Skip to main content

restore_snapshot_file

freenet::dev_tool

Function restore_snapshot_file 

Source 
pub fn restore_snapshot_file(
    delegate_dir: &Path,
    secret_encoded: &str,
    timestamp_ms: u64,
    suffix: Option<u32>,
    snapshots_enabled: bool,
) -> Result<(), RestoreError>
Expand description

Restore the snapshot matching timestamp_ms onto the active secret path, purely at the filesystem level — no cipher, no ReDb index.

delegate_dir is <secrets_dir>/<delegate_encoded>; secret_encoded is the on-disk secret file name (bs58 of the secret hash). The active secret file is delegate_dir/{secret_encoded}; its snapshot history lives in delegate_dir/.snapshots/{secret_encoded}/.

Mirrors the durability discipline of SecretsStore::store_secret:

  1. snapshot the current active value first (so the restore is itself reversible) when snapshots_enabled,
  2. copy the chosen snapshot to a sibling .tmp, fsync, then atomically rename onto the active path.

History thinning is intentionally NOT done here — callers thin AFTER their own post-restore bookkeeping. The node runtime thins only after its ReDb index repair commits, so a failed repair cannot prune source history a retry would need; the CLI thins right after a successful restore. (Keeping thin out of the shared core is what makes the runtime path byte-for-byte order-preserving vs. the pre-extraction inline implementation.)

suffix selects among same-millisecond collision entries (which list_snapshots / snapshot-list surface as the suffix column):

  • None — the unsuffixed file wins, then the lowest-numbered suffix (the historical SecretsStore::restore_snapshot behavior; the common case, since a timestamp without collisions has exactly one entry).
  • Some(n) — restore exactly the .n collision entry, so an operator can target a specific row from the listing rather than silently getting the unsuffixed one.

Shared by SecretsStore::restore_snapshot (node runtime; passes None and adds the in-memory + ReDb index repair) and the freenet secrets snapshot-restore CLI (node stopped). Byte-level copy: the restored ciphertext stays decryptable by whatever cipher wrote it.

§Errors