From ce2f59c3322ca25d10a9d666c21a714033e9e270 Mon Sep 17 00:00:00 2001
From: prosolis <5590409+prosolis@users.noreply.github.com>
Date: Fri, 15 May 2026 07:50:11 -0700
Subject: [PATCH] Phase C1: gate db.Backup() on GOGOBEE_BACKUP_DIR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Audit flagged C1 as "Backup() unwired" — actually
adventure_scheduler's dailyReset has been calling it every
midnight. The real gap was that Backup() always ran, always
to dataPath/backups, with no way for dev environments to opt
out.

Now: env var unset → no-op + debug log. Env var set → that
directory is the destination. Existing scheduler call site
unchanged; it cleanly no-ops in dev.
---
 internal/db/db.go | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/internal/db/db.go b/internal/db/db.go
index b2196e7..8b29e68 100644
--- a/internal/db/db.go
+++ b/internal/db/db.go
@@ -463,8 +463,16 @@ func CacheSet(key, data string) {
 
 // Backup creates a consistent snapshot of the database using VACUUM INTO.
 // Keeps the last 7 daily backups, deleting older ones.
+//
+// Gated on the GOGOBEE_BACKUP_DIR env var: when unset, this is a no-op so
+// dev environments don't accumulate snapshots. When set, that directory is
+// used as the backup destination.
 func Backup() error {
-	backupDir := filepath.Join(dataPath, "backups")
+	backupDir := os.Getenv("GOGOBEE_BACKUP_DIR")
+	if backupDir == "" {
+		slog.Debug("backup skipped: GOGOBEE_BACKUP_DIR unset")
+		return nil
+	}
 	if err := os.MkdirAll(backupDir, 0o755); err != nil {
 		return fmt.Errorf("create backup dir: %w", err)
 	}