Recovery paths: code, schema, full backup, recovery tool and data purge
Conditions of code and schema rollback, the full restore procedure, the manual backup, the recovery key and web recovery, and the safeguards of the full data purge.
The Update Manager offers four ways back: code rollback, schema rollback, full restore from a backup and the independent recovery tool. Each runs in the update service library with its own function key.
Recovery paths
| Path | Endpoint | Behaviour and condition |
|---|---|---|
| Code | update.rollback | Swaps back the code tree from before the last completed update from previous/; the database is unchanged, the installed version goes back. Condition: code_rollback_allowed = 1, the old tree exists, no active run. For a non-additive schema: "Use the full restore instead". |
| Schema | update.schemarollback | Reverts the update's migrations (revertVersioned) if all are reversible; only after the code rollback, otherwise an error. |
| Full | update.restore | verified backups only; maintenance mode for 1 hour, recovery tool installed, dump and code zip retrieved (downloaded for remote targets), the recovery engine reloads database and code; open runs closed, version set to the backup's, log, notification. The confirmation field must contain exactly "RESTORE" + the version. |
| Manual backup | update.backup | An action = backup run: the update's backup phase with the same verification and retention, done without activation. Condition: no other active run, a backup target exists. |
Recovery tool
update.recoverykey: new key, returned once; only the password hash remains on disk in the update storage folder, which is closed to web access; the recovery tool is installed.update.recoveryenable: web use of the independent recovery tool for 1 hour, with a warning log line.
Full data purge
update.purge: deletes all data of the module. isSuper() only; exact confirmation text required and a verified backup from the last 7 days, otherwise an error (error_purge_confirm, error_purge_backup).
Data used
Table names carry the installation's own prefix in the database.
update_run, update_backup, update_log, migration; for a full restore the whole database within the scope of the dump. Backup target: local storage or the installation's Google account.
Permissions
Function keys (all SYSTEM): rollback, restore, backup, recovery. The full purge belongs to the super administrator only. No content scope.
Known limitations
The recovery paths are tested with local transport; they have not yet run on a live central server or with a real Drive archive. Data created after the backup is lost on a full restore.