: GET /backup/status.
+function reauthReady(st, cur, code) {
+  if (!st || st.secondFactor === false) return false;
+  return (!st.password || !!cur) && !!String(code || "").trim();
+}
+
+function Reauth(props) {
+  const { st, L, prefix, cur, setCur, code, setCode, disabled } = props;
+  if (!st) return null;
+  if (st.secondFactor === false) {
+    return h("div", { className: "scalio-notice is-warn", "data-testid": `${prefix}-no-factor` },
+      h("span", null, L.noFactor),
+      props.accountTo && st.password
+        ? h(props.link || "a", Object.assign({ className: "scalio-btn" },
+            props.link ? { to: props.accountTo } : { href: props.accountTo }), L.setUpFactor)
+        : null);
+  }
+  return h("div", { className: "scalio-settings-form" },
+    h("p", { className: "scalio-field-label" }, h(Icons.KeyRound, { className: "scalio-icon" }), " ", L.reauthTitle),
+    st.password
+      ? h(Field, { id: `${prefix}-current-password`, label: L.currentPassword },
+          h("input", { id: `${prefix}-current-password`, type: "password", className: "scalio-input", value: cur, disabled,
+            autoComplete: "current-password", "data-testid": `${prefix}-current-password`, onChange: (e) => setCur(e.target.value) }))
+      : null,
+    h(Field, { id: `${prefix}-code`, label: L.code },
+      h("input", { id: `${prefix}-code`, className: "scalio-input", value: code, disabled, inputMode: "numeric",
+        autoComplete: "one-time-code", "data-testid": `${prefix}-code`, onChange: (e) => setCode(e.target.value) })));
+}
+
+function useNotify(props) {
+  const [error, setError] = React.useState("");
+  const [note, setNote] = React.useState("");
+  const notify = (text, tone) => {
+    if (props.notify) { props.notify(text, tone); return; }
+    if (tone === "error") { setError(text); setNote(""); } else { setNote(text); setError(""); }
+  };
+  const box = h(React.Fragment, null,
+    error ? h("div", { className: "scalio-notice is-error", role: "alert", "data-testid": `${props.prefix}-error` }, error) : null,
+    note ? h("div", { className: "scalio-notice is-ok", "data-testid": `${props.prefix}-note` }, note) : null);
+  return { notify, box, clear: () => { setError(""); setNote(""); } };
+}
+
+// ------------------------------------------------------------------------------------------------- export ---
+function BackupExport(props) {
+  const { client, lang } = props;
+  const L = labelsFor(lang, props.labels).backup;
+  const n = useNotify({ notify: props.notify, prefix: "backup-export" });
+  const [st, setSt] = React.useState(null);
+  const [pw, setPw] = React.useState("");
+  const [pw2, setPw2] = React.useState("");
+  const [cur, setCur] = React.useState("");
+  const [code, setCode] = React.useState("");
+  const [withData, setWithData] = React.useState(true);
+  const [withSecrets, setWithSecrets] = React.useState(true);
+  const [ack, setAck] = React.useState(false);
+  const [busy, setBusy] = React.useState(false);
+  const [job, setJob] = React.useState(null);
+  const timer = React.useRef(null);
+  const poll = props.pollMs || 1500;
+
+  const watch = (id) => {
+    clearTimeout(timer.current);
+    timer.current = setTimeout(async () => {
+      try {
+        const data = await client.exportJob(id);
+        setJob(data);
+        if (data.status === "running") watch(id);
+        else if (data.status === "failed") n.notify(fill(L.failed, { error: data.error || "" }), "error");
+      } catch (err) { n.notify(errText(L, err), "error"); }
+    }, poll);
+  };
+
+  React.useEffect(() => {
+    let alive = true;
+    client.status().then((data) => {
+      if (!alive) return;
+      setSt(data);
+      if (props.onStatus) props.onStatus(data);
+      const jobs = data.jobs || [];
+      const running = jobs.find((j) => j.status === "running");
+      const ready = jobs.find((j) => j.status === "done");
+      if (running) { setJob(running); watch(running.id); } else if (ready) setJob(ready);
+    }).catch((err) => alive && n.notify(errText(L, err), "error"));
+    return () => { alive = false; clearTimeout(timer.current); };
+  }, [client]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  const minLen = (st && st.minPasswordLength) || 12;
+  const pwOk = pw.length >= minLen && pw === pw2;
+  const running = job && job.status === "running";
+  const disabledReason = st && st.disabled;
+  const ready = !!st && !disabledReason && pwOk && ack && reauthReady(st, cur, code) && !busy && !running;
+
+  const start = async (e) => {
+    e.preventDefault();
+    if (!ready) return;
+    setBusy(true);
+    n.clear();
+    try {
+      const data = await client.startExport({ password: pw, includeData: withData, includeSecrets: withSecrets,
+        currentPassword: cur, mfaCode: code });
+      setJob(data);
+      setPw(""); setPw2(""); setCur(""); setCode(""); setAck(false);
+      watch(data.id);
+    } catch (err) {
+      n.notify(errText(L, err), "error");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const download = async () => {
+    try {
+      const blob = await client.download(job.id);
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement("a");
+      a.href = url;
+      a.download = job.filename || "backup.scaliobak";
+      document.body.appendChild(a);
+      a.click();
+      a.remove();
+      setTimeout(() => URL.revokeObjectURL(url), 10000);
+      setJob(null);
+      n.notify(L.downloaded, "ok");
+    } catch (err) { n.notify(errText(L, err), "error"); }
+  };
+
+  const check = (testId, checked, set, title, on, off) => h("label", { className: "scalio-settings-check" },
+    h("input", { type: "checkbox", checked, disabled: busy, "data-testid": testId, onChange: (e) => set(e.target.checked) }),
+    h("span", null, title, h("span", { className: "scalio-settings-help" }, checked ? on : off)));
+
+  return h(SettingsSection, { id: "backup-export", title: L.exportTitle, description: L.exportHint, testId: "backup-export" },
+    h("form", { className: "scalio-settings-form", onSubmit: start },
+      h("p", { className: "scalio-settings-text" }, L.exportIntro),
+      disabledReason ? h("div", { className: "scalio-notice is-info", "data-testid": "backup-disabled" }, disabledReason) : null,
+      check("backup-with-data", withData, setWithData, L.withData, L.withDataOn, L.withDataOff),
+      check("backup-with-secrets", withSecrets, setWithSecrets, L.withSecrets, L.withSecretsOn, L.withSecretsOff),
+      h("p", { className: "scalio-settings-help" }, L.notIncluded),
+      h(Field, { id: "backup-password", label: L.password, hint: fill(L.passwordHint, { n: minLen }) },
+        h("input", { id: "backup-password", type: "password", className: "scalio-input", value: pw, disabled: busy,
+          autoComplete: "new-password", "data-testid": "backup-password", onChange: (e) => setPw(e.target.value) })),
+      h(Field, { id: "backup-password2", label: L.password2 },
+        h("input", { id: "backup-password2", type: "password", className: "scalio-input", value: pw2, disabled: busy,
+          autoComplete: "new-password", "data-testid": "backup-password2", onChange: (e) => setPw2(e.target.value) }),
+        pw2 && pw !== pw2 ? h("p", { className: "scalio-settings-help is-error", "data-testid": "backup-mismatch" }, L.mismatch) : null),
+      h("div", { className: "scalio-notice is-warn" },
+        h("label", { className: "scalio-settings-check" },
+          h("input", { type: "checkbox", checked: ack, disabled: busy, "data-testid": "backup-ack", onChange: (e) => setAck(e.target.checked) }),
+          h("span", null, L.warning))),
+      h(Reauth, { st, L, prefix: "backup", cur, setCur, code, setCode, disabled: busy, accountTo: props.accountTo, link: props.link }),
+      n.box,
+      job && job.status === "done"
+        ? h("div", { className: "scalio-notice is-ok", "data-testid": "backup-ready" },
+            h("div", { className: "scalio-notice-body" },
+              h("div", { className: "scalio-notice-title" }, L.ready),
+              h("div", { className: "scalio-mono" }, `${job.filename} · ${fmtSize(job.size)} · ${fmtDate(job.finishedAt, lang)}`),
+              h("div", null, L.readyHint)),
+            h("div", { className: "scalio-notice-actions" },
+              h("button", { type: "button", className: "scalio-btn is-solid", onClick: download, "data-testid": "backup-download" },
+                h(Icons.Download, { className: "scalio-icon" }), L.download)))
+        : null,
+      h("div", { className: "scalio-settings-section-footer" },
+        h("button", { type: "submit", className: "scalio-btn is-solid", disabled: !ready, "data-testid": "backup-export-start" },
+          h(Icons.FileStack, { className: "scalio-icon" }), running ? L.running : L.start))));
+}
+
+// ------------------------------------------------------------------------------------------------- import ---
+function warningText(L, w) {
+  const map = { otherTenant: L.wOtherTenant, modeChange: L.wModeChange, hostChange: L.wHostChange, noSecrets: L.wNoSecrets,
+    configOnly: L.wConfigOnly };
+  return w.text || (map[w.code] ? fill(map[w.code], w) : w.code);
+}
+
+function BackupImport(props) {
+  const { client, lang } = props;
+  const L = labelsFor(lang, props.labels).backup;
+  const n = useNotify({ notify: props.notify, prefix: "import" });
+  const [st, setSt] = React.useState(props.status || null);
+  const [status, setStatus] = React.useState(null);
+  const [up, setUp] = React.useState(null);
+  const [sending, setSending] = React.useState(false);
+  const [filePw, setFilePw] = React.useState("");
+  const [confirm, setConfirm] = React.useState("");
+  const [otherOk, setOtherOk] = React.useState(false);
+  const [cur, setCur] = React.useState("");
+  const [code, setCode] = React.useState("");
+  const [busy, setBusy] = React.useState(false);
+  const [progress, setProgress] = React.useState(null);
+  const [checklist, setChecklist] = React.useState(readChecklist());
+  const fileRef = React.useRef(null);
+  const timer = React.useRef(null);
+  const poll = props.pollMs || 1500;
+
+  React.useEffect(() => { if (props.status) setSt(props.status); }, [props.status]);
+
+  const load = async () => {
+    try {
+      if (!props.status) setSt(await client.status());
+      const data = await client.importStatus();
+      setStatus(data);
+      const open = (data.uploads || []).find((u) => ["ready", "opening", "uploaded"].includes(u.status));
+      if (open) setUp(open);
+      if (open && open.status === "opening") watchUpload(open.id);
+    } catch (err) { n.notify(errText(L, err), "error"); }
+  };
+  React.useEffect(() => { load(); return () => clearTimeout(timer.current); }, [client]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  const watchUpload = (id) => {
+    clearTimeout(timer.current);
+    timer.current = setTimeout(async () => {
+      try {
+        const data = await client.upload(id);
+        setUp(data);
+        if (data.status === "opening" || data.status === "applying") watchUpload(id);
+        else if (data.status === "ready" && data.error && progress) setProgress(null);
+      } catch (err) { n.notify(errText(L, err), "error"); }
+    }, poll);
+  };
+
+  const watchProgress = (kind, pv, id) => {
+    clearTimeout(timer.current);
+    timer.current = setTimeout(async () => {
+      try {
+        const data = await client.progress();
+        if (data.active) { setProgress(data); watchProgress(kind, pv, id); return; }
+        if (data.result === "done" || data.result === "rolled_back") {
+          setProgress(null);
+          const list = { kind: data.result, items: kind === "import" ? checklistFor(pv) : ["signIn"],
+            secrets: (((pv && pv.warnings) || []).find((w) => w.code === "noSecrets") || {}).fields || [], at: data.finishedAt };
+          writeChecklist(list);
+          setChecklist(list);
+          setUp(null);
+          return;
+        }
+        // not started (another import, jobs still running) or failed: the upload says why
+        if (id) {
+          const u = await client.upload(id).catch(() => null);
+          if (u && u.status === "applying") { watchProgress(kind, pv, id); return; }
+          setProgress(null);
+          if (u) setUp(u);
+          if (u && u.status === "ready" && u.error) { n.notify(codeText(L, u.error, L.importFailed), "error"); return; }
+        }
+        setProgress(null);
+        n.notify(kind === "import" ? L.importFailed : L.rollbackFailed, "error");
+      } catch (err) { watchProgress(kind, pv, id); }   // 423 or a restart: keep asking
+    }, poll);
+  };
+
+  const sendFile = async (file) => {
+    if (!file) return;
+    if (status && status.maxBytes && file.size > status.maxBytes) { n.notify(L.errors.file_too_large, "error"); return; }
+    setSending(true);
+    n.clear();
+    try {
+      const data = await client.newUpload({ size: file.size, filename: file.name });
+      let current = data;
+      setUp(current);
+      let size = Math.min((status && status.chunkBytes) || 8 * 1024 * 1024, 8 * 1024 * 1024);
+      let offset = 0;
+      while (offset < file.size) {
+        const part = file.slice(offset, offset + size);
+        try {
+          const r = await client.chunk(data.id, offset, part);
+          offset = r.received;
+          current = Object.assign({}, current, { received: offset, status: r.status });
+          setUp(current);
+        } catch (err) {
+          const s = err && err.response && err.response.status;
+          const det = err && err.response && err.response.data && err.response.data.detail;
+          if (s === 413 && size > SMALL_CHUNK) { size = SMALL_CHUNK; continue; }
+          if (s === 409 && det && det.code === "bad_offset") { offset = det.received; continue; }
+          throw err;
+        }
+      }
+    } catch (err) {
+      n.notify(errText(L, err), "error");
+      setUp(null);
+    } finally {
+      setSending(false);
+      if (fileRef.current) fileRef.current.value = "";
+    }
+  };
+
+  const openFile = async (e) => {
+    if (e) e.preventDefault();
+    setBusy(true);
+    n.clear();
+    try {
+      const data = await client.open(up.id, filePw);
+      setUp(data);
+      setFilePw("");
+      watchUpload(data.id);
+    } catch (err) { n.notify(errText(L, err), "error"); } finally { setBusy(false); }
+  };
+
+  const discard = async () => {
+    try { if (up && up.id) await client.discard(up.id); } catch (err) { /* gone already */ }
+    setUp(null); setConfirm(""); setOtherOk(false);
+  };
+
+  const apply = async (e) => {
+    e.preventDefault();
+    setBusy(true);
+    n.clear();
+    try {
+      const pv = up.preview;
+      await client.apply(up.id, { confirm, confirmOtherTenant: otherOk, currentPassword: cur, mfaCode: code });
+      setCur(""); setCode("");
+      setUp(Object.assign({}, up, { status: "applying", error: null }));
+      setProgress({ active: true, kind: "import", phase: "waiting" });
+      watchProgress("import", pv, up.id);
+    } catch (err) { n.notify(errText(L, err), "error"); } finally { setBusy(false); }
+  };
+
+  const undo = async () => {
+    if (!window.confirm(L.rollbackConfirm)) return;
+    setBusy(true);
+    n.clear();
+    try {
+      await client.rollback({ currentPassword: cur, mfaCode: code });
+      setCur(""); setCode("");
+      setProgress({ active: true, kind: "rollback", phase: "waiting" });
+      watchProgress("rollback", null, null);
+    } catch (err) { n.notify(errText(L, err), "error"); } finally { setBusy(false); }
+  };
+
+  const pv = up && up.preview;
+  const last = status && status.last;
+  const running = progress && progress.active;
+  const reauthOk = reauthReady(st, cur, code);
+  const reauth = (prefix) => h(Reauth, { st, L, prefix, cur, setCur, code, setCode, disabled: busy, accountTo: props.accountTo, link: props.link });
+  const row = (label, value, mono) => h(React.Fragment, null, h("dt", null, label), h("dd", { className: mono ? "scalio-mono" : undefined }, value || "–"));
+  const confirmOk = pv && confirm.trim().toLowerCase() === String(pv.confirmWord).toLowerCase();
+
+  return h(SettingsSection, { id: "backup-import", title: L.importTitle, description: L.importHint, testId: "backup-import" },
+    h("div", { className: "scalio-settings-form" },
+      h("p", { className: "scalio-settings-text" }, L.importIntro),
+      running
+        ? h("div", { className: "scalio-notice is-info", "data-testid": "import-running" },
+            h("span", null, `${progress.kind === "rollback" ? L.rollbackRunning : L.importRunning} · ${(L.phase || {})[progress.phase || "waiting"] || ""}`))
+        : null,
+      checklist && !running
+        ? h("div", { className: "scalio-notice is-ok", "data-testid": "import-checklist" },
+            h("div", { className: "scalio-notice-body" },
+              h("div", { className: "scalio-notice-title" }, checklist.kind === "rolled_back" ? L.rollbackDone : L.importDone),
+              h("ul", null, checklist.items.map((k) => h("li", { key: k }, fill((L.check || {})[k], { fields: (checklist.secrets || []).join(", ") }))))),
+            h("div", { className: "scalio-notice-actions" },
+              h("button", { type: "button", className: "scalio-btn is-solid", "data-testid": "import-sign-in",
+                onClick: () => { writeChecklist(null); if (props.onSignIn) props.onSignIn(); else window.location.assign("/"); } }, L.signInAgain),
+              h("button", { type: "button", className: "scalio-btn", onClick: () => { writeChecklist(null); setChecklist(null); } }, L.checklistDismiss)))
+        : null,
+      !running && !up
+        ? h("div", { className: "scalio-settings-section-footer" },
+            h("input", { ref: fileRef, type: "file", accept: ".scaliobak", hidden: true, "data-testid": "import-file",
+              onChange: (e) => sendFile(e.target.files && e.target.files[0]) }),
+            h("span", { className: "scalio-settings-help" }, fill(L.maxSize, { n: Math.round(((status && status.maxBytes) || 2 * 1024 ** 3) / 1024 ** 3) })),
+            h("button", { type: "button", className: "scalio-btn", disabled: sending, "data-testid": "import-choose",
+              onClick: () => fileRef.current && fileRef.current.click() }, h(Icons.Upload, { className: "scalio-icon" }), L.chooseFile))
+        : null,
+      !running && up && up.status === "uploading"
+        ? h("div", { "data-testid": "import-uploading" },
+            h("p", { className: "scalio-settings-text" }, fill(L.uploading, { name: up.filename })),
+            h("progress", { max: up.size || 1, value: up.received || 0, style: { width: "100%" } }))
+        : null,
+      !running && up && (up.status === "uploaded" || up.status === "opening")
+        ? h("form", { className: "scalio-settings-form", onSubmit: openFile, "data-testid": "import-password" },
+            h("p", { className: "scalio-settings-text" }, fill(L.uploaded, { name: up.filename })),
+            up.error ? h("div", { className: "scalio-notice is-error", "data-testid": "import-upload-error" }, codeText(L, up.error, L.importFailed)) : null,
+            h(Field, { id: "import-file-password", label: L.filePassword },
+              h("input", { id: "import-file-password", type: "password", className: "scalio-input", value: filePw, autoComplete: "off",
+                disabled: busy || up.status === "opening", "data-testid": "import-file-password", onChange: (e) => setFilePw(e.target.value) })),
+            h("div", { className: "scalio-settings-section-footer" },
+              h("button", { type: "button", className: "scalio-btn", onClick: discard }, L.discard),
+              h("button", { type: "submit", className: "scalio-btn is-solid", disabled: busy || !filePw || up.status === "opening", "data-testid": "import-open" },
+                up.status === "opening" ? L.checking : L.openFile)))
+        : null,
+      !running && up && up.status === "failed"
+        ? h("div", { className: "scalio-notice is-error", "data-testid": "import-failed" },
+            h("span", { className: "scalio-notice-body" }, codeText(L, up.error, L.importFailed)),
+            h("div", { className: "scalio-notice-actions" }, h("button", { type: "button", className: "scalio-btn", onClick: discard }, L.discard)))
+        : null,
+      !running && up && up.status === "ready" && pv
+        ? h("form", { className: "scalio-settings-form", onSubmit: apply, "data-testid": "import-preview" },
+            up.error ? h("div", { className: "scalio-notice is-error", "data-testid": "import-apply-error" }, codeText(L, up.error, L.importFailed)) : null,
+            h("dl", { className: "scalio-audit-dl" },
+              row(L.pvSource, `${(pv.source && pv.source.host) || "–"} (${(pv.source && pv.source.mode) || "–"})`),
+              row(L.pvTenant, pv.source && pv.source.tenant, true),
+              row(L.pvCreated, `${fmtDate(pv.createdAt, lang)} · ${pv.createdBy || "–"}`),
+              row(L.pvVersion, pv.appVersion),
+              row(L.pvContent, pv.includeData ? L.withDataOn : L.withDataOff)),
+            pv.warnings && pv.warnings.length
+              ? h("ul", { className: "scalio-notice is-warn", "data-testid": "import-warnings" },
+                  pv.warnings.map((w, i) => h("li", { key: `${w.code}-${i}` }, warningText(L, w))))
+              : null,
+            pv.otherTenant
+              ? h("label", { className: "scalio-settings-check" },
+                  h("input", { type: "checkbox", checked: otherOk, "data-testid": "import-other-tenant", onChange: (e) => setOtherOk(e.target.checked) }),
+                  h("span", null, L.confirmOtherTenant))
+              : null,
+            h("div", { className: "scalio-notice is-error" }, L.overwriteWarning),
+            h(Field, { id: "import-confirm", label: fill(L.typeToConfirm, { word: pv.confirmWord }) },
+              h("input", { id: "import-confirm", className: "scalio-input scalio-mono", value: confirm, autoComplete: "off",
+                placeholder: pv.confirmWord, "data-testid": "import-confirm", onChange: (e) => setConfirm(e.target.value) })),
+            reauth("import"),
+            h("div", { className: "scalio-settings-section-footer" },
+              h("button", { type: "button", className: "scalio-btn", onClick: discard }, L.discard),
+              h("button", { type: "submit", className: "scalio-btn is-danger is-solid", "data-testid": "import-apply",
+                disabled: busy || !reauthOk || !confirmOk || (pv.otherTenant && !otherOk) }, L.applyImport)))
+        : null,
+      !running && !up && last && last.canRollback
+        ? h("div", { className: "scalio-settings-form", "data-testid": "import-rollback" },
+            h("p", { className: "scalio-settings-text" },
+              fill(L.lastImport, { at: fmtDate(last.finished_at, lang), by: last.imported_by || "–", host: (last.source && last.source.host) || "–" }),
+              " ", fill(L.rollbackUntil, { at: fmtDate(last.rollbackUntil, lang) })),
+            reauth("rollback"),
+            h("div", { className: "scalio-settings-section-footer" },
+              h("button", { type: "button", className: "scalio-btn", disabled: busy || !reauthOk, onClick: undo, "data-testid": "import-undo" },
+                h(Icons.RotateCcw, { className: "scalio-icon" }), L.rollback)))
+        : null,
+      n.box,
+      h("p", { className: "scalio-settings-help" }, L.ageHint)));
+}
+
+// Both areas of Einstellungen -> System -> Sicherung. Props: client (backupApi), lang, labels (backup: {...}
+// overrides, e.g. the app's own withDataOn), notify(text, tone), accountTo + link (where to set up the authenticator
+// app), onSignIn() after an import (default: go to /), pollMs (tests).
+function BackupPanel(props) {
+  const [st, setSt] = React.useState(null);
+  return h(React.Fragment, null,
+    h(BackupExport, Object.assign({}, props, { onStatus: setSt })),
+    st ? h(BackupImport, Object.assign({}, props, { status: st })) : null);
+}
+
+// 423 from the API while an import or rollback runs (scalio-platform maintenance). The app shows this instead of its
+// pages; it asks for the progress and reloads once the lock is gone. Props: client (backupApi), lang, labels, pollMs.
+function isMaintenance(err) {
+  const r = err && err.response;
+  return !!(r && r.status === 423);
+}
+
+function MaintenanceNotice(props) {
+  const { client, lang } = props;
+  const L = labelsFor(lang, props.labels).backup;
+  const [p, setP] = React.useState(props.progress || { active: true, kind: "import", phase: "waiting" });
+  React.useEffect(() => {
+    let alive = true;
+    let t = null;
+    const tick = async () => {
+      try {
+        const data = await client.progress();
+        if (!alive) return;
+        setP(data);
+        if (!data.active) { if (props.onDone) props.onDone(data); else window.location.reload(); return; }
+      } catch (e) { /* the server restarts: keep asking */ }
+      if (alive) t = setTimeout(tick, props.pollMs || 3000);
+    };
+    t = setTimeout(tick, props.pollMs || 3000);
+    return () => { alive = false; clearTimeout(t); };
+  }, [client]); // eslint-disable-line react-hooks/exhaustive-deps
+  const what = p.kind === "rollback" ? L.maintenanceRollback : L.maintenanceImport;
+  return h("div", { className: "scalio-notice is-info", role: "status", "data-testid": "maintenance-notice" },
+    h("span", null, fill(L.maintenance, { what, phase: p.phase && L.phase && L.phase[p.phase] ? ` (${L.phase[p.phase]})` : "" })));
+}
+
+module.exports = { BackupPanel, BackupExport, BackupImport, MaintenanceNotice, backupApi, isMaintenance };

package/react/icons.js

@@ -132,8 +132,10 @@ const Globe = icon([
   ["path", { d: "M2 12h20" }],
 ]);
 const Clock = icon([["circle", { cx: 12, cy: 12, r: 10 }], ["path", { d: "M12 6v6l4 2" }]]);
+const Upload = icon([["path", { d: "M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" }], ["path", { d: "m17 8-5-5-5 5" }], ["path", { d: "M12 3v12" }]]);
+const RotateCcw = icon([["path", { d: "M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8" }], ["path", { d: "M3 3v5h5" }]]);
 const Download = icon([["path", { d: "M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" }], ["path", { d: "m7 10 5 5 5-5" }], ["path", { d: "M12 15V3" }]]);
 
 module.exports = { Sun, Moon, Monitor, LifeBuoy, BookOpen, LogOut, Menu, Check, X, Search, ChevronDown, Fingerprint, FileStack, ShieldCheck, Hammer, Activity,
   Smartphone, KeyRound, Trash, Copy, Puzzle, Plus, Pencil, Link2, Alert, History, CornerDownLeft,
-  Users, Settings, ScrollText, Info, RadioTower, Globe, Clock, Download };
+  Users, Settings, ScrollText, Info, RadioTower, Globe, Clock, Download, Upload, RotateCcw };

package/react/index.js

@@ -378,6 +378,6 @@ module.exports = {
   TEST_IDS,
   initials,
 };
-Object.assign(module.exports, Nav, Blocks, require("./settings"), require("./support"), require("./beacon"), require("./security"), require("./license"), require("./palette"), require("./unify"), require("./profile"), require("./actions"), require("./selftest"), require("./users"), require("./roles"), require("./wizard"), require("./maintenance"), require("./audit"), require("./mail"), require("./saas_updates"), require("./pages"));
+Object.assign(module.exports, Nav, Blocks, require("./settings"), require("./support"), require("./beacon"), require("./security"), require("./license"), require("./palette"), require("./unify"), require("./profile"), require("./actions"), require("./selftest"), require("./users"), require("./roles"), require("./wizard"), require("./maintenance"), require("./backup"), require("./audit"), require("./mail"), require("./saas_updates"), require("./pages"));
 // After the exports above: auth.js uses LanguageToggle and ThemeToggle from this module.
 Object.assign(module.exports, require("./auth"));

package/react/labels.js

@@ -325,6 +325,104 @@ const LABELS = {
       continue: "Weiter",
       cancel: "Abbrechen",
     },
+    backup: {
+      exportTitle: "Verschlüsselter Export",
+      exportHint: "Eine Datei mit allem, was diese Instanz enthält, geschützt mit Ihrem Passwort.",
+      exportIntro: "Exportieren Sie alles, was in dieser Instanz eingestellt ist, in eine Datei, die mit einem Passwort Ihrer Wahl geschützt ist. Nutzen Sie sie als Sicherung oder für den Umzug zwischen Self-hosted und SaaS. Ein Import überschreibt die Zielinstanz vollständig.",
+      withData: "Daten einschliessen",
+      withDataOn: "Konfiguration plus Daten wie Protokoll, Berichte und erfasste Einträge.",
+      withDataOff: "Nur Konfiguration (Einstellungen, Vorlagen, Rollen, Konten).",
+      withSecrets: "Geheimnisse einschliessen",
+      withSecretsOn: "Passwörter, Client-Secrets und Zertifikate kommen in die verschlüsselte Datei; das Ziel funktioniert sofort.",
+      withSecretsOff: "Geheimnisse bleiben leer; Sie geben sie nach dem Import erneut ein.",
+      notIncluded: "Nie enthalten: Lizenzschlüssel, Installations-ID, Sitzungen und zwischengespeicherte Daten (die Instanz baut sie neu auf).",
+      password: "Datei-Passwort",
+      password2: "Passwort wiederholen",
+      passwordHint: "Mindestens {n} Zeichen. Ohne dieses Passwort lässt sich die Datei nicht öffnen, auch nicht durch Scalio.",
+      mismatch: "Die Passwörter stimmen nicht überein.",
+      warning: "Mir ist bewusst, dass die Datei alle Einstellungen dieser Instanz enthält und ohne das Passwort nicht wiederhergestellt werden kann. Ich bewahre das Passwort sicher auf.",
+      reauthTitle: "Identität bestätigen",
+      currentPassword: "Ihr Passwort",
+      code: "Code aus der Authenticator-App oder Backup-Code",
+      noFactor: "Für Sicherung und Import braucht Ihr Konto eine Authenticator-App; richten Sie sie zuerst im Profil ein. Ein Konto, das sich nur mit Microsoft anmeldet, kann das nicht: Das macht ein lokaler Admin mit Authenticator-App.",
+      setUpFactor: "Zum Profil",
+      start: "Export erstellen",
+      running: "Export läuft …",
+      failed: "Export fehlgeschlagen: {error}",
+      ready: "Export bereit",
+      readyHint: "Die Datei kann einmal heruntergeladen werden und wird danach vom Server gelöscht, spätestens nach einer Stunde.",
+      download: "Herunterladen",
+      downloaded: "Datei heruntergeladen und vom Server gelöscht.",
+      importTitle: "Import",
+      importHint: "Diese Instanz aus einer Sicherung wiederherstellen oder eine andere Instanz hierher umziehen.",
+      importIntro: "Stellen Sie diese Instanz aus einer .scaliobak-Datei wieder her oder ziehen Sie eine andere Instanz hierher um. Der Import ersetzt die gesamte Konfiguration und alle Daten dieser Instanz; Sie können ihn 7 Tage lang rückgängig machen.",
+      chooseFile: "Sicherungsdatei wählen",
+      maxSize: "Bis {n} GB",
+      uploading: "{name} wird hochgeladen …",
+      uploaded: "{name} hochgeladen. Geben Sie das Passwort der Datei ein.",
+      filePassword: "Passwort der Datei",
+      openFile: "Datei prüfen",
+      checking: "Wird entschlüsselt und geprüft …",
+      discard: "Verwerfen",
+      pvSource: "Von",
+      pvTenant: "Tenant",
+      pvCreated: "Erstellt",
+      pvVersion: "Version",
+      pvContent: "Inhalt",
+      wOtherTenant: "Die Datei stammt aus einem anderen Tenant ({source}, diese Instanz: {target}). Zwischengespeicherte Daten werden neu aufgebaut.",
+      wModeChange: "Die Datei stammt aus einer {source}-Instanz, diese ist {target}. Prüfen Sie danach die Tenant-Verbindung.",
+      wHostChange: "Die Datei stammt von {source}, diese Instanz läuft unter {target}.",
+      wNoSecrets: "Die Datei wurde ohne Geheimnisse exportiert. Geben Sie sie nach dem Import erneut ein.",
+      wConfigOnly: "Die Datei enthält nur die Konfiguration. Die Daten dieser Instanz bleiben erhalten.",
+      confirmOtherTenant: "Ich bestätige, dass die Konfiguration eines anderen Tenants diese Instanz ersetzt.",
+      overwriteWarning: "Der Import überschreibt alles, was in dieser Instanz eingerichtet ist. Während des Imports ist die Anwendung einige Minuten nicht verfügbar, und alle Sitzungen werden beendet.",
+      typeToConfirm: "Geben Sie zur Bestätigung {word} ein",
+      applyImport: "Importieren und überschreiben",
+      importRunning: "Import läuft, die Anwendung ist im Wartungsmodus",
+      rollbackRunning: "Import wird rückgängig gemacht, die Anwendung ist im Wartungsmodus",
+      phase: { waiting: "laufende Aufgaben werden abgeschlossen", stopping: "Hintergrundaufgaben werden angehalten", importing: "Daten werden ersetzt", rolling_back: "vorheriger Stand wird wiederhergestellt", finishing: "wird abgeschlossen" },
+      importDone: "Import abgeschlossen",
+      rollbackDone: "Import rückgängig gemacht, der vorherige Stand ist zurück",
+      importFailed: "Der Import ist fehlgeschlagen. Der vorherige Stand wurde wiederhergestellt.",
+      rollbackFailed: "Das Rückgängigmachen ist fehlgeschlagen. Prüfen Sie das Protokoll des Servers.",
+      check: {
+        signIn: "Alle Sitzungen wurden beendet: Melden Sie sich erneut an.",
+        license: "Der Lizenzschlüssel bleibt bei dieser Instanz: Prüfen Sie ihn unter Lizenz.",
+        connection: "Prüfen Sie die Tenant-Verbindung.",
+        secrets: "Geben Sie die ausgelassenen Geheimnisse erneut ein: {fields}.",
+        address: "Die Instanz läuft unter einer neuen Adresse: Passkeys registrieren Sie erneut.",
+      },
+      signInAgain: "Erneut anmelden",
+      checklistDismiss: "Erledigt",
+      lastImport: "Letzter Import am {at} durch {by} von {host}.",
+      rollbackUntil: "Er kann bis {at} rückgängig gemacht werden.",
+      rollback: "Import rückgängig machen",
+      rollbackConfirm: "Den letzten Import rückgängig machen? Der Stand vor dem Import kommt zurück, und alle Sitzungen werden beendet.",
+      ageHint: "Die Datei liegt im offenen age-Format vor: Sie können sie mit dem Werkzeug age und Ihrem Passwort auch selbst entschlüsseln.",
+      maintenance: "Die Anwendung ist im Wartungsmodus: {what}{phase}. Die Seite lädt neu, sobald sie fertig ist.",
+      maintenanceImport: "eine Sicherung wird eingespielt",
+      maintenanceRollback: "ein Import wird rückgängig gemacht",
+      errors: {
+        password_too_short: "Das Passwort der Datei ist zu kurz.",
+        password_too_simple: "Das Passwort der Datei ist zu einfach. Verwenden Sie eine längere Passphrase.",
+        wrong_current_password: "Ihr Passwort ist falsch.",
+        wrong_mfa_code: "Der Code ist falsch oder wurde bereits verwendet.",
+        second_factor_missing: "Ihr Konto braucht zuerst eine Authenticator-App.",
+        too_many_attempts: "Zu viele Fehlversuche. Bitte warten Sie einige Minuten.",
+        export_running: "Es läuft bereits ein Export.",
+        import_running: "Es läuft bereits ein Import, ein Rückgängigmachen oder ein Export.",
+        wrong_password: "Das Passwort der Datei ist falsch.",
+        wrong_confirmation: "Die Bestätigung stimmt nicht überein.",
+        confirm_other_tenant: "Bestätigen Sie, dass die Datei aus einem anderen Tenant stammt.",
+        file_too_large: "Die Datei ist grösser als 2 GB.",
+        not_ready: "Die Datei ist noch nicht bereit.",
+        nothing_to_roll_back: "Es gibt keinen Import, der rückgängig gemacht werden kann.",
+        jobs_running: "Eine Hintergrundaufgabe läuft noch länger als 10 Minuten. Es wurde nichts geändert; versuchen Sie es später erneut.",
+        maintenance_running: "Es läuft bereits ein Import oder ein Rückgängigmachen.",
+        incompatible: "Diese Datei kann hier nicht importiert werden: {error}",
+        damaged: "Die Datei ist beschädigt oder keine Sicherung dieser Anwendung.",
+      },
+    },
     reset: {
       title: "Auf Werkseinstellungen zurücksetzen",
       hint: "Alle Daten löschen und die Instanz neu einrichten.",
@@ -737,6 +835,104 @@ const LABELS = {
       continue: "Continue",
       cancel: "Cancel",
     },
+    backup: {
+      exportTitle: "Encrypted export",
+      exportHint: "One file with everything this instance holds, protected by your password.",
+      exportIntro: "Export everything configured in this instance into one file protected by a password of your choice. Use it as a backup or to move between self-hosted and SaaS. An import overwrites the target instance completely.",
+      withData: "Include data",
+      withDataOn: "Configuration plus data such as the log, reports and the records you entered.",
+      withDataOff: "Configuration only (settings, templates, roles, accounts).",
+      withSecrets: "Include secrets",
+      withSecretsOn: "Passwords, client secrets and certificates go into the encrypted file; the target works right away.",
+      withSecretsOff: "Secrets are left empty; you enter them again after the import.",
+      notIncluded: "Never included: license key, installation ID, sessions and cached data (the instance builds it again).",
+      password: "File password",
+      password2: "Repeat password",
+      passwordHint: "At least {n} characters. Without this password the file cannot be opened, not even by Scalio.",
+      mismatch: "The passwords do not match.",
+      warning: "I understand that the file contains all settings of this instance and cannot be restored without the password. I will keep the password in a safe place.",
+      reauthTitle: "Confirm your identity",
+      currentPassword: "Your password",
+      code: "Code from the authenticator app or a backup code",
+      noFactor: "Backup and import need an authenticator app on your account; set it up in your profile first. An account that signs in only with Microsoft cannot do it: a local admin with an authenticator app does it.",
+      setUpFactor: "Go to profile",
+      start: "Create export",
+      running: "Export is running …",
+      failed: "Export failed: {error}",
+      ready: "Export ready",
+      readyHint: "The file can be downloaded once and is deleted from the server afterwards, at the latest after one hour.",
+      download: "Download",
+      downloaded: "File downloaded and deleted from the server.",
+      importTitle: "Import",
+      importHint: "Restore this instance from a backup or move another instance here.",
+      importIntro: "Restore this instance from a .scaliobak file or move another instance here. The import replaces all configuration and data of this instance; you can undo it for 7 days.",
+      chooseFile: "Choose backup file",
+      maxSize: "Up to {n} GB",
+      uploading: "Uploading {name} …",
+      uploaded: "{name} uploaded. Enter the password of the file.",
+      filePassword: "Password of the file",
+      openFile: "Check file",
+      checking: "Decrypting and checking …",
+      discard: "Discard",
+      pvSource: "From",
+      pvTenant: "Tenant",
+      pvCreated: "Created",
+      pvVersion: "Version",
+      pvContent: "Content",
+      wOtherTenant: "The file comes from another tenant ({source}, this instance: {target}). Cached data is built again.",
+      wModeChange: "The file comes from a {source} instance, this one is {target}. Check the tenant connection afterwards.",
+      wHostChange: "The file comes from {source}, this instance runs on {target}.",
+      wNoSecrets: "The file was exported without secrets. Enter them again after the import.",
+      wConfigOnly: "The file contains configuration only. The data of this instance is kept.",
+      confirmOtherTenant: "I confirm that the configuration of another tenant replaces this instance.",
+      overwriteWarning: "The import overwrites everything that is set up in this instance. During the import the application is unavailable for a few minutes and every session ends.",
+      typeToConfirm: "Type {word} to confirm",
+      applyImport: "Import and overwrite",
+      importRunning: "Import is running, the application is in maintenance",
+      rollbackRunning: "Undoing the import, the application is in maintenance",
+      phase: { waiting: "letting running tasks finish", stopping: "stopping background tasks", importing: "replacing data", rolling_back: "restoring the previous state", finishing: "finishing" },
+      importDone: "Import complete",
+      rollbackDone: "Import undone, the previous state is back",
+      importFailed: "The import failed. The previous state was restored.",
+      rollbackFailed: "Undoing the import failed. Check the server log.",
+      check: {
+        signIn: "Every session was ended: sign in again.",
+        license: "The license key stays with this instance: check it under License.",
+        connection: "Check the tenant connection.",
+        secrets: "Enter the secrets that were left out again: {fields}.",
+        address: "The instance runs on a new address: register passkeys again.",
+      },
+      signInAgain: "Sign in again",
+      checklistDismiss: "Done",
+      lastImport: "Last import on {at} by {by} from {host}.",
+      rollbackUntil: "It can be undone until {at}.",
+      rollback: "Undo import",
+      rollbackConfirm: "Undo the last import? The state from before the import comes back and every session ends.",
+      ageHint: "The file is in the open age format: you can also decrypt it yourself with the age tool and your password.",
+      maintenance: "The application is in maintenance: {what}{phase}. The page reloads once it is done.",
+      maintenanceImport: "a backup is being imported",
+      maintenanceRollback: "an import is being undone",
+      errors: {
+        password_too_short: "The file password is too short.",
+        password_too_simple: "The file password is too simple. Use a longer passphrase.",
+        wrong_current_password: "Your password is wrong.",
+        wrong_mfa_code: "The code is wrong or already used.",
+        second_factor_missing: "Your account needs an authenticator app first.",
+        too_many_attempts: "Too many failed attempts. Please wait a few minutes.",
+        export_running: "An export is already running.",
+        import_running: "An import, rollback or export is already running.",
+        wrong_password: "The file password is wrong.",
+        wrong_confirmation: "The confirmation does not match.",
+        confirm_other_tenant: "Confirm that the file comes from another tenant.",
+        file_too_large: "The file is larger than 2 GB.",
+        not_ready: "The file is not ready yet.",
+        nothing_to_roll_back: "There is no import to undo.",
+        jobs_running: "A background task is still running after 10 minutes. Nothing was changed; try again later.",
+        maintenance_running: "An import or rollback is already running.",
+        incompatible: "This file cannot be imported here: {error}",
+        damaged: "The file is damaged or not a backup of this application.",
+      },
+    },
     reset: {
       title: "Reset to factory settings",
       hint: "Wipe all data and set the instance up again.",
@@ -847,6 +1043,7 @@ function labelsFor(lang, overrides) {
     passwordPolicy: Object.assign({}, base.passwordPolicy, o.passwordPolicy),
     profile_: Object.assign({}, base.profile_, o.profile_),
     wizard: Object.assign({}, base.wizard, o.wizard),
+    backup: Object.assign({}, base.backup, o.backup),
   });
 }