feat: json export and sqlite backup endpoints

server/src/app.ts

@@ -17,6 +17,7 @@ import { registerLibraryRoutes } from './routes/libraryRoutes.js'
 import { registerStreamRoutes } from './routes/streamRoutes.js'
 import { registerLoanRoutes } from './routes/loanRoutes.js'
 import { registerStatsRoutes } from './routes/statsRoutes.js'
+import { registerDataRoutes } from './routes/dataRoutes.js'
 
 declare module 'fastify' {
   interface FastifyInstance {
@@ -58,6 +59,7 @@ export async function buildApp(opts: AppOptions): Promise<FastifyInstance> {
   await registerStreamRoutes(app)
   await registerLoanRoutes(app)
   await registerStatsRoutes(app)
+  await registerDataRoutes(app)
 
   // artwork cache (always available)
   await app.register(fastifyStatic, {

server/src/routes/dataRoutes.ts

@@ -0,0 +1,71 @@
+import { FastifyInstance } from 'fastify'
+import { existsSync, readdirSync, statSync, unlinkSync } from 'node:fs'
+import path from 'node:path'
+import { requireAuth, requireAdmin } from './authRoutes.js'
+
+function matchLinksFor(db: any, userId: number) {
+  return db
+    .prepare(
+      `SELECT ml.item_id AS itemId, ml.album_id AS albumId FROM match_links ml WHERE ml.user_id = ?`
+    )
+    .all(userId)
+}
+
+function listBackups(dir: string): { file: string; sizeBytes: number; createdAt: string }[] {
+  try {
+    return readdirSync(dir)
+      .filter((f) => f.endsWith('.db'))
+      .map((file) => {
+        const full = path.join(dir, file)
+        const st = statSync(full)
+        return { file, sizeBytes: st.size, createdAt: st.mtime.toISOString() }
+      })
+      .sort((a, b) => b.createdAt.localeCompare(a.createdAt))
+  } catch {
+    return []
+  }
+}
+
+export async function registerDataRoutes(app: FastifyInstance): Promise<void> {
+  app.get('/api/export', { preHandler: [requireAuth] }, async (request) => {
+    const db = request.server.db
+    const userId = request.user!.id
+    const items = db
+      .prepare('SELECT * FROM collection_items WHERE user_id = ? ORDER BY date_added')
+      .all(userId)
+    const loans = db.prepare('SELECT * FROM loans WHERE user_id = ?').all(userId)
+    return {
+      exportedAt: new Date().toISOString(),
+      items,
+      loans,
+      matchLinks: matchLinksFor(db, userId),
+    }
+  })
+
+  app.post('/api/backup', { preHandler: [requireAuth, requireAdmin] }, async (request, reply) => {
+    const config = request.server.config
+    const stamp = new Date().toISOString().replace(/[:T]/g, '-').slice(0, 19)
+    // second-granularity stamp: make the destination unique for rapid successive backups
+    let dest = path.join(config.backupsDir, `record-shop-${stamp}.db`)
+    let suffix = 1
+    while (existsSync(dest)) {
+      dest = path.join(config.backupsDir, `record-shop-${stamp}-${suffix}.db`)
+      suffix += 1
+    }
+    await request.server.db.backup(dest)
+    // prune to newest 7
+    const backups = listBackups(config.backupsDir)
+    for (const old of backups.slice(7)) {
+      try {
+        unlinkSync(path.join(config.backupsDir, old.file))
+      } catch {
+        // best-effort prune
+      }
+    }
+    return { file: path.basename(dest) }
+  })
+
+  app.get('/api/backups', { preHandler: [requireAuth, requireAdmin] }, async (request) => {
+    return { backups: listBackups(request.server.config.backupsDir) }
+  })
+}