Add safe stale repository unlock action

internal/api/server.go

@@ -45,6 +45,7 @@ func New(socket string, svc *service.Service, log *slog.Logger) *Server {
 	mux.HandleFunc("POST /v1/runs/{id}/resume", s.resumeRun)
 	mux.HandleFunc("POST /v1/repositories/{id}/test", s.testRepository)
 	mux.HandleFunc("POST /v1/repositories/{id}/init", s.initRepository)
+	mux.HandleFunc("POST /v1/repositories/{id}/unlock", s.unlockRepository)
 	mux.HandleFunc("POST /v1/repositories/{id}/{action}", s.maintenance)
 	mux.HandleFunc("GET /v1/repositories/{id}/snapshots", s.snapshots)
 	mux.HandleFunc("GET /v1/repositories/{id}/snapshots/{snapshot}/files", s.snapshotFiles)
@@ -181,6 +182,15 @@ func (s *Server) testRepository(w http.ResponseWriter, r *http.Request) {
 func (s *Server) initRepository(w http.ResponseWriter, r *http.Request) {
 	s.repositoryAction(w, r, true)
 }
+func (s *Server) unlockRepository(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Minute)
+	defer cancel()
+	if err := s.service.UnlockRepository(ctx, r.PathValue("id")); err != nil {
+		writeError(w, err)
+		return
+	}
+	writeJSON(w, 200, map[string]bool{"ok": true})
+}
 func (s *Server) repositoryAction(w http.ResponseWriter, r *http.Request, initialize bool) {
 	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Minute)
 	defer cancel()

internal/restic/restic.go

@@ -95,6 +95,10 @@ func (r *Runner) Init(ctx context.Context, repo model.Repository) error {
 	return r.run(ctx, repo, []string{"init"}, nil, nil)
 }
 
+func (r *Runner) Unlock(ctx context.Context, repo model.Repository) error {
+	return r.run(ctx, repo, []string{"unlock"}, nil, nil)
+}
+
 func (r *Runner) Backup(ctx context.Context, repo model.Repository, job model.Job, sources []string, progress ProgressCallback) (Summary, error) {
 	args := []string{"backup", "--json", "--compression", job.Compression}
 	for _, tag := range append([]string{"urbm", "job:" + job.ID}, job.Tags...) {

internal/restic/restic_test.go

@@ -76,6 +76,28 @@ func TestForgetUsesAgeAndCalendarRetention(t *testing.T) {
 	}
 }
 
+func TestUnlockUsesSafeResticCommand(t *testing.T) {
+	dir := t.TempDir()
+	argsPath := filepath.Join(dir, "args")
+	script := filepath.Join(dir, "restic")
+	body := fmt.Sprintf("#!/bin/sh\nprintf '%%s\\n' \"$@\" > '%s'\n", argsPath)
+	if err := os.WriteFile(script, []byte(body), 0700); err != nil {
+		t.Fatal(err)
+	}
+	runner := &Runner{Binary: script, RuntimeDir: dir, Secrets: fakeSecrets{"password": "secret"}}
+	repo := model.Repository{Type: model.RepositoryLocal, Location: "/repo", PasswordRef: "password"}
+	if err := runner.Unlock(context.Background(), repo); err != nil {
+		t.Fatal(err)
+	}
+	args, _ := os.ReadFile(argsPath)
+	if !strings.Contains(string(args), "unlock") {
+		t.Fatalf("unlock command missing: %s", args)
+	}
+	if strings.Contains(string(args), "--remove-all") {
+		t.Fatalf("unsafe remove-all option used: %s", args)
+	}
+}
+
 func TestResticErrorExplainsExistingRepository(t *testing.T) {
 	err := resticError("Fatal: create repository failed: config file already exists", fmt.Errorf("exit status 1"))
 	if !strings.Contains(err.Error(), "already initialized") || !strings.Contains(err.Error(), "select Test") {

internal/service/service.go

@@ -232,6 +232,19 @@ func (s *Service) TestRepository(ctx context.Context, repoID string, initialize
 	return err
 }
 
+func (s *Service) UnlockRepository(ctx context.Context, repoID string) error {
+	repo, ok := s.repository(repoID)
+	if !ok {
+		return errors.New("validation: unknown repository")
+	}
+	mounted, err := s.mounts.Prepare(ctx, repo)
+	if err != nil {
+		return err
+	}
+	defer s.mounts.Cleanup(context.Background(), mounted)
+	return s.restic.Unlock(ctx, mounted.Repository)
+}
+
 func (s *Service) execute(ctx context.Context, run model.Run) model.Run {
 	ctx = restic.WithRunID(ctx, run.ID)
 	if run.TaskType == "backup" {