diff --git a/server.js b/server.js
index 0c2e675..f8df86c 100644
--- a/server.js
+++ b/server.js
@@ -2862,13 +2862,13 @@ async function pruneOldCloudBackups(cfg) {
}
}
-// Restore database from a Buffer (.db SQLite file or .json archive) without leaving local files
-function restoreDatabaseFromBuffer(fileBuffer, filename = '') {
+// Parse a backup Buffer (.db SQLite file or .json archive) into structured tables without leaving local files
+function parseBackupBufferToData(fileBuffer, filename = '') {
const isSqliteHeader =
fileBuffer.length > 16 &&
fileBuffer.subarray(0, 15).toString('utf8') === 'SQLite format 3';
- if (isSqliteHeader || filename.toLowerCase().endsWith('.db')) {
+ if (isSqliteHeader || filename.toLowerCase().endsWith('.db') || filename.toLowerCase().endsWith('.sqlite')) {
const tempRestorePath = path.join(
os.tmpdir(),
`forkfolio_restore_${Date.now()}_${crypto.randomBytes(6).toString('hex')}.db`
@@ -2892,7 +2892,7 @@ function restoreDatabaseFromBuffer(fileBuffer, filename = '') {
try { recipeVisits = sourceDb.prepare('SELECT * FROM recipe_shares_visits').all(); } catch (e) {}
try { listVisits = sourceDb.prepare('SELECT * FROM shopping_list_shares_visits').all(); } catch (e) {}
- applyParsedRestoreData({
+ return {
users,
recipes,
shoppingLists,
@@ -2900,15 +2900,6 @@ function restoreDatabaseFromBuffer(fileBuffer, filename = '') {
settings,
recipeSharesVisits: recipeVisits,
shoppingListSharesVisits: listVisits
- });
-
- return {
- users: users.length,
- recipes: recipes.length,
- shoppingLists: shoppingLists.length,
- userCount: users.length,
- recipeCount: recipes.length,
- shoppingListCount: shoppingLists.length
};
} finally {
if (sourceDb) {
@@ -2919,31 +2910,235 @@ function restoreDatabaseFromBuffer(fileBuffer, filename = '') {
} catch (e) {}
}
} else {
- // Parse as JSON archive
const parsed = JSON.parse(fileBuffer.toString('utf8'));
const data = parsed.data || parsed;
if (!Array.isArray(data.users) && !Array.isArray(data.recipes)) {
throw new Error('Invalid backup archive format: missing users and recipes tables.');
}
- applyParsedRestoreData(data);
- const uLen = (data.users || []).length;
- const rLen = (data.recipes || []).length;
- const sLen = (data.shoppingLists || []).length;
return {
- users: uLen,
- recipes: rLen,
- shoppingLists: sLen,
- userCount: uLen,
- recipeCount: rLen,
- shoppingListCount: sLen
+ users: data.users || [],
+ recipes: data.recipes || [],
+ shoppingLists: data.shoppingLists || [],
+ shoppingListItems: data.shoppingListItems || [],
+ settings: data.settings || [],
+ recipeSharesVisits: data.recipeSharesVisits || [],
+ shoppingListSharesVisits: data.shoppingListSharesVisits || []
};
}
}
-function applyParsedRestoreData(data) {
+function inspectBackupUsersFromData(data) {
+ const users = Array.isArray(data.users) ? data.users : [];
+ const recipes = Array.isArray(data.recipes) ? data.recipes : [];
+ const shoppingLists = Array.isArray(data.shoppingLists) ? data.shoppingLists : [];
+
+ const userSummaries = users.map(u => {
+ const unameLower = String(u.username || '').toLowerCase();
+ const rCount = recipes.filter(
+ r => r.userId === u.id || (r.createdBy && String(r.createdBy).toLowerCase() === unameLower)
+ ).length;
+ const lCount = shoppingLists.filter(
+ l => l.userId === u.id || (l.createdBy && String(l.createdBy).toLowerCase() === unameLower)
+ ).length;
+ return {
+ id: u.id,
+ username: u.username,
+ isAdmin: Boolean(u.isAdmin),
+ isRecipeManager: Boolean(u.isRecipeManager),
+ recipeCount: rCount,
+ shoppingListCount: lCount
+ };
+ });
+
+ return {
+ users: userSummaries,
+ totalUsers: users.length,
+ totalRecipes: recipes.length,
+ totalShoppingLists: shoppingLists.length
+ };
+}
+
+// Restore database (all users or a single user) from a Buffer (.db SQLite file or .json archive) without leaving local files
+function restoreDatabaseFromBuffer(fileBuffer, filename = '', targetUser = 'all') {
+ const data = parseBackupBufferToData(fileBuffer, filename);
+ return applyParsedRestoreData(data, targetUser);
+}
+
+function applyParsedRestoreData(data, targetUser = 'all') {
+ const isSingleUser = Boolean(targetUser && targetUser !== 'all');
db.pragma('foreign_keys = OFF');
try {
+ let resultSummary = null;
+
const tx = db.transaction(() => {
+ if (isSingleUser) {
+ const targetLower = String(targetUser).toLowerCase();
+ const backupUser = (data.users || []).find(
+ u => u.id === targetUser || String(u.username || '').toLowerCase() === targetLower
+ );
+ if (!backupUser) {
+ throw new Error(`User "${targetUser}" was not found in this backup archive.`);
+ }
+
+ const backupUnameLower = String(backupUser.username || '').toLowerCase();
+ const userRecipes = (data.recipes || []).filter(
+ r => r.userId === backupUser.id || (r.createdBy && String(r.createdBy).toLowerCase() === backupUnameLower)
+ );
+ const userLists = (data.shoppingLists || []).filter(
+ l => l.userId === backupUser.id || (l.createdBy && String(l.createdBy).toLowerCase() === backupUnameLower)
+ );
+ const userListIds = new Set(userLists.map(l => l.id));
+ const userListItems = (data.shoppingListItems || []).filter(item => userListIds.has(item.listId));
+
+ // Check if this user already exists in the live DB (by username or id)
+ const liveUser =
+ db.prepare('SELECT * FROM users WHERE lower(username) = lower(?)').get(backupUser.username) ||
+ db.prepare('SELECT * FROM users WHERE id = ?').get(backupUser.id);
+
+ const effectiveUserId = liveUser ? liveUser.id : backupUser.id;
+ const effectiveUsername = liveUser ? liveUser.username : backupUser.username;
+
+ if (!liveUser) {
+ db.prepare(`
+ INSERT INTO users (id, username, salt, passwordHash, isAdmin, isRecipeManager, defaultConsolidateLists, createdAt)
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+ `).run(
+ backupUser.id,
+ backupUser.username,
+ backupUser.salt,
+ backupUser.passwordHash,
+ backupUser.isAdmin ? 1 : 0,
+ backupUser.isRecipeManager ? 1 : 0,
+ backupUser.defaultConsolidateLists !== 0 ? 1 : 0,
+ backupUser.createdAt || new Date().toISOString()
+ );
+ } else {
+ db.prepare(`
+ UPDATE users
+ SET defaultConsolidateLists = ?
+ WHERE id = ?
+ `).run(backupUser.defaultConsolidateLists !== 0 ? 1 : 0, effectiveUserId);
+ }
+
+ // Remove only this user's existing shopping lists and their items
+ const existingUserLists = db.prepare(
+ 'SELECT id FROM shopping_lists WHERE userId = ? OR lower(createdBy) = lower(?)'
+ ).all(effectiveUserId, effectiveUsername);
+ const delListItemsStmt = db.prepare('DELETE FROM shopping_list_items WHERE listId = ?');
+ for (const el of existingUserLists) {
+ delListItemsStmt.run(el.id);
+ }
+ db.prepare('DELETE FROM shopping_lists WHERE userId = ? OR lower(createdBy) = lower(?)').run(
+ effectiveUserId,
+ effectiveUsername
+ );
+
+ // Insert restored shopping lists & items for this user
+ const insList = db.prepare(`
+ INSERT OR REPLACE INTO shopping_lists (id, userId, createdBy, name, shareToken, createdAt, updatedAt)
+ VALUES (?, ?, ?, ?, ?, ?, ?)
+ `);
+ for (const l of userLists) {
+ insList.run(
+ l.id,
+ effectiveUserId,
+ effectiveUsername,
+ l.name,
+ l.shareToken || null,
+ l.createdAt || new Date().toISOString(),
+ l.updatedAt || null
+ );
+ }
+
+ const insItem = db.prepare(`
+ INSERT OR REPLACE INTO shopping_list_items (
+ id, listId, rawText, itemName, quantity, unit, category, recipeId, recipeTitle, checked, createdAt
+ ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+ `);
+ for (const item of userListItems) {
+ insItem.run(
+ item.id,
+ item.listId,
+ item.rawText,
+ item.itemName || item.rawText,
+ item.quantity !== undefined ? item.quantity : null,
+ item.unit || '',
+ item.category || 'Other',
+ item.recipeId || null,
+ item.recipeTitle || null,
+ item.checked ? 1 : 0,
+ item.createdAt || new Date().toISOString()
+ );
+ }
+
+ // Remove only this user's existing recipes and insert their restored recipes
+ db.prepare('DELETE FROM recipes WHERE userId = ? OR lower(createdBy) = lower(?)').run(
+ effectiveUserId,
+ effectiveUsername
+ );
+ const insRecipe = db.prepare(`
+ INSERT OR REPLACE INTO recipes (
+ id, userId, createdBy, isPublic, title, description, servings,
+ prepTime, cookTime, totalTime, image, images, ingredients, instructions, sourceUrl, shareToken, createdAt, updatedAt
+ ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+ `);
+ for (const r of userRecipes) {
+ const coverImg = r.image || r.embeddedCoverImage || '';
+ insRecipe.run(
+ r.id,
+ effectiveUserId,
+ effectiveUsername,
+ r.isPublic !== 0 && r.isPublic !== false ? 1 : 0,
+ r.title || 'Untitled Recipe',
+ r.description || '',
+ r.servings || '',
+ r.prepTime || '',
+ r.cookTime || '',
+ r.totalTime || '',
+ coverImg,
+ typeof r.images === 'string' ? r.images : JSON.stringify(r.images || []),
+ typeof r.ingredients === 'string' ? r.ingredients : JSON.stringify(r.ingredients || []),
+ typeof r.instructions === 'string' ? r.instructions : JSON.stringify(r.instructions || []),
+ r.sourceUrl || '',
+ r.shareToken || null,
+ r.createdAt || new Date().toISOString(),
+ r.updatedAt || null
+ );
+ }
+
+ // Restore share visits for this user's restored recipes & lists
+ const recipeTokens = new Set(userRecipes.map(r => r.shareToken).filter(Boolean));
+ if (recipeTokens.size > 0 && Array.isArray(data.recipeSharesVisits)) {
+ const insVisit = db.prepare('INSERT OR IGNORE INTO recipe_shares_visits (shareToken, visitorIp, visitedAt) VALUES (?, ?, ?)');
+ for (const v of data.recipeSharesVisits) {
+ if (recipeTokens.has(v.shareToken)) {
+ insVisit.run(v.shareToken, v.visitorIp, v.visitedAt);
+ }
+ }
+ }
+ const listTokens = new Set(userLists.map(l => l.shareToken).filter(Boolean));
+ if (listTokens.size > 0 && Array.isArray(data.shoppingListSharesVisits)) {
+ const insListVisit = db.prepare('INSERT OR IGNORE INTO shopping_list_shares_visits (shareToken, visitorIp, visitedAt) VALUES (?, ?, ?)');
+ for (const v of data.shoppingListSharesVisits) {
+ if (listTokens.has(v.shareToken)) {
+ insListVisit.run(v.shareToken, v.visitorIp, v.visitedAt);
+ }
+ }
+ }
+
+ resultSummary = {
+ mode: 'single_user',
+ targetUsername: effectiveUsername,
+ users: 1,
+ recipes: userRecipes.length,
+ shoppingLists: userLists.length,
+ userCount: 1,
+ recipeCount: userRecipes.length,
+ shoppingListCount: userLists.length
+ };
+ return;
+ }
+
if (Array.isArray(data.users) && data.users.length > 0) {
db.prepare('DELETE FROM users').run();
const insUser = db.prepare(`
@@ -3047,6 +3242,19 @@ function applyParsedRestoreData(data) {
insListVisit.run(v.shareToken, v.visitorIp, v.visitedAt);
}
}
+
+ const uLen = (data.users || []).length;
+ const rLen = (data.recipes || []).length;
+ const sLen = (data.shoppingLists || []).length;
+ resultSummary = {
+ mode: 'all',
+ users: uLen,
+ recipes: rLen,
+ shoppingLists: sLen,
+ userCount: uLen,
+ recipeCount: rLen,
+ shoppingListCount: sLen
+ };
});
tx();
@@ -3065,6 +3273,8 @@ function applyParsedRestoreData(data) {
});
}
}
+
+ return resultSummary;
} finally {
db.pragma('foreign_keys = ON');
}
@@ -3759,12 +3969,64 @@ app.get('/api/admin/backups/cloud-files', requireAuth, async (req, res) => {
}
});
+// Inspect users and item counts inside a cloud or uploaded backup before restoring
+app.post('/api/admin/backups/inspect', requireAuth, async (req, res) => {
+ if (!req.user.isAdmin) {
+ return res.status(403).json({ error: 'Administrator privileges required.' });
+ }
+ const { provider, fileId, objectKey, historyId, format, filename, base64Data, dataBase64 } = req.body || {};
+ try {
+ const cfg = getBackupConfig();
+ let fileBuf = null;
+ let resolvedName = filename || 'backup.db';
+
+ const rawBase64 = base64Data || dataBase64;
+ if (rawBase64) {
+ fileBuf = Buffer.from(rawBase64, 'base64');
+ } else if (provider === 'gdrive' && fileId) {
+ const token = await getGoogleDriveAccessToken(cfg);
+ fileBuf = await gdriveDownloadFile(token, fileId);
+ } else if (provider === 's3' && objectKey) {
+ fileBuf = await s3GetObject(cfg, objectKey);
+ resolvedName = filename || objectKey;
+ } else if (historyId) {
+ const row = db.prepare('SELECT * FROM backup_history WHERE id = ?').get(historyId);
+ if (!row) return res.status(404).json({ error: 'Backup record not found.' });
+ const preferredFormat = format === 'json' ? 'json' : 'db';
+ const s3List = JSON.parse(row.s3Objects || '[]');
+ const gdList = JSON.parse(row.gdriveFiles || '[]');
+ const s3Target = s3List.find(o => o.format === preferredFormat) || s3List.find(o => o.format === 'db') || s3List[0];
+ const gdTarget = gdList.find(f => f.format === preferredFormat) || gdList.find(f => f.format === 'db') || gdList[0];
+
+ if (gdTarget && (cfg.gdriveEnabled || cfg.gdriveConnected)) {
+ const token = await getGoogleDriveAccessToken(cfg);
+ fileBuf = await gdriveDownloadFile(token, gdTarget.id);
+ resolvedName = gdTarget.name || resolvedName;
+ } else if (s3Target && cfg.s3Enabled) {
+ fileBuf = await s3GetObject(cfg, s3Target.key);
+ resolvedName = s3Target.name || s3Target.key;
+ } else {
+ return res.status(400).json({ error: 'No connected cloud provider found to inspect this backup.' });
+ }
+ } else {
+ return res.status(400).json({ error: 'Backup source is required to inspect contents.' });
+ }
+
+ const parsedData = parseBackupBufferToData(fileBuf, resolvedName);
+ const inspection = inspectBackupUsersFromData(parsedData);
+ res.json({ success: true, ...inspection });
+ } catch (error) {
+ console.error('Error inspecting backup:', error);
+ res.status(500).json({ error: error.message });
+ }
+});
+
// Restore directly from a specified cloud file (Google Drive fileId or Wasabi S3 objectKey)
app.post('/api/admin/backups/restore-cloud-file', requireAuth, async (req, res) => {
if (!req.user.isAdmin) {
return res.status(403).json({ error: 'Administrator privileges required.' });
}
- const { provider, fileId, objectKey, filename } = req.body || {};
+ const { provider, fileId, objectKey, filename, targetUser } = req.body || {};
try {
const cfg = getBackupConfig();
let fileBuf = null;
@@ -3780,7 +4042,7 @@ app.post('/api/admin/backups/restore-cloud-file', requireAuth, async (req, res)
return res.status(400).json({ error: 'Valid cloud provider and file identifier are required.' });
}
- const counts = restoreDatabaseFromBuffer(fileBuf, resolvedName);
+ const counts = restoreDatabaseFromBuffer(fileBuf, resolvedName, targetUser || 'all');
res.json({ success: true, restored: counts });
} catch (error) {
console.error('Error restoring from direct cloud file:', error);
@@ -3835,6 +4097,7 @@ app.post('/api/admin/backups/:id/restore-cloud', requireAuth, async (req, res) =
return res.status(403).json({ error: 'Administrator privileges required.' });
}
const preferredFormat = req.body?.format === 'json' ? 'json' : 'db';
+ const targetUser = req.body?.targetUser || 'all';
try {
const row = db.prepare('SELECT * FROM backup_history WHERE id = ?').get(req.params.id);
if (!row) return res.status(404).json({ error: 'Backup record not found.' });
@@ -3860,7 +4123,7 @@ app.post('/api/admin/backups/:id/restore-cloud', requireAuth, async (req, res) =
return res.status(400).json({ error: 'No connected cloud provider found to retrieve this backup.' });
}
- const counts = restoreDatabaseFromBuffer(fileBuf, filename);
+ const counts = restoreDatabaseFromBuffer(fileBuf, filename, targetUser);
res.json({ success: true, restored: counts });
} catch (error) {
console.error('Error restoring from cloud backup:', error);
@@ -3873,14 +4136,14 @@ app.post('/api/admin/backups/restore-upload', requireAuth, (req, res) => {
if (!req.user.isAdmin) {
return res.status(403).json({ error: 'Administrator privileges required.' });
}
- const { filename, base64Data, dataBase64 } = req.body || {};
+ const { filename, base64Data, dataBase64, targetUser } = req.body || {};
const payload = base64Data || dataBase64;
if (!payload) {
return res.status(400).json({ error: 'Backup file payload is required.' });
}
try {
const fileBuffer = Buffer.from(payload, 'base64');
- const counts = restoreDatabaseFromBuffer(fileBuffer, filename || '');
+ const counts = restoreDatabaseFromBuffer(fileBuffer, filename || '', targetUser || 'all');
res.json({ success: true, restored: counts });
} catch (error) {
console.error('Error restoring uploaded backup file:', error);