pgkiln 0.31.0 → 0.35.0

package/src/builder/advisor.ts

@@ -8,6 +8,8 @@ import { templateProblem } from '../runtime/document.ts';
 import { invokeStepReferences, stepProblems, stepWarnings } from '../workflow.ts';
 import { handlerProblems } from '../runtime/rest.ts';
 import { processProblems } from '../runtime/processes.ts';
+import { urlConfigProblem, urlTarget } from '../runtime/url-region.ts';
+import { configColumns, searchConfigProblems } from '../runtime/search.ts';
 import { COMPONENTS } from './components.ts';
 import { appEntries, type Entry } from './search.ts';
 import { appHeader, BASE, developer, region, send, shell, type Req } from './ui.ts';
@@ -149,10 +151,16 @@ export async function checkSql(c: pg.PoolClient, sql: string, shape: SqlShape):
 const ITEM_REF = /(?<![A-Za-z0-9_$&:])(?::|&)(P\d+_[A-Z0-9_]+)\b/gi;
 const BUILT_IN = new Set(['MUST_NOT_BE_PUBLIC_USER']);
 
-/** Run every check of an application. */
-export async function advise(appId: number): Promise<{ findings: Finding[]; checked: number; plpgsqlCheck: boolean }> {
-  const app = await owner.one('select * from meta.app where id = $1', [appId]);
-  const entries = await appEntries(appId);
+/**
+ * Run every check of an application. With `tx` (a client in a transaction,
+ * e.g. an import that hasn't committed yet) everything is read and checked
+ * on that client, inside a savepoint that is rolled back.
+ */
+export async function advise(appId: number, tx?: pg.ClientBase): Promise<{ findings: Finding[]; checked: number; plpgsqlCheck: boolean }> {
+  const query = (sql: string, params: unknown[] = []) => (tx ? tx.query(sql, params) : owner.query(sql, params));
+  const one = async (sql: string, params: unknown[] = []) => (await query(sql, params)).rows[0];
+  const app = await one('select * from meta.app where id = $1', [appId]);
+  const entries = await appEntries(appId, query);
   const byKey = new Map(entries.map((e) => [`${e.kind}-${e.id}`, e]));
   const findings: Finding[] = [];
   let checked = 0;
@@ -160,15 +168,15 @@ export async function advise(appId: number): Promise<{ findings: Finding[]; chec
   // rows with every column (the entries only carry the searchable fields)
   const rowsOf = async (kind: string, table: string, scope: 'page' | 'app') =>
     (scope === 'page'
-      ? await owner.query(`select t.*, p.page_no from ${table} t join meta.page p on p.id = t.page_id where p.app_id = $1`, [appId])
-      : await owner.query(`select * from ${table} where app_id = $1`, [appId])
+      ? await query(`select t.*, p.page_no from ${table} t join meta.page p on p.id = t.page_id where p.app_id = $1`, [appId])
+      : await query(`select * from ${table} where app_id = $1`, [appId])
     ).rows.map((row) => ({ kind, row }));
   const all = (await Promise.all(Object.entries(COMPONENTS).map(([kind, spec]) => rowsOf(kind, spec.table, spec.scope)))).flat();
 
-  // ---- SQL, as the application's role, rolled back
-  const c = await owner.pool.connect();
+  // ---- SQL, as the application's role, rolled back (a savepoint in the caller's transaction)
+  const c = (tx ?? (await owner.pool.connect())) as pg.PoolClient;
   try {
-    await c.query('begin');
+    await c.query(tx ? 'savepoint advisor_all' : 'begin');
     await c.query(`set local statement_timeout = '5s'`);
     await c.query(`select set_config('pgkiln.app_id', $1, true)`, [String(appId)]);
     if (app.db_role) await c.query(`set local role ${pg.escapeIdentifier(app.db_role)}`);
@@ -193,6 +201,26 @@ export async function advise(appId: number): Promise<{ findings: Finding[]; chec
         if (problem) findings.push({ ...problem, entry, field: `Layer "${typeof l.name === 'string' ? l.name : ''}" query` });
       }
     }
+    // (080) search configurations: their source with the columns they name
+    for (const { kind, row } of all.filter((x) => x.kind === 'search_config' && x.row.source_type !== 'list')) {
+      const entry = byKey.get(`${kind}-${row.id}`) ?? null;
+      const problems = searchConfigProblems(row);
+      if (problems.length) {
+        findings.push({ severity: 'error', entry, field: 'Source', message: problems.join(' ') });
+        continue;
+      }
+      const cols = configColumns(row).map((x) => `t.${pg.escapeIdentifier(x)}`).join(', ') || '*';
+      checked++;
+      const problem = await checkSql(c, `select ${cols} from ${row.source_type === 'table' ? row.source.trim() : `(${row.source})`} t`, 'select');
+      if (problem) findings.push({ ...problem, entry, field: 'Source' });
+    }
+    // the search regions name existing configurations
+    for (const { kind, row } of all.filter((x) => x.kind === 'region' && x.row.type === 'search')) {
+      const names: unknown[] = Array.isArray(row.config?.configs) ? row.config.configs : [];
+      for (const n of names)
+        if (!all.some((x) => x.kind === 'search_config' && x.row.name === String(n).toUpperCase()))
+          findings.push({ severity: 'error', entry: byKey.get(`${kind}-${row.id}`) ?? null, field: 'Attributes', message: `Search configuration ${String(n)} doesn't exist.` });
+    }
     // REST handlers
     for (const { kind, row } of all.filter((x) => x.kind === 'rest_module')) {
       const entry = byKey.get(`${kind}-${row.id}`) ?? null;
@@ -221,8 +249,13 @@ export async function advise(appId: number): Promise<{ findings: Finding[]; chec
       }
     }
   } finally {
-    await c.query('rollback').catch(() => {});
-    c.release();
+    if (tx) {
+      await c.query('rollback to savepoint advisor_all');
+      await c.query('release savepoint advisor_all');
+    } else {
+      await c.query('rollback').catch(() => {});
+      c.release();
+    }
   }
 
   // ---- references
@@ -277,6 +310,13 @@ export async function advise(appId: number): Promise<{ findings: Finding[]; chec
     if (kind === 'region' && row.type === 'grid' && !all.some((x) => x.kind === 'process' && x.row.type === 'grid_dml' && x.row.region_id === row.id))
       missing(e, 'Source', 'No grid_dml process saves this grid, so it is read-only.', 'info');
     if (kind === 'region' && row.type === 'form' && row.pk_item && !items.has(String(row.pk_item).toUpperCase())) missing(e, 'Primary key item', `Item ${row.pk_item} doesn't exist.`);
+    // (078) a URL region: a literal origin, valid attributes
+    if (kind === 'region' && row.type === 'url') {
+      const target = urlTarget(row.source);
+      if ('error' in target) missing(e, 'Source', target.error);
+      const problem = urlConfigProblem(row.config);
+      if (problem) missing(e, 'Attributes', problem);
+    }
     if (kind === 'computation' && !items.has(String(row.item_name).toUpperCase())) missing(e, 'Item', `Item ${row.item_name} doesn't exist (the computation sets nothing).`);
     if (kind === 'computation' && row.type === 'item' && !items.has(String(row.expression).toUpperCase())) missing(e, 'Expression', `Item ${row.expression} doesn't exist (its value is always empty).`, 'warning');
     if (kind === 'process' && (row.type === 'form_dml' || row.type === 'grid_dml') && !row.region_id) missing(e, 'Region', `A ${row.type} process needs its region.`);
@@ -290,7 +330,7 @@ export async function advise(appId: number): Promise<{ findings: Finding[]; chec
     }
     if (kind === 'branch' && row.target_type === 'page' && row.target_page && !pageNos.has(Number(row.target_page))) missing(e, 'Page', `Page ${row.target_page} doesn't exist.`);
     if (kind === 'branch' && row.target_type === 'app'
-        && !(await owner.one('select 1 as ok from meta.app a join meta.page p on p.app_id = a.id where a.alias = $1 and p.page_no = $2', [row.target_app, row.target_page])))
+        && !(await one('select 1 as ok from meta.app a join meta.page p on p.app_id = a.id where a.alias = $1 and p.page_no = $2', [row.target_app, row.target_page])))
       missing(e, 'Application (app)', `Application ${row.target_app} has no page ${row.target_page}.`);
     if (kind === 'button' && row.action === 'document' && !documents.has(String(row.document ?? '').toUpperCase()))
       missing(e, 'Document template', row.document ? `Document template ${row.document} doesn't exist.` : 'A document button needs a document template.');
@@ -324,9 +364,9 @@ export async function advise(appId: number): Promise<{ findings: Finding[]; chec
   }
 
   // ---- PL/pgSQL functions of the app's schemas, with plpgsql_check when installed
-  const plpgsqlCheck = !!(await owner.one(`select 1 as ok from pg_extension where extname = 'plpgsql_check'`));
+  const plpgsqlCheck = !!(await one(`select 1 as ok from pg_extension where extname = 'plpgsql_check'`));
   if (plpgsqlCheck && app.db_role) {
-    const res = await owner.query(
+    const res = await query(
       `select p.oid::regprocedure::text as fn, r.level, r.message, r.lineno
          from pg_proc p
          join pg_namespace n on n.oid = p.pronamespace

package/src/builder/arrange.ts

@@ -29,7 +29,7 @@ export const REGION_LABELS: Record<string, [string, string]> = {
   cards: ['Cards', 'layers'], calendar: ['Calendar', 'calendar'], facets: ['Faceted search', 'filter'], smart_filters: ['Smart filters', 'search'], display_selector: ['Region display selector', 'menu'], tasks: ['Task list', 'inbox'],
   workflows: ['Workflow console', 'activity'], map: ['Map', 'map'], tree: ['Tree', 'org'], static: ['Static content', 'region'], dynamic: ['Dynamic content', 'code'],
   template_component: ['Template component', 'layers'], list: ['List', 'list'], data_reporter: ['Data Reporter', 'table'],
-  ai_assistant: ['AI assistant', 'bolt'],
+  ai_assistant: ['AI assistant', 'bolt'], url: ['URL', 'link'], search: ['Search', 'search'],
 };
 export const ITEM_LABELS: Record<string, [string, string]> = {
   text: ['Text field', 'item'], textarea: ['Text area', 'item'], number: ['Number field', 'item'], date: ['Date picker', 'calendar'],
@@ -37,7 +37,7 @@ export const ITEM_LABELS: Record<string, [string, string]> = {
   checkbox: ['Checkbox', 'check'], switch: ['Switch', 'check'], checkbox_group: ['Checkbox group', 'check'], multiselect: ['Multi select', 'list'],
   email: ['E-mail', 'inbox'], tel: ['Phone number', 'item'], url: ['URL', 'item'], color: ['Color picker', 'item'], file: ['File upload', 'upload'],
   location: ['Location', 'map'], richtext: ['Rich text editor', 'edit'], markdown: ['Markdown editor', 'code'], rating: ['Star rating', 'check'],
-  combobox: ['Combobox (tags)', 'list'], daterange: ['Date range', 'calendar'], qrcode: ['QR code', 'scan'], hidden: ['Hidden', 'item'], display: ['Display only', 'file'], password: ['Password', 'key'],
+  combobox: ['Combobox (tags)', 'list'], daterange: ['Date range', 'calendar'], qrcode: ['QR code', 'scan'], image: ['Display image', 'file'], address: ['Geocoded address', 'map'], hidden: ['Hidden', 'item'], display: ['Display only', 'file'], password: ['Password', 'key'],
 };
 export const BUTTON_LABELS: Record<string, [string, string]> = {
   submit: ['Submit page', 'button'], redirect: ['Redirect to page', 'button'], da: ['Dynamic action', 'bolt'], document: ['Download document', 'download'],

package/src/builder/availability.ts

@@ -0,0 +1,74 @@
+import type { FastifyInstance } from 'fastify';
+import { owner } from '../db.ts';
+import { html, raw } from '../html.ts';
+import { clientIp, logActivity } from '../session.ts';
+import { appOr404 } from './forms.ts';
+import { appHeader, back, BASE, csrf, developer, flash, region, select, send, shell, type Req } from './ui.ts';
+
+// Application → Availability (APEX: Application Availability and Build Status,
+// migration 083): who may use the running application, the message they see
+// otherwise, and whether the builder may change it (Run only). Allowed on a
+// Run only application (src/builder/locks.ts), logged as "availability".
+
+const MODES: [string, string][] = [
+  ['available', 'Available'],
+  ['developers', 'Available to developers only'],
+  ['restricted', 'Restricted to the users below (and developers)'],
+  ['unavailable', 'Unavailable'],
+];
+
+export async function availabilityRoutes(app: FastifyInstance) {
+  app.get(`${BASE}/apps/:id(^\\d+$)/availability`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const a = await appOr404(req.params.id);
+    if (!a) return reply.code(404).send('Not found');
+    const body = region('Availability', html`<form method="post" action="${BASE}/apps/${a.id}/availability">${csrf(s)}
+      <p class="muted u-mt0">Who may use the running application. Developers are those signed in to the builder in the same browser
+        (they see the developer toolbar). Pages, file downloads, REST modules and the REST API follow this setting; automations,
+        workflows, background jobs and queued mail keep running. It belongs to this installation: exports leave it out and an
+        import over the application keeps it.</p>
+      <div class="form-grid">
+        ${select('availability', 'Status', a.availability, MODES)}
+        <div class="field" data-wide><label class="label" for="f_message">Message</label>
+          <textarea id="f_message" name="message" rows="3" maxlength="2000">${a.availability_message ?? ''}</textarea>
+          <small class="help">Shown when the application is unavailable or for developers only, e.g. "We are upgrading the application; back at 14:00." Empty: a standard message in the user's language.</small></div>
+        <div class="field" data-wide><label class="label" for="f_users">Users (restricted)</label>
+          <textarea id="f_users" name="users" rows="2">${(a.availability_users ?? []).join(', ')}</textarea>
+          <small class="help">User names separated by commas or spaces. They sign in as usual; others get "not available to your account".</small></div>
+        ${select('build_status', 'Build status', a.build_status, [['run_and_build', 'Run and build'], ['run_only', 'Run only']],
+          'Run only: the builder refuses changes to the application (pages, shared components, settings, restores) until it is set back here. pgkiln import --replace still deploys it.')}
+      </div>
+      <div class="buttons"><button class="btn btn-hot">Save</button></div></form>`);
+    const main = html`${appHeader(a, 'settings')}<div class="ide-body">${body}</div>`;
+    return send(reply, s, shell(s, `${a.name} availability`, [['App Builder', BASE], [a.name, `${BASE}/apps/${a.id}`], ['Availability']], main));
+  });
+
+  app.post(`${BASE}/apps/:id(^\\d+$)/availability`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const b = req.body ?? {};
+    const mode = MODES.some(([v]) => v === b.availability) ? b.availability : 'available';
+    const users = [...new Set(String(b.users ?? '').split(/[\s,;]+/).map((u) => u.trim()).filter(Boolean))];
+    if (users.some((u) => u.length > 100 || /[:\s]/.test(u))) {
+      flash(s, 'User names are at most 100 characters, without spaces or colons.', 'error');
+      return back(reply, s, `${BASE}/apps/${req.params.id}/availability`);
+    }
+    const build = b.build_status === 'run_only' ? 'run_only' : 'run_and_build';
+    const r = await owner.query(
+      `update meta.app set availability = $2, availability_message = $3, availability_users = $4, build_status = $5, updated_at = now() where id = $1`,
+      [req.params.id, mode, String(b.message ?? '').trim().slice(0, 2000) || null, users, build]);
+    if (r.rowCount) await logActivity({ appId: Number(req.params.id), username: s.username, event: 'availability', ip: clientIp(req), detail: `${mode}, ${build}` });
+    flash(s, r.rowCount ? 'Availability saved.' : 'Not found.', r.rowCount ? 'ok' : 'error');
+    return back(reply, s, `${BASE}/apps/${req.params.id}/availability`);
+  });
+}
+
+/** A badge for an application that is not simply available, or Run only. */
+export const availabilityBadge = (a: { id: number; availability?: string; build_status?: string }) =>
+  a.availability && a.availability !== 'available' || a.build_status === 'run_only'
+    ? html`<a class="tag tag-warning availability-badge" href="${BASE}/apps/${a.id}/availability">${[
+        a.availability && a.availability !== 'available' ? MODES.find(([v]) => v === a.availability)?.[1] : null,
+        a.build_status === 'run_only' ? 'Run only' : null,
+      ].filter(Boolean).join(' · ')}</a>`
+    : raw('');

package/src/builder/backups.ts

@@ -0,0 +1,134 @@
+import type { FastifyInstance } from 'fastify';
+import { replaceApp } from '../cli/replace.ts';
+import { owner } from '../db.ts';
+import { html } from '../html.ts';
+import { icon } from '../icons.ts';
+import { clientIp, logActivity } from '../session.ts';
+import { appOr404 } from './forms.ts';
+import { appHeader, back, BASE, csrf, developer, flash, input, region, send, shell, type Req } from './ui.ts';
+
+// Application → Backups (APEX: Application Backups, migration 082): the
+// exports this installation keeps of an application (before every import
+// that replaces it, a merge or a restore; daily when it changed; on demand),
+// with download, restore and delete. A restore is an import --replace of the
+// backup, so the version it replaces is backed up as well. Locks of the
+// application are respected (developer() refuses a POST to a locked app).
+
+const REASON: Record<string, string> = {
+  import: 'before an import', merge: 'before a working copy merge', restore: 'before a restore', daily: 'daily', manual: 'made by hand',
+};
+const when = (d: string | Date) => new Date(d).toISOString().slice(0, 16).replace('T', ' ');
+const kb = (n: number) => (n < 1024 * 1024 ? `${Math.max(1, Math.round(n / 1024))} KB` : `${(n / 1024 / 1024).toFixed(1)} MB`);
+
+/** Back up the applications whose newest backup is older than a day and that changed since (the scheduler). */
+export async function backupTick() {
+  const due = (await owner.query<{ id: number }>(
+    `select a.id from meta.app a
+      where a.backups_keep > 0
+        and not exists (select 1 from meta.app_backup b where b.app_id = a.id and b.created_at > now() - interval '1 day')`)).rows;
+  for (const a of due) await owner.query(`select meta.backup_app($1, 'daily', 'scheduler')`, [a.id]).catch((e) => console.error(`backup of application ${a.id}:`, (e as Error).message));
+  return due.length;
+}
+
+export async function backupRoutes(app: FastifyInstance) {
+  app.get(`${BASE}/apps/:id(^\\d+$)/backups`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const a = await appOr404(req.params.id);
+    if (!a) return reply.code(404).send('Not found');
+    const rows = (await owner.query(
+      'select id, created_at, created_by, reason, note, size from meta.app_backup where app_id = $1 order by created_at desc, id desc', [a.id])).rows;
+    const body = html`
+      ${region('Backups', html`
+        <p class="muted u-mt0">Exports of this application kept by this installation: one before every import that replaces it (also from the
+          command line and the MCP server), before a working copy merge and a restore, one a day when it changed, and the ones made here.
+          The newest ${a.backups_keep} are kept. Backups are not exported.</p>
+        <div class="table-wrap"><table class="report report-reflow"><thead><tr><th>Made (UTC)</th><th>Why</th><th>By</th><th>Note</th><th class="num">Size</th><th>Actions</th></tr></thead><tbody>
+        ${rows.length ? rows.map((b) => html`<tr>
+          <td data-label="Made">${when(b.created_at)}</td>
+          <td data-label="Why">${REASON[b.reason] ?? b.reason}</td>
+          <td data-label="By">${b.created_by ?? ''}</td>
+          <td data-label="Note" class="u-break">${b.note ?? ''}</td>
+          <td class="num" data-label="Size">${kb(b.size)}</td>
+          <td data-label="Actions"><div class="buttons">
+            <a class="btn btn-sm" href="${BASE}/apps/${a.id}/backups/${b.id}/download">${icon('download')} Download</a>
+            <form method="post" action="${BASE}/apps/${a.id}/backups/${b.id}/restore" class="u-inline">${csrf(s)}
+              <button class="btn btn-sm" data-confirm="Restore the application as it was on ${when(b.created_at)}? Its pages, shared components and settings become those of the backup; the current version is backed up first.">${icon('history')} Restore</button></form>
+            <form method="post" action="${BASE}/apps/${a.id}/backups/${b.id}/delete" class="u-inline">${csrf(s)}
+              <button class="btn btn-sm btn-danger" data-confirm="Delete this backup?">Delete</button></form>
+          </div></td></tr>`)
+          : html`<tr><td colspan="6" class="empty">No backups yet.</td></tr>`}</tbody></table></div>`)}
+      <div class="columns">
+        ${region('Back up now', html`<form method="post" action="${BASE}/apps/${a.id}/backups">${csrf(s)}
+          <div class="form-grid">${input('note', 'Note', '', { placeholder: 'e.g. before the new dashboard' })}</div>
+          <div class="buttons"><button class="btn btn-hot">${icon('save')} Back up now</button></div></form>`)}
+        ${region('Keep', html`<form method="post" action="${BASE}/apps/${a.id}/backups/settings">${csrf(s)}
+          <div class="form-grid">${input('keep', 'Backups to keep', a.backups_keep, { type: 'number', help: '0 to 500; 0 makes no backups at all (also not before an import).' })}</div>
+          <div class="buttons"><button class="btn">Save</button></div></form>`)}
+      </div>`;
+    const main = html`${appHeader(a, 'pages')}<div class="ide-body">${body}</div>`;
+    return send(reply, s, shell(s, `${a.name} backups`, [['App Builder', BASE], [a.name, `${BASE}/apps/${a.id}`], ['Backups']], main));
+  });
+
+  app.post(`${BASE}/apps/:id(^\\d+$)/backups`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const a = await appOr404(req.params.id);
+    if (!a) return reply.code(404).send('Not found');
+    const r = await owner.one(`select meta.backup_app($1, 'manual', $2, $3) as id`, [a.id, s.username, String(req.body?.note ?? '').trim().slice(0, 500) || null]);
+    flash(s, r.id ? 'Backup made.' : 'No backup made: this application keeps none (set "Backups to keep").', r.id ? 'ok' : 'error');
+    return back(reply, s, `${BASE}/apps/${a.id}/backups`);
+  });
+
+  app.post(`${BASE}/apps/:id(^\\d+$)/backups/settings`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const keep = Number(req.body?.keep);
+    if (!Number.isInteger(keep) || keep < 0 || keep > 500) flash(s, 'Backups to keep: a whole number from 0 to 500.', 'error');
+    else {
+      await owner.query('update meta.app set backups_keep = $2, updated_at = now() where id = $1', [req.params.id, keep]);
+      // fewer to keep: the oldest go now
+      await owner.query(`delete from meta.app_backup where app_id = $1 and id not in (select id from meta.app_backup where app_id = $1 order by created_at desc, id desc limit $2)`, [req.params.id, keep]);
+      flash(s, 'Saved.');
+    }
+    return back(reply, s, `${BASE}/apps/${req.params.id}/backups`);
+  });
+
+  app.get(`${BASE}/apps/:id(^\\d+$)/backups/:bid(^\\d+$)/download`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const b = await owner.one(`select b.doc, b.created_at, a.alias from meta.app_backup b join meta.app a on a.id = b.app_id where b.id = $1 and b.app_id = $2`, [req.params.bid, req.params.id]);
+    if (!b) return reply.code(404).send('Not found');
+    const name = `${b.alias}-${new Date(b.created_at).toISOString().slice(0, 16).replace(/[-:]/g, '').replace('T', '-')}.json`;
+    return reply.header('content-disposition', `attachment; filename="${name.replace(/[^\w.-]/g, '_')}"`).header('cache-control', 'private, no-store')
+      .type('application/json').send(JSON.stringify(b.doc, null, 2));
+  });
+
+  app.post(`${BASE}/apps/:id(^\\d+$)/backups/:bid(^\\d+$)/restore`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const a = await appOr404(req.params.id);
+    if (!a) return reply.code(404).send('Not found');
+    try {
+      const at = await owner.tx(async (c) => {
+        const b = (await c.query('select doc, created_at from meta.app_backup where id = $1 and app_id = $2', [req.params.bid, a.id])).rows[0];
+        if (!b) throw new Error('Backup not found.');
+        await replaceApp(c, b.doc, a.alias, { backup: { reason: 'restore', user: s.username, note: `before restoring the backup of ${when(b.created_at)}` } });
+        return when(b.created_at);
+      });
+      await logActivity({ appId: a.id, username: s.username, event: 'backup_restored', ip: clientIp(req), detail: `backup ${req.params.bid} of ${at}` });
+      flash(s, `Restored the application as it was on ${at}. The version it replaced is the newest backup.`);
+    } catch (e) {
+      flash(s, `Restore failed: ${(e as Error).message}`, 'error');
+    }
+    return back(reply, s, `${BASE}/apps/${a.id}/backups`);
+  });
+
+  app.post(`${BASE}/apps/:id(^\\d+$)/backups/:bid(^\\d+$)/delete`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const r = await owner.query('delete from meta.app_backup where id = $1 and app_id = $2', [req.params.bid, req.params.id]);
+    flash(s, r.rowCount ? 'Backup deleted.' : 'Not found.', r.rowCount ? 'ok' : 'error');
+    return back(reply, s, `${BASE}/apps/${req.params.id}/backups`);
+  });
+}