@summerscar/dsh-mnemon-sync 0.1.0 → 0.1.1

package/client.js

@@ -56,6 +56,7 @@ window.__ModuleLoader__.load({
       componentSpaces: '{count} 个空间',
       backups: '备份列表',
       listBackups: '从目标列出备份',
+      refresh: '刷新',
       backupsHint: '列出远端已存在的备份包，可查看明细并恢复。',
       noBackups: '目标上还没有备份包',
       backupName: '文件名',
@@ -118,7 +119,6 @@ window.__ModuleLoader__.load({
       backingUp: '备份中…',
       backupDone: '备份完成',
       backupFailed: '备份失败',
-      never: '从未',
       history: '运行记录',
       noHistory: '还没有运行记录',
       ok: '成功',
@@ -129,6 +129,9 @@ window.__ModuleLoader__.load({
       duration: '耗时',
       size: '体积',
       componentsCount: '组件',
+      clearHistory: '清空记录',
+      historyCleared: '运行记录已清空',
+      clearFailed: '清空失败',
       error: '错误',
       loading: '读取中…',
       loadFailed: '读取失败',
@@ -157,6 +160,7 @@ window.__ModuleLoader__.load({
       componentSpaces: '{count} spaces',
       backups: 'Backups',
       listBackups: 'List from target',
+      refresh: 'Refresh',
       backupsHint: 'List the archives already on the target, inspect one, and restore it.',
       noBackups: 'No archive on the target yet',
       backupName: 'File',
@@ -229,6 +233,9 @@ window.__ModuleLoader__.load({
       duration: 'Duration',
       size: 'Size',
       componentsCount: 'Components',
+      clearHistory: 'Clear log',
+      historyCleared: 'Run history cleared',
+      clearFailed: 'Could not clear',
       error: 'Error',
       loading: 'Loading\u2026',
       loadFailed: 'Could not load',
@@ -657,6 +664,24 @@ window.__ModuleLoader__.load({
         }
       }
 
+      /**
+       * Drop the run log. Archives on the target are not touched — this is a
+       * display reset, and the page says so before the button is pressed.
+       */
+      const clearHistory = async () => {
+        setBusy(true)
+        setNotice(null)
+        try {
+          await api('/clear-history', { method: 'POST', body: '{}' })
+          await load()
+          setNotice({ ok: true, text: t('historyCleared') })
+        } catch (cause) {
+          setNotice({ ok: false, text: `${t('clearFailed')}: ${cause.message}` })
+        } finally {
+          setBusy(false)
+        }
+      }
+
       const loadArchives = async () => {
         setArchivesBusy(true)
         setArchivesError(null)
@@ -1082,7 +1107,15 @@ window.__ModuleLoader__.load({
 
         // history
         h('section', { style: styles.card },
-          h('h3', { style: styles.cardTitle }, t('history')),
+          h('div', { style: styles.row },
+            h('h3', { style: { ...styles.cardTitle, marginRight: 'auto' } }, t('history')),
+            // The list keeps the newest 20 on its own; this clears what is left.
+            history.length === 0 ? null : h('button', {
+              style: styles.button,
+              disabled: busy,
+              onClick: () => void clearHistory(),
+            }, t('clearHistory')),
+          ),
           history.length === 0
             ? h('p', { style: styles.note }, t('noHistory'))
             : h('table', { style: styles.table },

package/index.js

@@ -199,19 +199,8 @@ export function apply(ctx, config = {}) {
 
     if (req.method === 'PUT' && route === '/settings') {
       const body = await readJsonBody(req)
-      const previous = settings()
       const incoming = body?.settings ?? body
-      // A masked secret coming back from the UI means "unchanged".
-      if (incoming !== null && typeof incoming === 'object' && incoming.target !== null && typeof incoming.target === 'object') {
-        const target = incoming.target
-        if (target.kind === 'webdav' && isMasked(target.password)) {
-          target.password = previous.target.kind === 'webdav' ? previous.target.password : ''
-        }
-        if (target.kind === 's3' && isMasked(target.secretAccessKey)) {
-          target.secretAccessKey = previous.target.kind === 's3' ? previous.target.secretAccessKey : ''
-        }
-      }
-      const saved = writeSettings(home, normalizeSettings(incoming))
+      const saved = writeSettings(home, normalizeSettings(restoreMaskedSecrets(incoming, settings())))
       scheduler.refresh()
       sendJson(res, 200, { settings: maskSettings(saved) })
       return
@@ -225,7 +214,10 @@ export function apply(ctx, config = {}) {
       const body = await readJsonBody(req)
       try {
         if (body?.settings !== undefined) {
-          const saved = writeSettings(home, normalizeSettings(body.settings))
+          // The same masked-secret rule as saving settings: the page always
+          // sends the mask it was shown, and writing that mask as the real
+          // password would silently break the next upload with a 401.
+          const saved = writeSettings(home, normalizeSettings(restoreMaskedSecrets(body.settings, settings())))
           scheduler.refresh()
           const result = await scheduler.runNow('manual')
           sendJson(res, 200, { result, settings: maskSettings(saved) })
@@ -239,6 +231,12 @@ export function apply(ctx, config = {}) {
       return
     }
 
+    if (req.method === 'POST' && route === '/clear-history') {
+      // Only the local run log is cleared; archives on the target are untouched.
+      sendJson(res, 200, { history: history.clear() })
+      return
+    }
+
     if (req.method === 'POST' && route === '/refresh-schedule') {
       scheduler.refresh()
       sendJson(res, 200, { scheduler: scheduler.snapshot(settings()) })
@@ -557,6 +555,33 @@ function isMasked(value) {
   return typeof value === 'string' && value !== '' && /^•+$/u.test(value)
 }
 
+/**
+ * Put the real secrets back into a settings payload that arrived masked.
+ *
+ * The page never receives a secret — `maskSettings` replaces it with bullets —
+ * and echoes those bullets back on every save. Treating them as a value would
+ * overwrite the real credential with eight bullet characters, which is exactly
+ * what made a correctly configured WebDAV target answer 401: the stored
+ * password really was `••••••••`.
+ *
+ * Any write path that accepts settings from the browser must run this first.
+ */
+function restoreMaskedSecrets(incoming, previous) {
+  if (incoming === null || typeof incoming !== 'object') return incoming
+  const target = incoming.target
+  if (target === null || typeof target !== 'object') return incoming
+  if (target.kind === 'webdav' && isMasked(target.password)) {
+    target.password = previous.target.kind === 'webdav' ? previous.target.password : ''
+  }
+  if (target.kind === 's3' && isMasked(target.secretAccessKey)) {
+    target.secretAccessKey = previous.target.kind === 's3' ? previous.target.secretAccessKey : ''
+  }
+  if (target.kind === 's3' && isMasked(target.sessionToken)) {
+    target.sessionToken = previous.target.kind === 's3' ? previous.target.sessionToken : ''
+  }
+  return incoming
+}
+
 /**
  * Resolve the dsh-mnemon extension SDK.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@summerscar/dsh-mnemon-sync",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Back up and restore dsh-mnemon memory components (memory spaces, project documents, runtime memory) to S3-compatible storage or WebDAV.",
   "type": "module",
   "main": "index.js",

package/scheduler.js

@@ -72,6 +72,22 @@ export class SyncHistory {
   latest() {
     return this.read()[0]
   }
+
+  /**
+   * Drop the whole run history.
+   *
+   * History is a display convenience, not a record of truth: the archives
+   * themselves live on the target, and retention keys off the same list, so
+   * clearing it simply stops the page from showing past runs. Retention then
+   * has nothing to delete, which is the honest outcome — after clearing, this
+   * plugin no longer knows which keys it uploaded.
+   */
+  clear() {
+    const path = this.path()
+    mkdirSync(join(this.root, STATE_DIRECTORY), { recursive: true, mode: 0o700 })
+    writeFileSync(path, `${JSON.stringify({ version: 1, runs: [] }, null, 2)}\n`, { mode: 0o600 })
+    return []
+  }
 }
 
 /**