feat: Admin Area System: Database Backup/Restore and Danger Zone 1.00

backend/src/modules/admin/system/admin-system.controller.ts

@@ -108,13 +108,20 @@ export class AdminSystemController {
         400,
       );
     }
+    if (!body.stagingId) {
+      throw new ApiError(
+        ERROR_CODES.SYSTEM_RESTORE_STAGE_EXPIRED,
+        'Restore stage missing or expired',
+        400,
+      );
+    }
     await this.tokens.consume({
       userId,
       operation: 'restore-backup',
       token: body.token,
       stagingId: body.stagingId,
     });
-    const result = await this.restore.commitRestore(body.stagingId ?? '');
+    const result = await this.restore.commitRestore(body.stagingId);
     void result;
     await this.auth.revokeAllRefreshSessions(userId);
     return { ok: true, operation: 'restore-backup' };

backend/src/modules/admin/system/dto/admin-system.dto.ts

@@ -20,7 +20,11 @@ export const AdminDangerConfirmBodySchema = z.object({
   token: z.string().min(1).max(512),
 });
 
-export const AdminRestoreCommitBodySchema = AdminDangerConfirmBodySchema;
+export const AdminRestoreCommitBodySchema = z.object({
+  operation: z.enum(ADMIN_OPERATION_KINDS),
+  token: z.string().min(1).max(512),
+  stagingId: z.string().min(1).max(128).optional(),
+});
 
 export const AdminRestoreValidateResponseSchema = z.object({
   stagingId: z.string(),