Create named subdirectories for new repositories

internal/model/validate.go

@@ -166,6 +166,12 @@ func ValidateRepository(r Repository) error {
 		if r.Mount.Remote == "" || !filepath.IsAbs(r.Mount.MountPoint) {
 			return errors.New("managed mount requires remote and absolute mountPoint")
 		}
+		location := filepath.Clean(r.Location)
+		mountPoint := filepath.Clean(r.Mount.MountPoint)
+		relative, err := filepath.Rel(mountPoint, location)
+		if err != nil || relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) {
+			return errors.New("managed repository location must be inside mountPoint")
+		}
 	}
 	if r.Type == RepositorySFTP && r.CredentialRef != "" {
 		knownHosts := r.Options["knownHostsPath"]

internal/model/validate_test.go

@@ -79,3 +79,14 @@ func TestRetentionRequiresAtLeastOneRule(t *testing.T) {
 		t.Fatalf("age retention rejected: %v", err)
 	}
 }
+
+func TestManagedRepositoryLocationMustRemainInsideMountPoint(t *testing.T) {
+	repo := Repository{SchemaVersion: 1, ID: "repo", Name: "NAS", Type: RepositorySMB, Location: "/mnt/remotes/nas/NAS", PasswordRef: "password", Mount: &MountConfig{Managed: true, Remote: "//nas/backups", MountPoint: "/mnt/remotes/nas"}}
+	if err := ValidateRepository(repo); err != nil {
+		t.Fatalf("repository subdirectory rejected: %v", err)
+	}
+	repo.Location = "/mnt/remotes/other/NAS"
+	if err := ValidateRepository(repo); err == nil {
+		t.Fatal("repository location outside mountPoint accepted")
+	}
+}

internal/platform/mounts.go

@@ -22,6 +22,7 @@ type MountManager struct {
 type MountedRepository struct {
 	Repository     model.Repository
 	Mounted        bool
+	MountPoint     string
 	CredentialFile string
 }
 
@@ -32,7 +33,12 @@ func (m *MountManager) Prepare(ctx context.Context, repo model.Repository) (Moun
 	}
 	if repo.Mount == nil || !repo.Mount.Managed {
 		if _, err := os.Stat(repo.Location); err != nil {
-			return result, fmt.Errorf("connectivity: external mount unavailable: %w", err)
+			if !os.IsNotExist(err) {
+				return result, fmt.Errorf("connectivity: external mount unavailable: %w", err)
+			}
+			if _, parentErr := os.Stat(filepath.Dir(repo.Location)); parentErr != nil {
+				return result, fmt.Errorf("connectivity: external mount unavailable: %w", parentErr)
+			}
 		}
 		return result, nil
 	}
@@ -40,6 +46,11 @@ func (m *MountManager) Prepare(ctx context.Context, repo model.Repository) (Moun
 	if !strings.HasPrefix(point, "/mnt/remotes/") && !strings.HasPrefix(point, "/mnt/disks/") {
 		return result, errors.New("validation: managed mountPoint must be below /mnt/remotes or /mnt/disks")
 	}
+	repositoryPath := filepath.Clean(repo.Location)
+	relative, err := filepath.Rel(point, repositoryPath)
+	if err != nil || relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) {
+		return result, errors.New("validation: managed repository location must be inside its mountPoint")
+	}
 	if err := os.MkdirAll(point, 0700); err != nil {
 		return result, err
 	}
@@ -86,7 +97,7 @@ func (m *MountManager) Prepare(ctx context.Context, repo model.Repository) (Moun
 		return result, fmt.Errorf("connectivity: mount repository: %w", err)
 	}
 	result.Mounted = true
-	result.Repository.Location = point
+	result.MountPoint = point
 	return result, nil
 }
 
@@ -97,5 +108,5 @@ func (m *MountManager) Cleanup(ctx context.Context, mounted MountedRepository) e
 	if !mounted.Mounted {
 		return nil
 	}
-	return exec.CommandContext(ctx, "umount", mounted.Repository.Location).Run()
+	return exec.CommandContext(ctx, "umount", mounted.MountPoint).Run()
 }

internal/platform/mounts_test.go

@@ -0,0 +1,32 @@
+package platform
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+
+	"git.casaderoll.de/michael/urbm/internal/model"
+)
+
+func TestExternalMountAllowsNewRepositorySubdirectory(t *testing.T) {
+	base := t.TempDir()
+	repo := model.Repository{Type: model.RepositorySMB, Location: filepath.Join(base, "Photos")}
+	manager := &MountManager{}
+
+	mounted, err := manager.Prepare(context.Background(), repo)
+	if err != nil {
+		t.Fatalf("new repository subdirectory rejected: %v", err)
+	}
+	if mounted.Repository.Location != repo.Location {
+		t.Fatalf("location = %q, want %q", mounted.Repository.Location, repo.Location)
+	}
+}
+
+func TestExternalMountRejectsMissingBaseDirectory(t *testing.T) {
+	repo := model.Repository{Type: model.RepositoryNFS, Location: filepath.Join(t.TempDir(), "missing", "Photos")}
+	manager := &MountManager{}
+
+	if _, err := manager.Prepare(context.Background(), repo); err == nil {
+		t.Fatal("missing external mount base accepted")
+	}
+}

internal/service/service.go

@@ -226,6 +226,11 @@ func (s *Service) TestRepository(ctx context.Context, repoID string, initialize
 	}
 	defer s.mounts.Cleanup(context.Background(), mounted)
 	if initialize {
+		if mounted.Repository.Type != model.RepositorySFTP {
+			if err := os.MkdirAll(mounted.Repository.Location, 0750); err != nil {
+				return fmt.Errorf("repository: create destination directory: %w", err)
+			}
+		}
 		return s.restic.Init(ctx, mounted.Repository)
 	}
 	_, err = s.restic.Snapshots(ctx, mounted.Repository)