refactor(export): share the visibility filter between the row query and the estimate

`query_uploads` selects the rows the archives are built from; `estimate_export_bytes`
sizes them for the disk preflight. They stated the same WHERE clause separately, and
the direction of drift matters: an estimate that MISSES rows the archive writes
under-reserves, which is precisely the ENOSPC the preflight exists to prevent.

The integration test claimed to guard this and cannot. Both sides of
`the_estimate_sums_exactly_the_rows_the_archive_will_contain` are `SRC:`-marked
hand-copies in tests/common/mod.rs -- neither is production code -- so drift means
production moved while both copies sat still, and the test goes on passing. The
convention is sound for pinning behaviour; it is structurally incapable of detecting
divergence from the thing it copies.

So fix it where it can be fixed. One `export_visibility_where!()` fragment,
`concat!`-ed into both queries at compile time (still `&'static str`, no allocation),
with the `u`/`usr` alias contract stated. Divergence is now impossible by
construction rather than watched for.

The tests keep their value and lose the overclaim: the docstrings now say they pin
WHICH uploads may be counted -- each excluded row in the fixture is excluded by a
different predicate, so weakening any one of them still fails here -- and say plainly
that they do not detect drift, with a pointer to what does.

No behaviour change. The filters were verified identical before the hoist
(`u.event_id = $1 AND u.deleted_at IS NULL AND usr.uploads_hidden = FALSE AND
usr.is_banned = FALSE`); 99 backend tests still pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -12,14 +12,6 @@ APP_ENV=production
 # ── Database ──────────────────────────────────────────────────────────────────
 # Set a strong password and keep it in sync between DATABASE_URL and
 # POSTGRES_PASSWORD. Generate one with: openssl rand -hex 24
-#
-# SET THIS BEFORE THE FIRST `docker compose up -d`. Postgres reads POSTGRES_PASSWORD
-# only when it initialises its data directory, on that very first boot. Change it
-# afterwards and the app authenticates with the new password against a volume still
-# holding the old one — a permanent restart loop ("password authentication failed").
-# The only ways out are restoring the old password or `docker compose down -v`, which
-# deletes the database, the media and the exports. In production the app refuses to
-# boot while this is still the placeholder below, so it cannot be missed by accident.
 DATABASE_URL=postgres://eventsnap:CHANGE_ME_use_a_strong_password@db:5432/eventsnap
 POSTGRES_USER=eventsnap
 POSTGRES_PASSWORD=CHANGE_ME_use_a_strong_password
@@ -38,9 +30,7 @@ JWT_SECRET=change_me_to_a_random_64_byte_hex_string
 SESSION_EXPIRY_DAYS=30
 
 # Admin dashboard password (bcrypt hash).
-# Generate with an image the stack already pulls (htpasswd needs apache2-utils, which
-# a stock VPS does not have):
-#   docker run --rm caddy:2-alpine caddy hash-password --plaintext 'yourpassword'
+# Generate with: htpasswd -bnBC 12 "" yourpassword | tr -d ':\n'
 # IMPORTANT: keep the SINGLE QUOTES. A bcrypt hash is full of `$` (e.g. $2b$12$…$…),
 # and both Docker Compose's env_file interpolation and dotenvy's variable substitution
 # would otherwise eat the `$…` segments (reading them as unset vars) and corrupt the

.gitignore

@@ -13,16 +13,8 @@ frontend/build/
 frontend/export-viewer/node_modules/
 frontend/export-viewer/.svelte-kit/
 
-# Media uploads. In production these live in the `media_data` DOCKER VOLUME, never in the
-# working tree — so this pattern is anchored to the repo root and exists only for a local
-# bind-mount experiment.
-#
-# It used to read `media/`, unanchored, which matches a directory of that name at ANY depth.
-# The only one in the repo is `e2e/fixtures/media/`, so the rule's entire practical effect was
-# to keep every E2E fixture untracked: a fresh clone got the specs and none of the images or
-# videos they read. `.github/workflows/e2e.yml` does a plain checkout and generates nothing, so
-# the committed CI job could not have run the upload, video or export suites at all.
-/media/
+# Media uploads (mounted volume in production)
+media/
 
 # Playwright E2E suite — runtime artifacts (the suite itself is committed)
 e2e/node_modules/

README.md

@@ -97,51 +97,17 @@ eventsnap/
 git clone https://git.mc02.dev/fabi/EventSnap.git eventsnap
 cd eventsnap
 
-# 2. Configure environment — set EVERY secret NOW, before step 3.
+# 2. Configure environment
 cp .env.example .env
-nano .env   # DOMAIN, EVENT_NAME, EVENT_SLUG,
-            # JWT_SECRET, ADMIN_PASSWORD_HASH,
-            # POSTGRES_PASSWORD *and* the same password inside DATABASE_URL
-            # (see "Generate required secrets" below)
+nano .env   # set DOMAIN, JWT_SECRET, ADMIN_PASSWORD_HASH, EVENT_NAME, etc.
 
 # 3. Start the stack
 docker compose up -d
 ```
 
-> **Set every secret before step 3 — `POSTGRES_PASSWORD` especially.** Postgres reads it **only
-> when it initialises its data directory**, which happens on the very first `docker compose up -d`.
-> Changing it in `.env` afterwards does not change the stored password: the app then authenticates
-> with the new one against a volume holding the old one, and you get a permanent restart loop with
-> `password authentication failed for user "eventsnap"`. The only fixes are restoring the old
-> password or `docker compose down -v`, which **deletes the database, the media and the exports**.
-> Getting it right once, up front, costs nothing; getting it wrong costs the volume.
-
 Caddy automatically obtains a Let's Encrypt certificate on first start. The app is live at `https://DOMAIN` within ~30 seconds.
 
-> **If the site never comes up:** with `APP_ENV=production` the backend **refuses to boot** while
-> `JWT_SECRET`, `ADMIN_PASSWORD_HASH` or the password inside `DATABASE_URL` still hold the
-> `.env.example` placeholders (this is deliberate — a publicly-known signing key or database
-> password is worse than downtime). Caddy then waits on the unhealthy `app` container and never
-> serves. Check `docker compose logs app` — a "Refusing to start … placeholder …" line lists
-> **every** unset secret at once, so one edit fixes them all.
->
-> **If it comes up but keeps restarting with `password authentication failed for user
-> "eventsnap"`:** `POSTGRES_PASSWORD` was changed after the database volume was created. Postgres
-> applies that variable only at initialisation, so `.env` and the stored password have drifted
-> apart permanently. `docker compose logs app` spells this out. Before the event, with nothing
-> worth keeping:
->
-> ```bash
-> docker compose down -v && docker compose up -d   # -v DELETES db + media + exports. No undo.
-> ```
->
-> **Once the event has real data, never do that.** Put the original password back into
-> `DATABASE_URL`, or change the stored one instead:
->
-> ```bash
-> docker compose exec db psql -U "$POSTGRES_USER" -c \
->   "ALTER ROLE eventsnap WITH PASSWORD 'the-password-now-in-your-.env';"
-> ```
+> **If the site never comes up:** with `APP_ENV=production` the backend **refuses to boot** while `JWT_SECRET`/`ADMIN_PASSWORD_HASH` still hold the `.env.example` placeholders (this is deliberate — a publicly-known signing key is worse than downtime). Caddy then waits on the unhealthy `app` container and never serves. Check `docker compose logs app` — a "Refusing to start … placeholder …" line means you skipped step 2. Rotate the secrets (see below) and restart.
 
 > **Production note:** `docker compose up -d` does **not** expose the database — Postgres is reachable only on the internal Docker network. For local development where you need host access to Postgres, opt into the dev overlay explicitly:
 > ```bash
@@ -213,19 +179,10 @@ TLS certificate and all data volumes survive.
 # JWT secret (64 random bytes)
 openssl rand -hex 64
 
-# Database password (goes in BOTH DATABASE_URL and POSTGRES_PASSWORD)
-openssl rand -hex 24
-
-# Admin password hash (bcrypt). Uses an image the stack already pulls, so it needs
-# nothing installed on the host — `htpasswd` lives in apache2-utils, which a stock
-# VPS does not have. Emits cost 14 rather than 12; that is fine (admin login is
-# rate-limited and hashed off the async runtime), and any $2a/$2b/$2y hash verifies.
-docker run --rm caddy:2-alpine caddy hash-password --plaintext 'yourpassword'
+# Admin password hash (bcrypt, cost 12)
+htpasswd -bnBC 12 "" yourpassword | tr -d ':\n'
 ```
 
-Wrap the resulting hash in **single quotes** in `.env` — see the note there; a bcrypt
-hash is full of `$`, and both Compose and dotenvy would otherwise eat those segments.
-
 ### Environment Variables
 
 See [.env.example](.env.example) for the full list with descriptions and defaults. Key variables:

backend/src/config.rs

@@ -20,53 +20,21 @@ fn looks_placeholder(s: &str) -> bool {
 /// Enforce secret hygiene. In production every guard is hard-fail: a booting app
 /// with a publicly-known signing key is worse than one that refuses to start.
 /// Outside production the dev sentinel is tolerated (warned) so local dev is frictionless.
-///
-/// EVERY failure is collected and reported together. Returning on the first one made fixing two
-/// secrets cost two boot cycles — the operator rotates JWT_SECRET, restarts, and only then learns
-/// about ADMIN_PASSWORD_HASH. Restarting this stack is not free (Caddy waits on the unhealthy app),
-/// and each avoidable cycle is another chance to reach for `down -v`.
-fn validate_secrets(
-    is_prod: bool,
-    jwt_secret: &str,
-    admin_password_hash: &str,
-    database_url: &str,
-) -> Result<()> {
+fn validate_secrets(is_prod: bool, jwt_secret: &str, admin_password_hash: &str) -> Result<()> {
     if is_prod {
-        let mut problems: Vec<&str> = Vec::new();
         if looks_placeholder(jwt_secret) {
-            problems.push(
-                "JWT_SECRET is still the .env.example placeholder — rotate it \
-                 (openssl rand -hex 64).",
-            );
-        } else if jwt_secret.len() < 32 {
-            problems.push("JWT_SECRET must be at least 32 characters.");
+            return Err(anyhow!(
+                "Refusing to start in production with a placeholder JWT_SECRET — \
+                 rotate it (openssl rand -hex 64)."
+            ));
+        }
+        if jwt_secret.len() < 32 {
+            return Err(anyhow!("JWT_SECRET must be at least 32 characters."));
         }
         if admin_password_hash.is_empty() || looks_placeholder(admin_password_hash) {
-            problems.push(
-                "ADMIN_PASSWORD_HASH is unset or still the .env.example placeholder — generate one \
-                 (docker run --rm caddy:2-alpine caddy hash-password --plaintext '<password>').",
-            );
-        }
-        // The DATABASE_URL carries the Postgres password, so a placeholder here means the stack is
-        // running on `CHANGE_ME_use_a_strong_password` — a credential published in the repo. The
-        // app used to boot green on it, because this guard only ever covered the two secrets it
-        // was written for and nothing else looked at POSTGRES_PASSWORD at all.
-        //
-        // Read POSTGRES_PASSWORD's docs before changing this: it is applied ONLY at initdb, so the
-        // remedy is not "edit .env and restart" — see the 28P01 diagnostic in db.rs.
-        if looks_placeholder(database_url) {
-            problems.push(
-                "DATABASE_URL still carries the .env.example placeholder password — set a strong \
-                 one (openssl rand -hex 24) in BOTH DATABASE_URL and POSTGRES_PASSWORD.",
-            );
-        }
-        if !problems.is_empty() {
             return Err(anyhow!(
-                "Refusing to start in production — {} secret(s) still unset or placeholder:\n  - {}\n\
-                 ALL secrets must be set BEFORE the first `docker compose up -d`: Postgres bakes \
-                 POSTGRES_PASSWORD into its data directory on first boot and ignores later changes.",
-                problems.len(),
-                problems.join("\n  - ")
+                "Refusing to start in production without a real ADMIN_PASSWORD_HASH — \
+                 generate one (htpasswd -bnBC 12 '' <password> | tr -d ':\\n')."
             ));
         }
     } else if jwt_secret == DEV_JWT_SECRET_SENTINEL {
@@ -121,12 +89,11 @@ impl AppConfig {
 
         let jwt_secret = std::env::var("JWT_SECRET").context("JWT_SECRET must be set")?;
         let admin_password_hash = std::env::var("ADMIN_PASSWORD_HASH").unwrap_or_default();
-        let database_url = std::env::var("DATABASE_URL").context("DATABASE_URL must be set")?;
 
-        validate_secrets(is_prod, &jwt_secret, &admin_password_hash, &database_url)?;
+        validate_secrets(is_prod, &jwt_secret, &admin_password_hash)?;
 
         Ok(Self {
-            database_url,
+            database_url: std::env::var("DATABASE_URL").context("DATABASE_URL must be set")?,
             jwt_secret,
             session_expiry_days: std::env::var("SESSION_EXPIRY_DAYS")
                 .unwrap_or_else(|_| "30".to_string())
@@ -174,18 +141,12 @@ mod tests {
 
     const REAL_SECRET: &str = "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2";
     const REAL_HASH: &str = "$2y$12$abcdefghijklmnopqrstuv.wxyzABCDEFGHIJKLMNOPQRSTUVWXYZ012";
-    const REAL_DB_URL: &str = "postgres://eventsnap:7f3a9c1e5b2d8a4f@db:5432/eventsnap";
 
     #[test]
     fn prod_rejects_shipped_placeholder_secret() {
         // The exact string shipped in `.env` — >32 chars, so it must be caught by
         // the substring guard, not the length check.
-        let err = validate_secrets(
-            true,
-            "change_me_to_a_random_64_byte_hex_string",
-            REAL_HASH,
-            REAL_DB_URL,
-        );
+        let err = validate_secrets(true, "change_me_to_a_random_64_byte_hex_string", REAL_HASH);
         assert!(
             err.is_err(),
             "placeholder JWT_SECRET must be rejected in prod"
@@ -194,108 +155,29 @@ mod tests {
 
     #[test]
     fn prod_rejects_dev_sentinel_and_short_secret() {
-        assert!(validate_secrets(true, DEV_JWT_SECRET_SENTINEL, REAL_HASH, REAL_DB_URL).is_err());
-        assert!(validate_secrets(true, "tooshort", REAL_HASH, REAL_DB_URL).is_err());
+        assert!(validate_secrets(true, DEV_JWT_SECRET_SENTINEL, REAL_HASH).is_err());
+        assert!(validate_secrets(true, "tooshort", REAL_HASH).is_err());
     }
 
     #[test]
     fn prod_rejects_missing_or_placeholder_admin_hash() {
-        assert!(validate_secrets(true, REAL_SECRET, "", REAL_DB_URL).is_err());
-        assert!(
-            validate_secrets(
-                true,
-                REAL_SECRET,
-                "$2y$12$placeholder_replace_me",
-                REAL_DB_URL
-            )
-            .is_err()
-        );
-    }
-
-    /// The stack used to come up GREEN on the database password published in the repo: this guard
-    /// covered the two secrets it was written for, and nothing anywhere looked at the Postgres
-    /// credential. README step 2 doesn't name POSTGRES_PASSWORD either, so following the
-    /// documented procedure verbatim shipped it.
-    #[test]
-    fn prod_rejects_the_shipped_placeholder_database_password() {
-        let shipped = "postgres://eventsnap:CHANGE_ME_use_a_strong_password@db:5432/eventsnap";
-        let err = validate_secrets(true, REAL_SECRET, REAL_HASH, shipped).unwrap_err();
-        assert!(
-            err.to_string().contains("DATABASE_URL"),
-            "the refusal must name DATABASE_URL, not just fail: {err}"
-        );
-        // And it must point at the initdb trap, or the operator edits .env, restarts, and lands
-        // in a permanent auth-failure loop instead.
-        assert!(
-            err.to_string().contains("POSTGRES_PASSWORD"),
-            "the refusal must name POSTGRES_PASSWORD as the other half: {err}"
-        );
-    }
-
-    /// Every problem in ONE message. Reporting them one per boot made fixing two secrets cost two
-    /// restart cycles, on a stack where Caddy waits on the unhealthy app the whole time.
-    #[test]
-    fn prod_reports_every_placeholder_at_once() {
-        let err = validate_secrets(
-            true,
-            "change_me_to_a_random_64_byte_hex_string",
-            "$2y$12$placeholder_replace_me",
-            "postgres://eventsnap:CHANGE_ME_use_a_strong_password@db:5432/eventsnap",
-        )
-        .unwrap_err()
-        .to_string();
-        for expected in ["JWT_SECRET", "ADMIN_PASSWORD_HASH", "DATABASE_URL"] {
-            assert!(err.contains(expected), "{expected} missing from: {err}");
-        }
-        assert!(
-            err.contains("3 secret(s)"),
-            "the count must match what is listed: {err}"
-        );
+        assert!(validate_secrets(true, REAL_SECRET, "").is_err());
+        assert!(validate_secrets(true, REAL_SECRET, "$2y$12$placeholder_replace_me").is_err());
     }
 
     #[test]
     fn prod_accepts_real_secrets() {
-        assert!(validate_secrets(true, REAL_SECRET, REAL_HASH, REAL_DB_URL).is_ok());
-    }
-
-    /// A real password that happens to contain no placeholder substring must pass — including one
-    /// with URL-ish punctuation, so the guard can't be mistaken for a URL validator.
-    #[test]
-    fn prod_accepts_a_real_database_url_with_awkward_punctuation() {
-        assert!(
-            validate_secrets(
-                true,
-                REAL_SECRET,
-                REAL_HASH,
-                "postgres://eventsnap:aB3%24xY9-_.qW@db:5432/eventsnap"
-            )
-            .is_ok()
-        );
-    }
-
-    /// The e2e stack runs without APP_ENV=production, so none of this applies there — but assert
-    /// it, because a guard that tripped in e2e would be found the hard way.
-    #[test]
-    fn non_prod_ignores_a_placeholder_database_url() {
-        assert!(
-            validate_secrets(
-                false,
-                REAL_SECRET,
-                "",
-                "postgres://eventsnap:CHANGE_ME_use_a_strong_password@db:5432/eventsnap"
-            )
-            .is_ok()
-        );
+        assert!(validate_secrets(true, REAL_SECRET, REAL_HASH).is_ok());
     }
 
     #[test]
     fn non_prod_tolerates_dev_sentinel() {
-        assert!(validate_secrets(false, DEV_JWT_SECRET_SENTINEL, "", REAL_DB_URL).is_ok());
+        assert!(validate_secrets(false, DEV_JWT_SECRET_SENTINEL, "").is_ok());
     }
 
     #[test]
     fn non_prod_still_rejects_short_non_sentinel_secret() {
-        assert!(validate_secrets(false, "tooshort", "", REAL_DB_URL).is_err());
+        assert!(validate_secrets(false, "tooshort", "").is_err());
     }
 
     #[test]
@@ -303,23 +185,9 @@ mod tests {
         // looks_placeholder lowercases before matching — an upper/mixed-case
         // placeholder must still be rejected in prod.
         assert!(
-            validate_secrets(
-                true,
-                "CHANGE_ME_TO_A_RANDOM_64_BYTE_HEX_STRING",
-                REAL_HASH,
-                REAL_DB_URL
-            )
-            .is_err()
-        );
-        assert!(
-            validate_secrets(
-                true,
-                REAL_SECRET,
-                "$2Y$12$PLACEHOLDER_replace_me",
-                REAL_DB_URL
-            )
-            .is_err()
+            validate_secrets(true, "CHANGE_ME_TO_A_RANDOM_64_BYTE_HEX_STRING", REAL_HASH).is_err()
         );
+        assert!(validate_secrets(true, REAL_SECRET, "$2Y$12$PLACEHOLDER_replace_me").is_err());
     }
 
     #[test]
@@ -329,7 +197,7 @@ mod tests {
         const LEN_31: &str = "abcdefghijklmnopqrstuvwxyz01234";
         assert_eq!(LEN_32.len(), 32);
         assert_eq!(LEN_31.len(), 31);
-        assert!(validate_secrets(true, LEN_32, REAL_HASH, REAL_DB_URL).is_ok());
-        assert!(validate_secrets(true, LEN_31, REAL_HASH, REAL_DB_URL).is_err());
+        assert!(validate_secrets(true, LEN_32, REAL_HASH).is_ok());
+        assert!(validate_secrets(true, LEN_31, REAL_HASH).is_err());
     }
 }

backend/src/db.rs

@@ -4,65 +4,17 @@ use sqlx::postgres::PgPoolOptions;
 
 const DEFAULT_MAX_CONNECTIONS: u32 = 10;
 
-/// SQLSTATE for `invalid_password`.
-const PG_INVALID_PASSWORD: &str = "28P01";
-
-/// Turn the one connect failure with an unguessable cause into a self-explaining one.
-///
-/// `POSTGRES_PASSWORD` is honoured ONLY when Postgres initialises its data directory. Change it in
-/// `.env` afterwards and the app authenticates with the new password against a volume that still
-/// holds the old one — a permanent restart loop whose only symptom is
-/// `password authentication failed`.
-///
-/// The production secret guard makes that sequence NEARLY CERTAIN rather than rare: it stops the
-/// app on the first `docker compose up -d`, but not the `db` service in that same command, which
-/// initialises and bakes in whatever password was in `.env` at that moment. So the intended
-/// recovery — see the refusal, fix your secrets, boot again — is exactly the sequence that breaks
-/// it. Nothing in the error names the cause, and the remedy destroys data, so it is the last thing
-/// an operator should guess at.
-fn explain_auth_failure(err: &sqlx::Error) {
-    let is_auth_failure = match err {
-        sqlx::Error::Database(db) => db.code().as_deref() == Some(PG_INVALID_PASSWORD),
-        _ => false,
-    };
-    if !is_auth_failure {
-        return;
-    }
-    tracing::error!(
-        "Postgres rejected the credentials in DATABASE_URL (SQLSTATE {PG_INVALID_PASSWORD}).\n\
-         \n\
-         This almost always means POSTGRES_PASSWORD was changed AFTER the database volume was \
-         first created. Postgres applies that variable only when it initialises its data \
-         directory; editing .env and restarting does not change the stored password, so the two \
-         drift apart permanently.\n\
-         \n\
-         If the event has NOT started and you have no data worth keeping:\n\n    \
-         docker compose down -v && docker compose up -d\n\n\
-         (-v DELETES the database, the uploaded media and the exports. There is no undo.)\n\
-         \n\
-         If you DO have data: restore the old password into DATABASE_URL instead, or change the \
-         stored one with ALTER ROLE inside the running db container. Never reach for -v to fix a \
-         login problem on a live event."
-    );
-}
-
 pub async fn create_pool(database_url: &str) -> Result<PgPool> {
     let max_connections = std::env::var("DATABASE_MAX_CONNECTIONS")
         .ok()
         .and_then(|s| s.parse::<u32>().ok())
         .unwrap_or(DEFAULT_MAX_CONNECTIONS);
 
-    let pool = match PgPoolOptions::new()
+    let pool = PgPoolOptions::new()
         .max_connections(max_connections)
         .connect(database_url)
         .await
-    {
-        Ok(pool) => pool,
-        Err(e) => {
-            explain_auth_failure(&e);
-            return Err(e).context("failed to connect to database");
-        }
-    };
+        .context("failed to connect to database")?;
 
     sqlx::migrate!()
         .run(&pool)

backend/src/handlers/admin.rs

@@ -197,23 +197,6 @@ pub async fn patch_config(
                     "Wert für {key} liegt außerhalb des zulässigen Bereichs ({min}–{max})."
                 )));
             }
-            // Zero is in range and catastrophic. `quota_tolerance` is the multiplier in
-            // `free_disk * tolerance / active_uploaders`, so 0 makes every per-user limit 0 and
-            // refuses EVERY upload — mid-event, with "Du hast dein Upload-Limit für dieses Event
-            // erreicht", an error naming the wrong cause entirely. `storage_quota_enabled` is the
-            // intended off-switch.
-            //
-            // Rejecting the value rather than raising the floor: very small tolerances are
-            // legitimate (they are how a large disk is throttled down to a sensible per-guest
-            // ceiling, and how the e2e quota tests steer it — around 1e-5 on a 174 GB volume), so
-            // a floor of, say, 0.01 would forbid real configurations to prevent one typo.
-            if key_str == "quota_tolerance" && n == 0.0 {
-                return Err(AppError::BadRequest(
-                    "quota_tolerance = 0 würde jeden Upload blockieren. Zum Abschalten der \
-                     Speicher-Quote stattdessen „Speicher-Quote aktiv“ ausschalten."
-                        .into(),
-                ));
-            }
         } else if BOOL_KEYS.contains(&key_str) {
             match value.trim().to_ascii_lowercase().as_str() {
                 "true" | "false" | "1" | "0" | "yes" | "no" | "on" | "off" => {}

backend/src/services/export.rs

@@ -580,7 +580,7 @@ async fn run_zip_export_inner(
             };
             let entry_name = format!("{folder}/{date}_{name_safe}_{}.{ext}", row.id);
 
-            let builder = keepsake_entry(entry_name, Compression::Stored);
+            let builder = ZipEntryBuilder::new(entry_name.into(), Compression::Stored);
 
             // Open BEFORE writing the entry header. A missing source is skipped (the media file
             // was deleted, or its processing failed) — but it must be skipped without aborting the
@@ -973,7 +973,7 @@ async fn run_html_export_inner(
 
         // Write data.json
         {
-            let builder = keepsake_entry("data.json".into(), Compression::Deflate);
+            let builder = ZipEntryBuilder::new("data.json".into(), Compression::Deflate);
             let mut entry = zip.write_entry_stream(builder).await?;
             let mut cursor = AllowStdIo::new(std::io::Cursor::new(data_json.as_bytes()));
             fcopy(&mut cursor, &mut entry).await?;
@@ -982,7 +982,7 @@ async fn run_html_export_inner(
 
         // Write README.txt
         {
-            let builder = keepsake_entry("README.txt".into(), Compression::Deflate);
+            let builder = ZipEntryBuilder::new("README.txt".into(), Compression::Deflate);
             let mut entry = zip.write_entry_stream(builder).await?;
             let mut cursor = AllowStdIo::new(std::io::Cursor::new(README_TEXT.as_bytes()));
             fcopy(&mut cursor, &mut entry).await?;
@@ -1015,7 +1015,7 @@ async fn run_html_export_inner(
             };
 
             let entry_name = format!("media/{name}");
-            let builder = keepsake_entry(entry_name, Compression::Stored);
+            let builder = ZipEntryBuilder::new(entry_name.into(), Compression::Stored);
             let mut zip_entry = zip.write_entry_stream(builder).await?;
             let mut f = src_file.compat();
             fcopy(&mut f, &mut zip_entry).await?;
@@ -1552,36 +1552,6 @@ async fn maybe_broadcast_complete(
 /// double-clicking `index.html` (file://), where browsers block a cross-origin
 /// `fetch()` of a sibling `data.json` — so the data is inlined into the page.
 /// (`data.json` is still written separately for the http-served case.)
-/// Permissions stamped on every entry in both archives: `rw-r--r--`.
-///
-/// `ZipEntryBuilder::new` leaves the external file attribute at zero, and the host compatibility
-/// defaults to Unix — so every entry was written with a stored mode of **0000**. Windows Explorer
-/// ignores Unix modes and was fine, which is exactly why this survived: on Linux and macOS
-/// `unzip` faithfully applies what the archive asks for, and the guest gets a directory of files
-/// none of which they can open. `?---------` on every line of `unzip -Z`.
-///
-/// That is the keepsake — the artifact the whole event exists to produce — arriving unreadable,
-/// after distribution, with no server-side symptom at all.
-/// `S_IFREG | 0644`. The type bits are included because the mode is written whole into the high
-/// half of the external file attribute: without them extractors see a file of type "unknown"
-/// (`unzip -Z` renders `?rw-r--r--`), which works but is not what the archive means to say.
-const KEEPSAKE_ENTRY_MODE: u16 = 0o100_644;
-
-/// Build a ZIP entry for the keepsake. ALL entries in both archives go through here so the mode
-/// can't be forgotten at one of the six call sites.
-fn keepsake_entry(name: String, compression: Compression) -> ZipEntryBuilder {
-    ZipEntryBuilder::new(name.into(), compression).unix_permissions(KEEPSAKE_ENTRY_MODE)
-}
-
-/// Escape a JSON payload for inlining inside a `<script>` element.
-///
-/// See the call site in [`write_viewer_with_data`] for why this is every `<` and not just `</`.
-/// Kept separate so the property that matters — no `<` survives, and the value still decodes to
-/// the original — can be asserted without building a ZIP.
-fn escape_json_for_script(data_json: &str) -> String {
-    data_json.replace('<', "\\u003c")
-}
-
 async fn write_viewer_with_data(
     dir: &include_dir::Dir<'_>,
     zip: &mut ZipFileWriter<tokio::fs::File>,
@@ -1593,31 +1563,8 @@ async fn write_viewer_with_data(
         if path == "index.html" {
             let html = std::str::from_utf8(file.contents())
                 .context("export-viewer index.html is not valid UTF-8")?;
-            // Escape EVERY `<`, not just `</`.
-            //
-            // `</` -> `<\/` stops the obvious break-out (`</script><img onerror=…>`) and is inert
-            // against XSS. It does not stop the caption steering the HTML TOKENIZER. A caption
-            // containing `<!--<script` with no later `-->` puts the parser into
-            // script-data-double-escaped state; from there the template's own `</script>` only
-            // steps back to script-data-escaped instead of closing the element, and the rest of the
-            // document — including the viewer bundle — is swallowed as script data. Nothing
-            // executes and nothing leaks; `window.__EXPORT_DATA__` is simply never assigned and the
-            // keepsake opens blank.
-            //
-            // That failure is silent and POST-DISTRIBUTION: the export succeeds, the ZIP is
-            // well-formed, the job writes `done`, /export/status is green, and the host hands out a
-            // file that only fails when a guest double-clicks index.html — in every copy, with no
-            // way to fix it after the fact. Reachable from any guest-authored caption or comment,
-            // since both are embedded in the viewer.
-            //
-            // `<` never appears in JSON structural syntax — only inside string values — so a global
-            // replace is sound, and `<` is valid in both JSON and a JS string literal. One
-            // rule covers `</script`, `<!--` and `<script` together, which is the point: the
-            // previous escape was named for the single case it did handle.
-            //
-            // NOTE this is deliberately only for the INLINED copy. `data.json` is written
-            // separately, in no HTML context, and must stay literal.
-            let safe = escape_json_for_script(data_json);
+            // Escape `</` so a caption containing `</script>` can't break out of the tag.
+            let safe = data_json.replace("</", "<\\/");
             // Match the live app's colour theme: inject the same `:root:root{…}` override
             // the app builds at runtime so a rose/sage/custom event exports a rose/sage
             // keepsake (not the embedded default gold). The CSS is generated purely from
@@ -1631,13 +1578,13 @@ async fn write_viewer_with_data(
                 Some(idx) => format!("{}{}{}", &html[..idx], head_inject, &html[idx..]),
                 None => format!("{head_inject}{html}"),
             };
-            let builder = keepsake_entry(path, Compression::Deflate);
+            let builder = ZipEntryBuilder::new(path.into(), Compression::Deflate);
             let mut entry = zip.write_entry_stream(builder).await?;
             let mut cursor = AllowStdIo::new(std::io::Cursor::new(injected.as_bytes()));
             fcopy(&mut cursor, &mut entry).await?;
             entry.close().await?;
         } else {
-            let builder = keepsake_entry(path, Compression::Deflate);
+            let builder = ZipEntryBuilder::new(path.into(), Compression::Deflate);
             let mut entry = zip.write_entry_stream(builder).await?;
             let mut cursor = AllowStdIo::new(std::io::Cursor::new(file.contents()));
             fcopy(&mut cursor, &mut entry).await?;
@@ -1868,62 +1815,6 @@ mod tests {
         }
     }
 
-    /// Every `<` is escaped, whatever it is part of.
-    ///
-    /// PREVENTS the regression to `</` -> `<\\/`, which is named for the one case it handles.
-    /// `<!--<script` with no later `-->` drives the HTML tokenizer into
-    /// script-data-double-escaped state, where the template's own `</script>` no longer closes
-    /// the element — the viewer bundle is swallowed as script data, `__EXPORT_DATA__` is never
-    /// assigned, and the keepsake opens blank in every copy the host has already handed out.
-    #[test]
-    fn no_left_angle_bracket_survives_inlining() {
-        for payload in [
-            r#"{"caption":"<!--<script"}"#,
-            r#"{"caption":"</script><img src=x onerror=alert(1)>"}"#,
-            r#"{"caption":"<!--"}"#,
-            r#"{"caption":"<script>"}"#,
-            r#"{"caption":"a < b"}"#,
-        ] {
-            let escaped = escape_json_for_script(payload);
-            assert!(
-                !escaped.contains('<'),
-                "a surviving `<` can still steer the tokenizer: {escaped}"
-            );
-        }
-    }
-
-    /// The escape must not change what the viewer READS — it is a transport encoding, not a
-    /// sanitiser. A caption is guest-authored text that has to render back exactly.
-    #[test]
-    fn the_payload_still_decodes_to_the_original_value() {
-        // `<` appears only inside JSON string values, never in structural syntax, so a global
-        // replace is sound — this is the assertion that says so.
-        for caption in [
-            "<!--<script",
-            "</script><img src=x onerror=alert(1)>",
-            "a < b und c > d",
-            "ganz normale Bildunterschrift",
-            "Herz <3",
-        ] {
-            let json = serde_json::json!({ "posts": [{ "caption": caption }] }).to_string();
-            let escaped = escape_json_for_script(&json);
-            let back: serde_json::Value =
-                serde_json::from_str(&escaped).expect("the escaped form must still be valid JSON");
-            assert_eq!(
-                back["posts"][0]["caption"].as_str(),
-                Some(caption),
-                "the caption must survive the round trip unchanged"
-            );
-        }
-    }
-
-    /// Nothing else in the document is touched.
-    #[test]
-    fn a_payload_with_no_angle_brackets_is_unchanged() {
-        let json = r#"{"posts":[{"caption":"schönes Foto"}]}"#;
-        assert_eq!(escape_json_for_script(json), json);
-    }
-
     #[test]
     fn a_lone_armed_job_reserves_for_one_archive() {
         // A ViewerOnly regeneration re-arms only the HTML half — reserving for two would refuse

e2e/specs/05-admin/config.spec.ts

@@ -68,40 +68,6 @@ test.describe('Admin — config API', () => {
     expect(cfg.privacy_note).toBe(note);
     await api.patchConfig(adminToken, { privacy_note: '' });
   });
-  test('quota_tolerance = 0 is rejected, with a pointer to the real off-switch', async ({
-    api,
-    adminToken,
-  }) => {
-    // Zero is inside the documented 0–1 range and catastrophic: the per-user limit is
-    // `free_disk * tolerance / active_uploaders`, so 0 refuses EVERY upload — mid-event, with
-    // "Du hast dein Upload-Limit für dieses Event erreicht", which names the wrong cause
-    // entirely. `storage_quota_enabled` is what an admin reaching for an off-switch wants.
-    const res = await fetch(
-      (process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/admin/config',
-      {
-        method: 'PATCH',
-        headers: { Authorization: `Bearer ${adminToken}`, 'Content-Type': 'application/json' },
-        body: JSON.stringify({ quota_tolerance: '0' }),
-      }
-    );
-    expect(res.status).toBe(400);
-    expect(
-      (await res.text()).toLowerCase(),
-      'the error must name the switch the admin actually wanted'
-    ).toContain('speicher-quote');
-
-    // The value is untouched — validation fully precedes any write.
-    expect((await api.getConfig(adminToken)).quota_tolerance).toBe('0.75');
-  });
-
-  test('a very small quota_tolerance is still accepted', async ({ api, adminToken }) => {
-    // The mirror. Rejecting 0 must not become a floor: small tolerances are how a large disk is
-    // throttled to a sensible per-guest ceiling, and how the quota specs steer it (~1e-5 on a
-    // 174 GB volume). A floor of 0.01 would forbid real configurations to prevent one typo.
-    await api.patchConfig(adminToken, { quota_tolerance: '0.00001' });
-    expect((await api.getConfig(adminToken)).quota_tolerance).toBe('0.00001');
-    await api.patchConfig(adminToken, { quota_tolerance: '0.75' });
-  });
 });
 
 test.describe('Admin — stats', () => {

e2e/specs/06-export/archive-permissions.spec.ts

@@ -1,103 +0,0 @@
-/**
- * Regression guard — the keepsake extracts to files a guest can actually open.
- *
- * `ZipEntryBuilder::new` leaves the external file attribute at zero, and async_zip's host
- * compatibility defaults to Unix — so every entry in BOTH archives was written with a stored mode
- * of 0000. `unzip -Z` showed `?---------` on every line.
- *
- * Windows Explorer ignores Unix modes, which is exactly why this survived. On Linux and macOS,
- * `unzip` faithfully applies what the archive asks for, and the guest gets a folder of photos none
- * of which they can open — plus an index.html the browser refuses with ERR_ACCESS_DENIED.
- *
- * Unconditional: it affected every keepsake ever produced, no hostile input required. And it is
- * invisible server-side — the export succeeds, the ZIP is well-formed, the job writes `done`,
- * /export/status is green. The only way to see it is to extract the real artifact and try to read
- * it, which is what this does.
- *
- * Found while chasing an unrelated ERR_ACCESS_DENIED that looked like a Playwright quirk.
- */
-import { test, expect } from '../../fixtures/test';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, writeFileSync, rmSync, readFileSync, statSync, readdirSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { seedUpload } from '../../helpers/seed';
-import { BASE } from '../../helpers/env';
-
-/** Walk every file under `dir`, ignoring the archives we dropped there ourselves. */
-function walk(dir: string, skip: string[] = []): string[] {
-  return readdirSync(dir, { withFileTypes: true }).flatMap((e) => {
-    const p = join(dir, e.name);
-    if (e.isDirectory()) return walk(p, skip);
-    return skip.includes(e.name) ? [] : [p];
-  });
-}
-
-test.describe('Export — the archives extract to readable files', () => {
-  test('every entry in both keepsake archives is owner-readable', async ({ host, guest, db }) => {
-    test.setTimeout(120_000);
-    const bearer = { Authorization: `Bearer ${host.jwt}` };
-
-    const g = await guest('Archivist');
-    const id = await seedUpload(g.jwt, { caption: 'ein Foto' });
-    await expect.poll(() => db.compressionStatus(id), { timeout: 30_000 }).toBe('done');
-
-    expect(
-      (await fetch(`${BASE}/api/v1/host/gallery/release`, { method: 'POST', headers: bearer }))
-        .status
-    ).toBe(204);
-
-    await expect
-      .poll(
-        async () => {
-          const res = await fetch(`${BASE}/api/v1/export/status`, { headers: bearer });
-          const s = await res.json();
-          return s.zip?.status === 'done' && s.html?.status === 'done';
-        },
-        { timeout: 90_000, intervals: [500] }
-      )
-      .toBe(true);
-
-    for (const kind of ['zip', 'html'] as const) {
-      const ticketRes = await fetch(`${BASE}/api/v1/export/ticket`, {
-        method: 'POST',
-        headers: bearer,
-      });
-      const { ticket } = (await ticketRes.json()) as { ticket: string };
-      const dl = await fetch(`${BASE}/api/v1/export/${kind}?ticket=${encodeURIComponent(ticket)}`);
-      expect(dl.status, `downloading the ${kind} archive`).toBe(200);
-
-      const dir = mkdtempSync(join(tmpdir(), `eventsnap-perms-${kind}-`));
-      try {
-        const zipPath = join(dir, 'archive.zip');
-        writeFileSync(zipPath, Buffer.from(await dl.arrayBuffer()));
-
-        // The mode as STORED in the archive — this is what a guest's unzip will apply. Reading it
-        // from the central directory catches the defect even on a filesystem that would mask it.
-        const listing = execFileSync('unzip', ['-Z', zipPath], { encoding: 'utf8' });
-        const modes = listing
-          .split('\n')
-          .filter((l) => /^[?d-][rwx-]{9}\s/.test(l))
-          .map((l) => l.slice(0, 10));
-        expect(modes.length, `${kind}: no entries listed`).toBeGreaterThan(0);
-        for (const m of modes) {
-          expect(m, `${kind}: an entry is stored mode ${m} — the guest cannot open it`).toMatch(
-            /^.r[w-]-/
-          );
-        }
-
-        // And extraction really does produce readable files.
-        execFileSync('unzip', ['-qo', zipPath, '-d', dir]);
-        const files = walk(dir, ['archive.zip']);
-        expect(files.length, `${kind}: nothing extracted`).toBeGreaterThan(0);
-        for (const f of files) {
-          expect(statSync(f).mode & 0o400, `${f} is not owner-readable`).toBeTruthy();
-          // The assertion that matters to a guest: the bytes actually come out.
-          expect(() => readFileSync(f)).not.toThrow();
-        }
-      } finally {
-        rmSync(dir, { recursive: true, force: true });
-      }
-    }
-  });
-});

e2e/specs/06-export/viewer-caption-injection.spec.ts

@@ -1,125 +0,0 @@
-/**
- * Regression guard — a guest-authored caption cannot brick the offline keepsake.
- *
- * The viewer's data is inlined as `<script>window.__EXPORT_DATA__={…};</script>` (it must be:
- * guests open index.html over file://, where a cross-origin fetch of a sibling data.json is
- * blocked). Captions and comments are guest text and land in that payload.
- *
- * The escape used to be `</` → `<\/`. Against XSS that holds — `</script><img src=x onerror=…>`
- * round-trips inert. It does NOT stop the caption steering the HTML TOKENIZER: `<!--<script` with
- * no later `-->` drives the parser into script-data-double-escaped state, where the template's own
- * `</script>` steps back to script-data-escaped instead of closing the element. Everything after —
- * including the viewer bundle — is swallowed as script data. Nothing executes and nothing leaks;
- * `__EXPORT_DATA__` is never assigned and the keepsake renders blank.
- *
- * What makes it worth a browser-level test rather than a unit test alone: the failure is SILENT and
- * POST-DISTRIBUTION. The export succeeds, the ZIP is well-formed, the job writes `done`,
- * /export/status is green, and the host hands out a file that only fails when a guest
- * double-clicks it — in every copy, unfixably. It is not visible by reading the escape. It is only
- * visible by running a real parser over the real artifact, which is what this does: release, pull
- * the actual Memories.zip, extract index.html, open it over file:// in Chromium, and assert the
- * viewer actually booted.
- *
- * The near-miss worth recording: `<!--<script>alert(1)</script>-->` comes back CLEAN, because the
- * trailing `-->` returns the parser to script-data state. A probe using the terminated form
- * quietly repairs the very thing it is testing for. Only the unterminated variant exposes it.
- */
-import { test, expect } from '../../fixtures/test';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { seedUpload } from '../../helpers/seed';
-import { BASE } from '../../helpers/env';
-
-/** Unterminated on purpose — see the header. The terminated form self-repairs. */
-const TOKENIZER_PAYLOAD = '<!--<script';
-/** The classic break-out. Already handled, kept so the fix can never regress on it. */
-const BREAKOUT_PAYLOAD = '</script><img src=x onerror=window.__XSS__=1>';
-
-test.describe('Export — a caption cannot brick the keepsake viewer', () => {
-  test('the exported viewer boots with a tokenizer-hostile caption in it', async ({
-    page,
-    host,
-    guest,
-    db,
-  }) => {
-    test.setTimeout(120_000);
-    const bearer = { Authorization: `Bearer ${host.jwt}` };
-
-    const g = await guest('Trickster');
-    const a = await seedUpload(g.jwt, { caption: TOKENIZER_PAYLOAD });
-    const b = await seedUpload(g.jwt, { caption: BREAKOUT_PAYLOAD });
-    for (const id of [a, b]) {
-      await expect.poll(() => db.compressionStatus(id), { timeout: 30_000 }).toBe('done');
-    }
-
-    expect(
-      (await fetch(`${BASE}/api/v1/host/gallery/release`, { method: 'POST', headers: bearer }))
-        .status
-    ).toBe(204);
-
-    await expect
-      .poll(
-        async () => {
-          const res = await fetch(`${BASE}/api/v1/export/status`, { headers: bearer });
-          return (await res.json()).html?.status;
-        },
-        { timeout: 90_000, intervals: [500] }
-      )
-      .toBe('done');
-
-    const ticketRes = await fetch(`${BASE}/api/v1/export/ticket`, {
-      method: 'POST',
-      headers: bearer,
-    });
-    const { ticket } = (await ticketRes.json()) as { ticket: string };
-    const dl = await fetch(`${BASE}/api/v1/export/html?ticket=${encodeURIComponent(ticket)}`);
-    expect(dl.status).toBe(200);
-
-    const dir = mkdtempSync(join(tmpdir(), 'eventsnap-viewer-'));
-    try {
-      const zipPath = join(dir, 'Memories.zip');
-      writeFileSync(zipPath, Buffer.from(await dl.arrayBuffer()));
-      // Extract the WHOLE archive: index.html pulls in the viewer's own JS/CSS, and the point of
-      // this test is that those later resources are still reachable by the parser.
-      execFileSync('unzip', ['-qo', zipPath, '-d', dir]);
-
-      // file://, not http://. That is how a guest actually opens the keepsake, and it is the
-      // whole reason the data is inlined rather than fetched from a sibling data.json.
-      let xss = false;
-      page.on('dialog', (d) => {
-        xss = true;
-        void d.dismiss();
-      });
-      await page.goto('file://' + join(dir, 'index.html'));
-
-      // 1. The payload was assigned at all. This is the assertion that fails on the old escape —
-      //    the second script block is never reached, so the global stays undefined.
-      const captions = await page.evaluate(() => {
-        const d = (window as unknown as { __EXPORT_DATA__?: { posts?: { caption?: string }[] } })
-          .__EXPORT_DATA__;
-        return d?.posts?.map((p) => p.caption ?? '') ?? null;
-      });
-      expect(captions, '__EXPORT_DATA__ was never assigned — the viewer is bricked').not.toBeNull();
-
-      // 2. The captions survived verbatim. The escape is a transport encoding, not a sanitiser:
-      //    a guest's text has to come back exactly, or we have silently rewritten their words.
-      expect(captions).toContain(TOKENIZER_PAYLOAD);
-      expect(captions).toContain(BREAKOUT_PAYLOAD);
-
-      // 3. And nothing executed.
-      expect(
-        await page.evaluate(() => (window as unknown as { __XSS__?: number }).__XSS__ === 1),
-        'the caption must be inert, not merely non-fatal'
-      ).toBe(false);
-      expect(xss).toBe(false);
-
-      // 4. The viewer actually rendered — the whole document parsed, not just the head. If the
-      //    tokenizer had swallowed the bundle, the body would be empty of viewer output.
-      await expect(page.locator('body')).not.toBeEmpty();
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});