restore.v

1//! Writing a tree back onto disk.2//!3//! A restore writes the target's files and deletes the tracked files the4//! target does not have. An ignored file already on disk is never overwritten5//! or deleted, and every file lands through a temp file and a rename, so an6//! interrupted restore leaves a readable tree rather than half-written files.78module snapshot910import os11import src.storage1213// Set while a restore writes into the repo. A restore records its save first,14// so a mark still here means the files stopped part way: the tree is half one15// save and half another, and nobody's work.16const restoring_key = 'restoring'1718pub const restore_unfinished = 'an earlier restore stopped before all its files were written — run koh revert to finish it (it records the tree as it is in a checkpoint first)'1920pub fn restore_pending(store &storage.Store) bool {21	return store.state(restoring_key) != none22}2324// mark_restore goes down before a restore records its save, so a kill between25// the save and the files still leaves it; restore_files lifts it at the end.26pub fn mark_restore(store &storage.Store) ! {27	store.set_state(restoring_key, 'yes')!28}2930pub fn clear_restore_mark(store &storage.Store) ! {31	store.remove_state(restoring_key)!32}3334pub struct RestoreReport {35pub:36	written int37	removed int38}3940// restore_files writes `target` into the working tree and deletes the paths in41// `remove` (tracked files the target does not have). An ignored file already42// on disk is left as it is, even when the target saved an older copy: it may43// hold work no save has. A missing one is written. Every file lands through a44// temp file and a rename, so an interrupted restore leaves a readable tree45// rather than half-written files.46pub fn restore_files(store &storage.Store, root string, ig Ignore, target []FileEntry, remove []string) !RestoreReport {47	// Peek writes elsewhere; only the repo's own tree carries the mark.48	in_repo := root == store.root49	report := write_tree(store, root, ig, target, remove) or {50		// The save is recorded by now, so the way on is to finish, not retry.51		if in_repo {52			return error('${err.msg()} — the restore stopped part way; fix that, then run koh revert to finish it')53		}54		return err55	}56	if in_repo {57		clear_restore_mark(store)!58	}59	return report60}6162fn write_tree(store &storage.Store, root string, ig Ignore, target []FileEntry, remove []string) !RestoreReport {63	check_containment(root, target, remove)!64	mut wanted := map[string]bool{}65	for entry in target {66		wanted[entry.path] = true67	}68	mut removed := 069	for path in remove {70		full := os.join_path(root, path)71		if !os.is_file(full) || ig.matches(path, false) || path in wanted {72			continue73		}74		os.rm(full)!75		removed++76		prune_empty_dirs(root, os.dir(full))77	}78	// A folder where a file belongs: gone if the removals emptied it, else it79	// holds ignored files, which are never touched. Refuse before writing, as80	// V's move would otherwise drop the file inside the folder.81	for entry in target {82		full := os.join_path(root, entry.path)83		if os.is_dir(full) {84			os.rmdir(full) or {85				return error('${entry.path} is a folder of ignored files where a saved file belongs — move it')86			}87		}88	}89	mut written := 090	cache := store.load_cache()!91	for entry in target {92		if ig.matches(entry.path, false) && os.exists(os.join_path(root, entry.path)) {93			continue94		}95		// Rewriting a file that already matches would only reset its mtime,96		// and make the next status hash it again.97		if already_there(root, entry, cache) {98			continue99		}100		data := store.get_object(entry.hash)!101		write_file(os.join_path(root, entry.path), data, entry.executable)!102		written++103	}104	return RestoreReport{105		written: written106		removed: removed107	}108}109110// check_containment proves the whole restore stays below root before its first removal or write.111fn check_containment(root string, target []FileEntry, remove []string) ! {112	base := os.abs_path(root).trim_right(os.path_separator) + os.path_separator113	mut paths := target.map(it.path)114	paths << remove115	for path in paths {116		full := os.abs_path(os.join_path(root, path))117		if !legal_path(path) || !full.starts_with(base) {118			return error('unsafe path ${escape_path(path)} is outside the repo')119		}120	}121}122123// already_there reports whether the file on disk has the target's content and124// executable bit. The file cache answers without reading when the file is as125// it was when last hashed.126fn already_there(root string, entry FileEntry, cache map[string]storage.CacheRow) bool {127	full := os.join_path(root, entry.path)128	st := lstat(full) or { return false }129	if st.kind != .file || st.size != entry.size || is_executable(st.mode) != entry.executable {130		return false131	}132	if row := cache[entry.path] {133		if row.size == st.size && row.mtime_ns == st.mtime_ns && row.ctime_ns == st.ctime_ns {134			return row.hash == entry.hash135		}136	}137	data := os.read_bytes(full) or { return false }138	return storage.hash_hex(data) == entry.hash139}140141// check_links refuses a restore that would write through a symlinked folder.142// Koh never follows links, so the folder it points at is not the repo's, and143// writing there would overwrite files outside it. Callers run it before they144// record anything.145pub fn check_links(root string, files []FileEntry) ! {146	for file in files {147		mut folder := ''148		for part in file.path.split('/')#[..-1] {149			folder = if folder == '' { part } else { '${folder}/${part}' }150			st := lstat(os.join_path(root, folder)) or { break }151			if st.kind == .symlink {152				return error('${folder} is a symbolic link where a saved folder belongs — koh will not write through it; move it, then run the command again')153			}154		}155	}156}157158fn write_file(path string, data []u8, executable bool) ! {159	os.mkdir_all(os.dir(path), os.MkdirParams{})!160	tmp := '${path}.koh-tmp-${os.getpid()}'161	os.write_file_array(tmp, data)!162	mode := if executable { 0o755 } else { 0o644 }163	os.chmod(tmp, mode)!164	os.rename(tmp, path)!165}166167// prune_empty_dirs clears directories a restore emptied, never the repo root.168fn prune_empty_dirs(root string, dir string) {169	mut current := dir170	inside := root.trim_right(os.path_separator) + os.path_separator171	for current.starts_with(inside) {172		if (os.ls(current) or { return }).len > 0 {173			return174		}175		os.rmdir(current) or { return }176		current = os.dir(current)177	}178}