feat(backup): wire the real Mokosh backup/restore client (BUNYIP-356) #357

Merged

longjacksonle merged 1 commit from feat/BUNYIP-356-mokosh-backup-adapter into main

2026-07-10 20:34:17 +02:00

longjacksonle commented

2026-07-10 20:07:24 +02:00

Owner

Summary

Replaces the pending MokoshBackupAdapter stub (BUNYIP-353) with a real HTTP client that calls mokosh-server's tenant data API, so an account backup captures - and restores - the account's Mokosh PSA data instead of recording Mokosh as "unavailable" (BUNYIP-356).

How it works

bunyip is the OIDC issuer, and Mokosh scopes its admin export/import to the token user's own tenant, so a bare service token has no tenant to act on. The adapter mints a short-lived Mokosh-audience at+jwt for the acting admin via OidcProvider::mint_access_token, sourcing the audience + TTL from the seeded mokosh-apps OAuth client, and uses it as the server-to-server bearer.
backup -> GET /api/v1/data/export, returns the envelope. restore -> POST /api/v1/data/import with confirm = the tenant_name the envelope now carries (mokosh-server PMS-647, PR #443) plus the export payload.
Lives in bunyip-api, not bunyip-domain: it depends on bunyip-oidc, and the dependency direction forbids the domain crate from depending on oidc. main.rs registers the real adapter only when MOKOSH_BACKUP_API_URL is set and the OIDC provider + mokosh-apps client are present; otherwise it falls back to the domain's pending stub. No change for deployments that don't set the URL.

Tests

wiremock unit tests cover the HTTP mapping and the confirm extraction: export 2xx -> Produced, non-2xx -> Unavailable; import posts confirm + envelope and reads success / returns false on non-2xx; a bundle missing tenant_name errors before any token is minted. just check-container green (fmt + clippy -D warnings + full suite: bunyip-api 69 passed, domain 271, web 94). Full end-to-end (real minted token against a live Mokosh) is exercised in the dev-sso stack.

Caveats / sequencing

Depends on mokosh-server PR #443 (adds tenant_name to the export envelope) for the restore confirm.
Mokosh's import/restore is still maturing: its round-trip test is quarantined pending a deferrable-FK migration (mokosh-server PMS-648). So backup/export works today; restore is code-complete here but gated on PMS-648 landing.
Config: set MOKOSH_BACKUP_API_URL to Mokosh's internal service URL to enable (documented in .env.example).

🤖 Generated with Claude Code

## Summary Replaces the pending `MokoshBackupAdapter` stub (BUNYIP-353) with a real HTTP client that calls mokosh-server's tenant data API, so an account backup captures - and restores - the account's Mokosh PSA data instead of recording Mokosh as "unavailable" (BUNYIP-356). ## How it works - bunyip is the OIDC issuer, and Mokosh scopes its admin export/import to the **token user's own tenant**, so a bare service token has no tenant to act on. The adapter mints a short-lived Mokosh-audience `at+jwt` for the acting admin via `OidcProvider::mint_access_token`, sourcing the audience + TTL from the seeded mokosh-apps OAuth client, and uses it as the server-to-server bearer. - `backup` -> `GET /api/v1/data/export`, returns the envelope. `restore` -> `POST /api/v1/data/import` with `confirm` = the `tenant_name` the envelope now carries (mokosh-server PMS-647, PR #443) plus the export payload. - Lives in `bunyip-api`, not `bunyip-domain`: it depends on `bunyip-oidc`, and the dependency direction forbids the domain crate from depending on oidc. `main.rs` registers the real adapter only when `MOKOSH_BACKUP_API_URL` is set and the OIDC provider + mokosh-apps client are present; otherwise it falls back to the domain's pending stub. No change for deployments that don't set the URL. ## Tests wiremock unit tests cover the HTTP mapping and the confirm extraction: export 2xx -> `Produced`, non-2xx -> `Unavailable`; import posts `confirm` + envelope and reads success / returns false on non-2xx; a bundle missing `tenant_name` errors before any token is minted. `just check-container` green (fmt + clippy `-D warnings` + full suite: bunyip-api 69 passed, domain 271, web 94). Full end-to-end (real minted token against a live Mokosh) is exercised in the `dev-sso` stack. ## Caveats / sequencing - Depends on mokosh-server PR #443 (adds `tenant_name` to the export envelope) for the restore `confirm`. - Mokosh's import/restore is still maturing: its round-trip test is quarantined pending a deferrable-FK migration (mokosh-server PMS-648). So **backup/export works today; restore is code-complete here but gated on PMS-648 landing.** - Config: set `MOKOSH_BACKUP_API_URL` to Mokosh's internal service URL to enable (documented in `.env.example`). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

longjacksonle added 1 commit

2026-07-10 20:07:24 +02:00

feat(backup): wire the real Mokosh backup/restore client (BUNYIP-356)

E2E / Playwright against deployment (pull_request) Successful in 5s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 18m40s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

3a92dfa5a7

Replaces the pending MokoshBackupAdapter stub with a real HTTP client that calls mokosh-server's tenant data API, so an account backup captures (and restores) the account's Mokosh PSA data instead of recording Mokosh as "unavailable".

bunyip is the OIDC issuer, and Mokosh scopes its admin export/import to the token user's own tenant, so the adapter mints a short-lived Mokosh-audience at+jwt for the acting admin via OidcProvider::mint_access_token (sourcing the audience/TTL from the seeded mokosh-apps OAuth client) and uses it as the server-to-server bearer. backup GETs /api/v1/data/export and returns the envelope; restore POSTs /api/v1/data/import with confirm set to the tenant_name the envelope now carries (mokosh-server PMS-647) plus the export payload.

The adapter lives in bunyip-api, not bunyip-domain: it depends on bunyip-oidc, and the dependency direction forbids the domain crate from depending on oidc. main.rs registers the real adapter only when MOKOSH_BACKUP_API_URL is set and the OIDC provider + mokosh-apps client are present; otherwise it falls back to the domain's pending stub. No behavior change for deployments that do not configure the URL.

The HTTP request/response mapping and the confirm extraction are covered by wiremock unit tests (export 2xx -> Produced, non-2xx -> Unavailable; import posts confirm+envelope and reads success; missing tenant_name errors before minting). Full end-to-end (real token against a live Mokosh) is exercised in the dev-sso stack.

Note: Mokosh's import/restore is still maturing (its round-trip test is quarantined pending a deferrable-FK migration, mokosh-server PMS-648), so restore is code-complete here but gated on that landing; backup/export works today.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gTWMeFYgEAiRKCV3L9jAb