From 9bbd7bdac1ff301921764972e7d08f8eb14e7534 Mon Sep 17 00:00:00 2001 From: Paul Lizer Date: Wed, 19 Aug 2026 17:09:36 -0400 Subject: [PATCH] Stage D part 6: Backup & Recovery, completing Stage D One tab carried the entire backup, migration, restore, Cosmos editing and job history surface: 1,622 lines in a single scroll. Backup readiness, backup, schedule, storage, encryption Migrate migration workflow Restore backup inventory and restore Cosmos Editor direct database editor Jobs job history Navigation is now 14 groups / 44 tabs / 88 sections. Stage D is done, from an original 17 flat tabs. Three problems the existing tools could not handle The migration card is a
, not a
, so every div balancing helper walked straight past it and the tools reported five top level cards where there were six. Its boundaries were found by balancing
instead, and the split was driven from explicit ranges with a check that every one of the 1,183 lines lands in exactly one output. Eleven dialogs, six of them opened from JavaScript rather than a button, serving what became five different tabs. A dialog inside a tab pane cannot appear while another tab is showing, so all eleven moved outside the panes. Checked first that none carried a name= attribute: the pane's twelve form fields are all radio groups inside the migration card, which stayed put. One save button, one status line and one operational warning serve all five tabs. Group-shared regions Shared controls cannot be copied into each pane, because that repeats element ids and the JavaScript module would bind to the wrong one, and cannot live in one pane, because an inactive pane is hidden and the other four tabs would lose the save button. They now sit outside the panes marked data-admin-group-shared="backup-recovery" and are revealed only while that group is active, synced from every path that activates a tab including Bootstrap's own shown.bs.tab event. syncAdminGroupSharedRegions resolves the owning group from either navigation. Reading only the top tab strip was a real bug: that strip is not rendered at all in the sidebar layout, so the save button would have been hidden permanently. Verified against a simulated DOM in both layouts. Verified field contract 462 names / 110 card ids, unchanged regression set 32 failures, identical to baseline jinja compile 46/46 admin templates xss sinks pass element ids all 1,608 ids in the composed template are unique modal placement every dialog reachable from its trigger Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- application/single_app/admin_settings_nav.py | 40 +- application/single_app/config.py | 2 +- .../static/js/admin/admin_sidebar_nav.js | 44 + .../templates/admin/_panes/backup.html | 323 ++++ .../templates/admin/_panes/cosmos-editor.html | 49 + .../admin/_panes/data-management.html | 1621 ----------------- .../templates/admin/_panes/jobs.html | 89 + .../templates/admin/_panes/migrate.html | 578 ++++++ .../templates/admin/_panes/restore.html | 147 ++ .../single_app/templates/admin_settings.html | 454 ++++- .../ADMIN_SETTINGS_IA_REWORK_STATUS.md | 39 +- docs/explanation/release_notes.md | 22 + ...est_admin_settings_group_shared_regions.py | 166 ++ .../test_data_management_security_patterns.py | 38 +- 14 files changed, 1966 insertions(+), 1646 deletions(-) create mode 100644 application/single_app/templates/admin/_panes/backup.html create mode 100644 application/single_app/templates/admin/_panes/cosmos-editor.html delete mode 100644 application/single_app/templates/admin/_panes/data-management.html create mode 100644 application/single_app/templates/admin/_panes/jobs.html create mode 100644 application/single_app/templates/admin/_panes/migrate.html create mode 100644 application/single_app/templates/admin/_panes/restore.html create mode 100644 functional_tests/test_admin_settings_group_shared_regions.py diff --git a/application/single_app/admin_settings_nav.py b/application/single_app/admin_settings_nav.py index 48026e3ea..742c57fd7 100644 --- a/application/single_app/admin_settings_nav.py +++ b/application/single_app/admin_settings_nav.py @@ -395,18 +395,50 @@ "icon": "bi-database", "tabs": [ { - "id": "data-management", - "label": "Backup, Migrate & Restore", - "icon": "bi-database-check", + # Schedule, storage and encryption are cards nested inside the + # backup card, so they stay with it. + "id": "backup", + "label": "Backup", + "icon": "bi-archive", "sections": [ {"id": "data-management-readiness-section", "label": "Start Here", "icon": "bi-compass"}, {"id": "data-management-backup-section", "label": "Backup", "icon": "bi-archive"}, {"id": "data-management-schedule-section", "label": "Schedule", "icon": "bi-calendar-event"}, {"id": "data-management-storage-section", "label": "Storage", "icon": "bi-hdd"}, {"id": "data-management-encryption-section", "label": "Encryption", "icon": "bi-key"}, + ], + }, + { + "id": "migrate", + "label": "Migrate", + "icon": "bi-arrow-left-right", + "sections": [ {"id": "data-management-migration-section", "label": "Migration", "icon": "bi-arrow-left-right"}, - {"id": "data-management-cosmos-editor-section", "label": "Cosmos Editor", "icon": "bi-database-exclamation"}, + ], + }, + { + "id": "restore", + "label": "Restore", + "icon": "bi-box-seam", + "sections": [ {"id": "data-management-backup-inventory-section", "label": "Backup Inventory & Restore", "icon": "bi-box-seam"}, + ], + }, + { + # A direct database editor. It is a repair tool that belongs + # with the backup and restore tooling it shares a module with. + "id": "cosmos-editor", + "label": "Cosmos Editor", + "icon": "bi-database-exclamation", + "sections": [ + {"id": "data-management-cosmos-editor-section", "label": "Cosmos Editor", "icon": "bi-database-exclamation"}, + ], + }, + { + "id": "jobs", + "label": "Jobs", + "icon": "bi-clock-history", + "sections": [ {"id": "data-management-jobs-section", "label": "Jobs", "icon": "bi-clock-history"}, ], }, diff --git a/application/single_app/config.py b/application/single_app/config.py index 27e50b825..4302f6372 100644 --- a/application/single_app/config.py +++ b/application/single_app/config.py @@ -96,7 +96,7 @@ EXECUTOR_TYPE = 'thread' EXECUTOR_MAX_WORKERS = 30 SESSION_TYPE = 'filesystem' -VERSION = "0.260.015" +VERSION = "0.260.016" IS_DEVELOPMENT = is_development_env_enabled() SESSION_COOKIE_SAMESITE = os.getenv('SESSION_COOKIE_SAMESITE', 'Lax') diff --git a/application/single_app/static/js/admin/admin_sidebar_nav.js b/application/single_app/static/js/admin/admin_sidebar_nav.js index 1bf0e5e53..b452447c9 100644 --- a/application/single_app/static/js/admin/admin_sidebar_nav.js +++ b/application/single_app/static/js/admin/admin_sidebar_nav.js @@ -157,7 +157,19 @@ function initAdminSidebarNav() { } } else { console.log('initAdminSidebarNav - Found existing active tab, preserving current state:', activeTab.getAttribute('data-tab')); + syncAdminGroupSharedRegions(activeTab.getAttribute('data-tab')); } + + // Clicking a tab button directly does not go through showAdminTab, so the + // shared regions are synced from Bootstrap's own event as well. + document.querySelectorAll('button.nav-link[data-bs-target^="#"]').forEach(button => { + button.addEventListener('shown.bs.tab', event => { + const target = event.target.getAttribute('data-bs-target'); + if (target) { + syncAdminGroupSharedRegions(target.slice(1)); + } + }); + }); } function setupAdminGroupToggles() { @@ -297,12 +309,43 @@ const LEGACY_TAB_REDIRECTS = { 'workspaces': 'workspace-types', 'search-extract': 'web-research', 'ai-models': 'model-endpoints', + 'data-management': 'backup', }; function resolveAdminTabId(tabId) { return LEGACY_TAB_REDIRECTS[tabId] || tabId; } +/** + * Some groups share one set of controls across all of their tabs, such as the + * single save button that serves every Backup & Recovery tab. Those controls + * cannot be duplicated into each pane without repeating element ids, and they + * cannot sit in one pane because the other tabs would lose them, so they live + * outside the panes and are revealed only while their group is active. + */ +function syncAdminGroupSharedRegions(tabId) { + const regions = document.querySelectorAll('[data-admin-group-shared]'); + if (!regions.length) { + return; + } + + // Only one of the two navigations is rendered at a time, so resolve the + // owning group from whichever is present. Looking only at the top tab strip + // would leave the region hidden for good in the sidebar layout. + const tabButton = document.querySelector(`.admin-tab-item[data-admin-group] button[data-bs-target="#${tabId}"]`); + let owner = tabButton ? tabButton.closest('[data-admin-group]') : null; + if (!owner) { + const sidebarLink = document.querySelector(`.admin-nav-tab[data-tab="${tabId}"]`); + owner = sidebarLink ? sidebarLink.closest('[data-admin-group]') : null; + } + const activeGroup = owner ? owner.getAttribute('data-admin-group') : null; + + regions.forEach(region => { + const ownerGroup = region.getAttribute('data-admin-group-shared'); + region.hidden = ownerGroup !== activeGroup; + }); +} + function showAdminTab(requestedTabId) { const tabId = resolveAdminTabId(requestedTabId); @@ -333,6 +376,7 @@ function showAdminTab(requestedTabId) { // Update the hash in URL for deep linking window.location.hash = tabId; + syncAdminGroupSharedRegions(tabId); if (typeof window.updateAdminSettingsSaveButtonState === 'function') { window.updateAdminSettingsSaveButtonState(); } diff --git a/application/single_app/templates/admin/_panes/backup.html b/application/single_app/templates/admin/_panes/backup.html new file mode 100644 index 000000000..a00542658 --- /dev/null +++ b/application/single_app/templates/admin/_panes/backup.html @@ -0,0 +1,323 @@ +
+
+
+
+

Start Here

+

Use these checkpoints before running backup, migration, restore, or advanced repair actions.

+
+ +
+
+
+
+
Back up
+

Configure dedicated storage, encryption, schedule, and backup scope before queueing jobs.

+ +
+
+
+
+
Migrate
+

Connect a destination, choose who moves, run preflight, then execute a recoverable transfer.

+ +
+
+
+
+
Restore
+

Review backup readiness and stage restore decisions from Backup Inventory.

+ +
+
+
+
+
RU Boost
+

Temporarily raise eligible Cosmos capacity during approved backup or migration windows.

+ +
+
+
+
+ +
+
+
+ +
+
+

Backup

+

Configure when backups run, where artifacts are stored, and how backup files are encrypted.

+
+
+ +
+
+
+
Schedule
+

Full backups run on the selected cadence; partial backups run daily only.

+
+
+
+ + +
+
+
+ + +
+
+ + +
Default is 03:00 UTC.
+
+
+ +
+ + + +
+ +
Automatic cleanup keeps the newest successful full backup as a safety baseline.
+
+
+
+
+
+ + +
+
+
+
+ + +
+
+
+
+ +
+
+
+ +
+
+
+ + +
Core application records required for meaningful restore and migration.
+
+
+
+
+ + +
Search index schemas and retrievable indexed documents.
+
+
+
+
+ + +
Original source files used by Enhanced Citations.
+
+
+
+
+
+
+
+ +
+
+
+
Storage
+

Store backup artifacts in Azure Blob Storage.

+
+ +
+
+ + Use a dedicated backup storage account. Data Management will reject storage that matches the Enhanced Citations connection string or Blob endpoint. +
+
+
+ + +
+
+ + +
+
+ + +
+
+
+
+ + +
No connection string saved yet.
+
+
+ + +
+
+
+ +
+
+
+
Encryption
+

Generate a 256-bit backup encryption key.

+
+ +
+
+ + +
+
+
Key storage
+
Not configured
+
Key reference
+
Not configured
+
+
+ +
+
Key Vault is strongly recommended
+
Generated backup encryption keys are stored in the Data Management settings document when Key Vault is not enabled.
+ Open Key Vault settings +
+
+
+ +
+
+
+
Cosmos Backup Performance
+

Backups stream deterministic checkpoint batches and commit only verified work. Higher concurrency can increase source Cosmos cost and pressure.

+
+ +
+ +
+
+
Source Blob Backup Performance
+

Source files stream through bounded chunks and durable per-file checkpoints. Peak transfer buffering is bounded by concurrent transfers multiplied by chunk size.

+
+
+
+ + +
+
+ + +
+
+ + +
+
+
Defaults bound application transfer buffering to approximately 32 MiB, excluding Azure SDK overhead. Throttling temporarily reduces active transfers.
+
+
+
+ + +
+
+ + +
+
+ + +
+
+
+ + +
+
+
+ + +
+
+
The backup records the current source capacity, raises only eligible targets up to 10,000 RU/s, and restores the original setting after completion, cancellation, failure, or recovery. This can increase Cosmos charges and requires source ARM throughput permission.
+
+
+
+ +
+
+
+
Backup Operations
+

Queue immediate full or partial backup jobs using the settings above.

+
+
+ + +
+
+

Jobs use Cosmos-backed leases so scaled-out App Service workers do not run the same backup twice.

+
+
+ + +
diff --git a/application/single_app/templates/admin/_panes/cosmos-editor.html b/application/single_app/templates/admin/_panes/cosmos-editor.html new file mode 100644 index 000000000..3639ba706 --- /dev/null +++ b/application/single_app/templates/admin/_panes/cosmos-editor.html @@ -0,0 +1,49 @@ +
+
+
+
+

Cosmos DB JSON Editor

+

Query SimpleChat Cosmos DB containers, inspect one document, and save JSON changes with ETag protection.

+
+ +
+ +
+ The Cosmos DB JSON editor is locked. Acknowledge the danger prompt before querying or editing data. +
+
+
+
+ + +
Choose a known SimpleChat Cosmos DB container.
+
+
+ + +
Max 100 per request.
+
+
+ + +
Empty query returns only the first 100 documents. Custom SELECT queries can page beyond 100 with Next Page.
+
+
+
+ + No query has run yet. +
+
+ Query results and the JSON editor open in a modal so the Data Management page stays compact. +
+
+
+
diff --git a/application/single_app/templates/admin/_panes/data-management.html b/application/single_app/templates/admin/_panes/data-management.html deleted file mode 100644 index d99c04990..000000000 --- a/application/single_app/templates/admin/_panes/data-management.html +++ /dev/null @@ -1,1621 +0,0 @@ -
-
-
-

Backup, Migrate & Restore

-

Protect SimpleChat data, move selected workspaces to another environment, and stage restore decisions with guided checks.

-
- -
- - - -
- -
-
-
-

Start Here

-

Use these checkpoints before running backup, migration, restore, or advanced repair actions.

-
- -
-
-
-
-
Back up
-

Configure dedicated storage, encryption, schedule, and backup scope before queueing jobs.

- -
-
-
-
-
Migrate
-

Connect a destination, choose who moves, run preflight, then execute a recoverable transfer.

- -
-
-
-
-
Restore
-

Review backup readiness and stage restore decisions from Backup Inventory.

- -
-
-
-
-
RU Boost
-

Temporarily raise eligible Cosmos capacity during approved backup or migration windows.

- -
-
-
-
- -
-
-
- -
-
-

Backup

-

Configure when backups run, where artifacts are stored, and how backup files are encrypted.

-
-
- -
-
-
-
Schedule
-

Full backups run on the selected cadence; partial backups run daily only.

-
-
-
- - -
-
-
- - -
-
- - -
Default is 03:00 UTC.
-
-
- -
- - - -
- -
Automatic cleanup keeps the newest successful full backup as a safety baseline.
-
-
-
-
-
- - -
-
-
-
- - -
-
-
-
- -
-
-
- -
-
-
- - -
Core application records required for meaningful restore and migration.
-
-
-
-
- - -
Search index schemas and retrievable indexed documents.
-
-
-
-
- - -
Original source files used by Enhanced Citations.
-
-
-
-
-
-
-
- -
-
-
-
Storage
-

Store backup artifacts in Azure Blob Storage.

-
- -
-
- - Use a dedicated backup storage account. Data Management will reject storage that matches the Enhanced Citations connection string or Blob endpoint. -
-
-
- - -
-
- - -
-
- - -
-
-
-
- - -
No connection string saved yet.
-
-
- - -
-
-
- -
-
-
-
Encryption
-

Generate a 256-bit backup encryption key.

-
- -
-
- - -
-
-
Key storage
-
Not configured
-
Key reference
-
Not configured
-
-
- -
-
Key Vault is strongly recommended
-
Generated backup encryption keys are stored in the Data Management settings document when Key Vault is not enabled.
- Open Key Vault settings -
-
-
- -
-
-
-
Cosmos Backup Performance
-

Backups stream deterministic checkpoint batches and commit only verified work. Higher concurrency can increase source Cosmos cost and pressure.

-
- -
- -
-
-
Source Blob Backup Performance
-

Source files stream through bounded chunks and durable per-file checkpoints. Peak transfer buffering is bounded by concurrent transfers multiplied by chunk size.

-
-
-
- - -
-
- - -
-
- - -
-
-
Defaults bound application transfer buffering to approximately 32 MiB, excluding Azure SDK overhead. Throttling temporarily reduces active transfers.
-
-
-
- - -
-
- - -
-
- - -
-
-
- - -
-
-
- - -
-
-
The backup records the current source capacity, raises only eligible targets up to 10,000 RU/s, and restores the original setting after completion, cancellation, failure, or recovery. This can increase Cosmos charges and requires source ARM throughput permission.
-
-
-
- -
-
-
-
Backup Operations
-

Queue immediate full or partial backup jobs using the settings above.

-
-
- - -
-
-

Jobs use Cosmos-backed leases so scaled-out App Service workers do not run the same backup twice.

-
-
- - -
-
-
-

- Migration -

-

Move SimpleChat data through a reviewed, recoverable environment transfer.

-
-
- - Not reviewed -
-
- -
- - - - - -
-
-
-
Connect the destination
-

Configure the services this migration will write to. Stored credentials remain redacted.

-
- Destination database: SimpleChat -
- -
-
-
-
-
Target Cosmos Database
-

Required for every migration.

-
- -
-
- Managed identity requires Cosmos DB Data Contributor and target network access. -
-
-
- - -
-
- - -
-
- - -
Fixed app contract.
-
-
-
- - -
-
- -
-
-
-
Target Search
-

Required when AI Search documents are included.

-
- -
-
-
- - -
-
- - -
-
- - -
-
-
- -
-
-
-
Target Enhanced Citation Storage
-

Required only when source document blobs are included.

-
- -
-
-
- - -
-
- - -
-
- - -
-
-
-
-
- - -
-
-
-
Choose who and what moves
-

Selections persist while you search and page. “All” always uses the exhaustive server count.

-
-
0 principal scopes selected
-
- -
- - - -
- -
- -
- Migration mode -
- - - -
-
- -
-
-
-
-
Available users
-

Search the server catalog.

-
-
- - - -
-
-
-
- - Page 1 - -
-
- -
- -
- -
- Loading exhaustive count… - Every current user record will be resolved by the server when the job starts. -
-
- -
- - -
-
- -
- -
- Migration mode -
- - - -
-
-
-
-
-
-
Available groups
-

Search the server catalog.

-
-
- - - -
-
-
-
- - Page 1 - -
-
- -
-
- -
- Loading exhaustive count… - Every current group record will be resolved by the server when the job starts. -
-
-
- - -
-
- -
- -
- Migration mode -
- - - -
-
-
-
-
-
-
Available public workspaces
-

Search the server catalog.

-
-
- - - -
-
-
-
- - Page 1 - -
-
- -
-
- -
- Loading exhaustive count… - Every current public workspace record will be resolved by the server when the job starts. -
-
-
- - -
-
-
- - -
-
-
-
Choose what happens at the destination
-

Choose whether to copy only missing items, catch up changes, or make migrated destination data match the source.

-
-
- -
- Destination behavior -
- - - - - - -
-

- Copies source items that are absent from the destination. Existing destination data is never updated or deleted. -

-
-
- - -
Leave blank to let SimpleChat choose the latest compatible completed migration as the starting point for this catch-up run.
-
-
-
- -
- Data surfaces -
-
-
- - -
-
- - -
SimpleChat pauses its own target indexing. Freeze other writers before review.
-
-
-
-
- - -
Requires Enhanced Citation storage at both source and destination.
-
-
-
-
- -
- Performance and resume -

Migration uses durable resource checkpoints and retains the same migration ID after Retry or Resume.

-
-
- - -
-
- - -
-
- - -
-
-
- - - -
-
-
- - -
-
- - -
-
- - -
-
- -
-
-
RU Boost validates Azure management-plane throughput permissions separately from Cosmos data-copy access. Eligible capacity is raised only up to 10,000 RU/s during execution and restored after completion or failure.
-
-
-
-
- - -
-
-
-
Prove the plan is ready
-

Preflight runs server-owned access probes and inventory. Any earlier change makes this review stale.

-
-
- - -
-
-
- -
- Review has not run. - Run preflight to verify target access, counts, collisions, locks, and capacity policy. -
-
-
-
- -
- - -
-
-
-
Confirm execution
-

Review the final server-normalized plan. Submission is guarded against duplicate requests.

-
-
-
-

Complete preflight review before confirmation.

-
- -
- - -
- -
- - -
-
-
-
Operate the migration
-

Progress comes from the durable job record. Cancel, Retry, and Resume retain verified checkpoints.

-
-
- - -
-
-
- -
- No migration is attached to this workflow yet. - After execution, this stage follows the queued job and exposes its recovery actions. -
-
-
-
-
-
-
-
- -
-
- - -
- Step 1 of 6 -
-
-
- -
-
-
-

Cosmos DB JSON Editor

-

Query SimpleChat Cosmos DB containers, inspect one document, and save JSON changes with ETag protection.

-
- -
- -
- The Cosmos DB JSON editor is locked. Acknowledge the danger prompt before querying or editing data. -
-
-
-
- - -
Choose a known SimpleChat Cosmos DB container.
-
-
- - -
Max 100 per request.
-
-
- - -
Empty query returns only the first 100 documents. Custom SELECT queries can page beyond 100 with Next Page.
-
-
-
- - No query has run yet. -
-
- Query results and the JSON editor open in a modal so the Data Management page stays compact. -
-
-
- -
-
-
-

Backup Inventory

-

Track completed full and partial backups created by Data Management jobs.

-
-
- - - -
-
-
-
-
What does Run Retention Cleanup do?
-

- It permanently deletes backups whose age exceeds the retention period configured in Data Management settings, - and removes their stored artifacts from the backup container. Backups newer than the retention cutoff are left alone. -

-
    -
  • Only backups in a finished state are eligible; running or queued jobs are skipped.
    • -
  • When Keep latest full backup is enabled, the most recent successful full backup is protected even if it is past the cutoff.
    • -
  • Each run deletes at most 25 backups, so very large cleanups may need several runs.
    • -
  • Cleanup also runs automatically on the configured schedule; this button just runs it now.
    • -
-

- Seeing “found no expired backups to delete” means every backup is still inside the retention window. That is expected, not an error. -

-
-
-
-
- -
-
- -
-
- -
-
-
-
- - -
-
- - -
-
- - -
-
- - -
-
- - -
-
-
- - - - - - - - - - - - - - - - - -
BackupCompletedContentsStorageProtectionWarningsActions
Backup inventory has not loaded yet.
-
- -
- - - -
-
-

Job History

- -
-
-
- - -
-
- - -
-
- - -
-
- - -
-
- - -
-
- - -
-
-
- - - - - - - - - - - - - - - - -
CreatedOperationStatusProgressMessageActions
Job history has not loaded yet.
-
- -
- - - - - - - - - - - - - - - - - - - - -
diff --git a/application/single_app/templates/admin/_panes/jobs.html b/application/single_app/templates/admin/_panes/jobs.html new file mode 100644 index 000000000..98c939eed --- /dev/null +++ b/application/single_app/templates/admin/_panes/jobs.html @@ -0,0 +1,89 @@ +
+
+
+

Job History

+ +
+
+
+ + +
+
+ + +
+
+ + +
+
+ + +
+
+ + +
+
+ + +
+
+
+ + + + + + + + + + + + + + + + +
CreatedOperationStatusProgressMessageActions
Job history has not loaded yet.
+
+ +
+
diff --git a/application/single_app/templates/admin/_panes/migrate.html b/application/single_app/templates/admin/_panes/migrate.html new file mode 100644 index 000000000..ad6290a15 --- /dev/null +++ b/application/single_app/templates/admin/_panes/migrate.html @@ -0,0 +1,578 @@ +
+
+
+
+

+ Migration +

+

Move SimpleChat data through a reviewed, recoverable environment transfer.

+
+
+ + Not reviewed +
+
+ +
+ + + + + +
+
+
+
Connect the destination
+

Configure the services this migration will write to. Stored credentials remain redacted.

+
+ Destination database: SimpleChat +
+ +
+
+
+
+
Target Cosmos Database
+

Required for every migration.

+
+ +
+
+ Managed identity requires Cosmos DB Data Contributor and target network access. +
+
+
+ + +
+
+ + +
+
+ + +
Fixed app contract.
+
+
+
+ + +
+
+ +
+
+
+
Target Search
+

Required when AI Search documents are included.

+
+ +
+
+
+ + +
+
+ + +
+
+ + +
+
+
+ +
+
+
+
Target Enhanced Citation Storage
+

Required only when source document blobs are included.

+
+ +
+
+
+ + +
+
+ + +
+
+ + +
+
+
+
+
+ + +
+
+
+
Choose who and what moves
+

Selections persist while you search and page. “All” always uses the exhaustive server count.

+
+
0 principal scopes selected
+
+ +
+ + + +
+ +
+ +
+ Migration mode +
+ + + +
+
+ +
+
+
+
+
Available users
+

Search the server catalog.

+
+
+ + + +
+
+
+
+ + Page 1 + +
+
+ +
+ +
+ +
+ Loading exhaustive count… + Every current user record will be resolved by the server when the job starts. +
+
+ +
+ + +
+
+ +
+ +
+ Migration mode +
+ + + +
+
+
+
+
+
+
Available groups
+

Search the server catalog.

+
+
+ + + +
+
+
+
+ + Page 1 + +
+
+ +
+
+ +
+ Loading exhaustive count… + Every current group record will be resolved by the server when the job starts. +
+
+
+ + +
+
+ +
+ +
+ Migration mode +
+ + + +
+
+
+
+
+
+
Available public workspaces
+

Search the server catalog.

+
+
+ + + +
+
+
+
+ + Page 1 + +
+
+ +
+
+ +
+ Loading exhaustive count… + Every current public workspace record will be resolved by the server when the job starts. +
+
+
+ + +
+
+
+ + +
+
+
+
Choose what happens at the destination
+

Choose whether to copy only missing items, catch up changes, or make migrated destination data match the source.

+
+
+ +
+ Destination behavior +
+ + + + + + +
+

+ Copies source items that are absent from the destination. Existing destination data is never updated or deleted. +

+
+
+ + +
Leave blank to let SimpleChat choose the latest compatible completed migration as the starting point for this catch-up run.
+
+
+
+ +
+ Data surfaces +
+
+
+ + +
+
+ + +
SimpleChat pauses its own target indexing. Freeze other writers before review.
+
+
+
+
+ + +
Requires Enhanced Citation storage at both source and destination.
+
+
+
+
+ +
+ Performance and resume +

Migration uses durable resource checkpoints and retains the same migration ID after Retry or Resume.

+
+
+ + +
+
+ + +
+
+ + +
+
+
+ + + +
+
+
+ + +
+
+ + +
+
+ + +
+
+ +
+
+
RU Boost validates Azure management-plane throughput permissions separately from Cosmos data-copy access. Eligible capacity is raised only up to 10,000 RU/s during execution and restored after completion or failure.
+
+
+
+
+ + +
+
+
+
Prove the plan is ready
+

Preflight runs server-owned access probes and inventory. Any earlier change makes this review stale.

+
+
+ + +
+
+
+ +
+ Review has not run. + Run preflight to verify target access, counts, collisions, locks, and capacity policy. +
+
+
+
+ +
+ + +
+
+
+
Confirm execution
+

Review the final server-normalized plan. Submission is guarded against duplicate requests.

+
+
+
+

Complete preflight review before confirmation.

+
+ +
+ + +
+ +
+ + +
+
+
+
Operate the migration
+

Progress comes from the durable job record. Cancel, Retry, and Resume retain verified checkpoints.

+
+
+ + +
+
+
+ +
+ No migration is attached to this workflow yet. + After execution, this stage follows the queued job and exposes its recovery actions. +
+
+
+
+
+
+
+
+ +
+
+ + +
+ Step 1 of 6 +
+
+
+
diff --git a/application/single_app/templates/admin/_panes/restore.html b/application/single_app/templates/admin/_panes/restore.html new file mode 100644 index 000000000..6b8e1ff5a --- /dev/null +++ b/application/single_app/templates/admin/_panes/restore.html @@ -0,0 +1,147 @@ +
+
+
+
+

Backup Inventory

+

Track completed full and partial backups created by Data Management jobs.

+
+
+ + + +
+
+
+
+
What does Run Retention Cleanup do?
+

+ It permanently deletes backups whose age exceeds the retention period configured in Data Management settings, + and removes their stored artifacts from the backup container. Backups newer than the retention cutoff are left alone. +

+
    +
  • Only backups in a finished state are eligible; running or queued jobs are skipped.
    • +
  • When Keep latest full backup is enabled, the most recent successful full backup is protected even if it is past the cutoff.
    • +
  • Each run deletes at most 25 backups, so very large cleanups may need several runs.
    • +
  • Cleanup also runs automatically on the configured schedule; this button just runs it now.
    • +
+

+ Seeing “found no expired backups to delete” means every backup is still inside the retention window. That is expected, not an error. +

+
+
+
+
+ +
+
+ +
+
+ +
+
+
+
+ + +
+
+ + +
+
+ + +
+
+ + +
+
+ + +
+
+
+ + + + + + + + + + + + + + + + + +
BackupCompletedContentsStorageProtectionWarningsActions
Backup inventory has not loaded yet.
+
+ +
+
diff --git a/application/single_app/templates/admin_settings.html b/application/single_app/templates/admin_settings.html index a34e450cf..203d8a87b 100644 --- a/application/single_app/templates/admin_settings.html +++ b/application/single_app/templates/admin_settings.html @@ -983,6 +983,27 @@

12. Enhanced Citations and Image Generation

{# Governance status is rendered outside the panes so a message stays visible whichever governance tab is active. #} + {# Shared by every Backup & Recovery tab: one save button, one status + line and one operational warning serve all five tabs, so they sit + outside the panes and are shown only while that group is active. #} + +
{% include "admin/_panes/secrets.html" %} {% include "admin/_panes/access-roles.html" %} @@ -1016,7 +1037,11 @@

12. Enhanced Citations and Image Generation

{% include "admin/_panes/control-center-config.html" %} - {% include "admin/_panes/data-management.html" %} + {% include "admin/_panes/backup.html" %} + {% include "admin/_panes/migrate.html" %} + {% include "admin/_panes/restore.html" %} + {% include "admin/_panes/cosmos-editor.html" %} + {% include "admin/_panes/jobs.html" %} {% include "admin/_panes/redis-caching.html" %} {% include "admin/_panes/cosmos.html" %} @@ -1173,6 +1198,433 @@
Recommended setup
+ + + + + + + + + + + + + + + + + + + + + + +