BZOD v0.5.0 RC2: multi-user platform, dashboards, analytics, backups and validation

src/cli/backup_user.rs

@@ -0,0 +1,150 @@
+use crate::config::Config;
+use crate::db::Db;
+use chrono::Utc;
+use std::fs::File;
+use std::path::{Path, PathBuf};
+use tar::{Builder, Header};
+use tracing::{error, info};
+use zstd::Encoder;
+
+#[derive(serde::Serialize, serde::Deserialize)]
+struct UserBackupMetadata {
+    id: i64,
+    username: String,
+    password_hash: String,
+    status: String,
+    created_at: String,
+    account_type: String,
+    metadata: Option<String>,
+    quotas: UserBackupQuotas,
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+struct UserBackupQuotas {
+    max_urls: i64,
+    max_landings: i64,
+    max_api_tokens: i64,
+    max_storage_mb: i64,
+}
+
+pub async fn run(
+    username: String,
+    out: Option<String>,
+    data_dir: Option<String>,
+    mut config: Config,
+) -> Result<(), Box<dyn std::error::Error>> {
+    if let Some(d) = data_dir {
+        config.data_dir = PathBuf::from(d);
+    }
+    let db = Db::init(&config)?;
+
+    let username_clean = username.trim().to_lowercase();
+
+    // 1. Get user details from users.db
+    let user_details = {
+        let conn = db.users.lock().unwrap();
+        crate::db::users::get_user_by_username(&conn, &username_clean)?
+    };
+
+    let user = match user_details {
+        Some(u) => u,
+        None => {
+            error!("User '{}' not found", username_clean);
+            return Ok(());
+        }
+    };
+
+    let user_id = user.id;
+
+    // 2. Fetch user's quotas
+    let quotas = {
+        let conn = db.users.lock().unwrap();
+        conn.query_row(
+            "SELECT max_urls, max_landings, max_api_tokens, max_storage_mb FROM quotas WHERE user_id = ?1;",
+            [user_id],
+            |row| {
+                Ok(UserBackupQuotas {
+                    max_urls: row.get(0)?,
+                    max_landings: row.get(1)?,
+                    max_api_tokens: row.get(2)?,
+                    max_storage_mb: row.get(3)?,
+                })
+            }
+        )?
+    };
+
+    // 3. Define output path
+    let tar_path = match out {
+        Some(p) => PathBuf::from(p),
+        None => {
+            if !config.backup_dir.exists() {
+                std::fs::create_dir_all(&config.backup_dir)?;
+            }
+            config.backup_dir.join(format!(
+                "{}-{}.tar.zst",
+                username_clean,
+                Utc::now().format("%Y%m%d")
+            ))
+        }
+    };
+
+    info!(
+        "Backing up user {} (ID: {}) to {:?}",
+        username_clean, user_id, tar_path
+    );
+
+    // 4. Force checkpoint on user's databases
+    let user_dir = config.data_dir.join("users").join(user_id.to_string());
+    if let Ok(c) = rusqlite::Connection::open(user_dir.join("content.db")) {
+        let _ = c.execute("PRAGMA wal_checkpoint(TRUNCATE);", []);
+    }
+    if let Ok(c) = rusqlite::Connection::open(user_dir.join("analytics.db")) {
+        let _ = c.execute("PRAGMA wal_checkpoint(TRUNCATE);", []);
+    }
+    if let Ok(c) = rusqlite::Connection::open(user_dir.join("profile.db")) {
+        let _ = c.execute("PRAGMA wal_checkpoint(TRUNCATE);", []);
+    }
+
+    // 5. Create tar.zst archive
+    let file = File::create(&tar_path)?;
+    let zst_enc = Encoder::new(file, 3)?;
+    let mut tar = Builder::new(zst_enc);
+
+    // Write metadata.json directly into tar
+    let metadata_obj = UserBackupMetadata {
+        id: user.id,
+        username: user.username,
+        password_hash: user.password_hash,
+        status: user.status,
+        created_at: user.created_at,
+        account_type: user.account_type,
+        metadata: user.metadata,
+        quotas,
+    };
+    let metadata_bytes = serde_json::to_vec_pretty(&metadata_obj)?;
+    let mut header = Header::new_gnu();
+    header.set_size(metadata_bytes.len() as u64);
+    header.set_path("metadata.json")?;
+    header.set_mode(0o644);
+    header.set_cksum();
+    tar.append(&header, &metadata_bytes[..])?;
+
+    // Append database files
+    let mut append_file =
+        |name_in_archive: &str, path_on_disk: &Path| -> Result<(), Box<dyn std::error::Error>> {
+            if path_on_disk.exists() {
+                let mut file = File::open(path_on_disk)?;
+                tar.append_file(name_in_archive, &mut file)?;
+            }
+            Ok(())
+        };
+
+    append_file("content.db", &user_dir.join("content.db"))?;
+    append_file("analytics.db", &user_dir.join("analytics.db"))?;
+    append_file("profile.db", &user_dir.join("profile.db"))?;
+
+    tar.into_inner()?.finish()?;
+
+    info!("User backup generated successfully at {:?}", tar_path);
+    Ok(())
+}

src/cli/create_admin.rs

@@ -32,8 +32,9 @@ pub async fn run(
     }
 
     let hash = hash_password(&password).map_err(|e| e.to_string())?;
-    let conn = db.admin.lock().unwrap();
-    let u = crate::db::admin::create_user(&conn, &final_username, &hash)?;
+    let conn = db.users.lock().unwrap();
+    let u = crate::db::users::create_admin_user(&conn, &final_username, &hash)?;
+    db.init_user_databases(u.id)?;
     info!(
         "Successfully created admin user: {} (ID: {})",
         u.username, u.id

src/cli/create_user.rs

@@ -0,0 +1,86 @@
+use crate::auth::hash_password;
+use crate::config::Config;
+use crate::db::Db;
+use std::io::{self, Write};
+use std::path::PathBuf;
+use tracing::{error, info};
+
+pub async fn run(
+    username: Option<String>,
+    password: Option<String>,
+    data_dir: Option<String>,
+    mut config: Config,
+) -> Result<(), Box<dyn std::error::Error>> {
+    if let Some(d) = data_dir {
+        config.data_dir = PathBuf::from(d);
+    }
+    let db = Db::init(&config)?;
+
+    let final_username = match username {
+        Some(u) => u,
+        None => read_input("Enter username: "),
+    };
+
+    let username_clean = final_username.trim().to_lowercase();
+    if username_clean.is_empty() {
+        error!("Username cannot be empty");
+        return Ok(());
+    }
+
+    if username_clean.len() < 3 {
+        error!("Username must be at least 3 characters");
+        return Ok(());
+    }
+
+    if !username_clean
+        .chars()
+        .all(|c| c.is_alphanumeric() || c == '-' || c == '_')
+    {
+        error!("Username must contain only alphanumeric characters, hyphens, or underscores");
+        return Ok(());
+    }
+
+    let final_password = match password {
+        Some(p) => p,
+        None => read_input("Enter password: "),
+    };
+    if final_password.trim().is_empty() {
+        error!("Password cannot be empty");
+        return Ok(());
+    }
+
+    let hash = hash_password(&final_password).map_err(|e| e.to_string())?;
+
+    // Check if user already exists
+    {
+        let conn = db.users.lock().unwrap();
+        if crate::db::users::get_user_by_username(&conn, &username_clean)?.is_some() {
+            error!("User already exists: {}", username_clean);
+            return Ok(());
+        }
+    }
+
+    // Create user in DB (this seeds default quotas too)
+    let new_user = {
+        let conn = db.users.lock().unwrap();
+        crate::db::users::create_user(&conn, &username_clean, &hash, "standard", None)?
+    };
+
+    // Initialize their user specific directory and DB files (content.db, analytics.db, profile.db)
+    db.init_user_databases(new_user.id)?;
+
+    info!(
+        "Successfully created standard user: {} (ID: {})",
+        new_user.username, new_user.id
+    );
+
+    Ok(())
+}
+
+fn read_input(prompt: &str) -> String {
+    print!("{}", prompt);
+    let _ = io::stdout().flush();
+    let mut input = String::new();
+    let _ = io::stdin().read_line(&mut input);
+    input.trim().to_string()
+}

src/cli/delete_user.rs

@@ -0,0 +1,92 @@
+use crate::config::Config;
+use crate::db::Db;
+use chrono::Utc;
+use std::path::PathBuf;
+use tracing::{error, info};
+
+pub async fn run(
+    user_id: i64,
+    force: bool,
+    data_dir: Option<String>,
+    mut config: Config,
+) -> Result<(), Box<dyn std::error::Error>> {
+    if let Some(d) = data_dir {
+        config.data_dir = PathBuf::from(d);
+    }
+    let db = Db::init(&config)?;
+
+    if user_id == 1 && !force {
+        error!("Deleting legacy_admin system account requires --force flag");
+        return Ok(());
+    }
+
+    // Capture user details
+    let user_details = {
+        let conn = db.users.lock().unwrap();
+        match crate::db::users::get_user_by_id(&conn, user_id)? {
+            Some(u) => u,
+            None => {
+                error!("User ID {} not found", user_id);
+                return Ok(());
+            }
+        }
+    };
+
+    // 1. Transactional clean up on system.db (deleting their global slug mappings)
+    {
+        let mut system_conn = db.system.lock().unwrap();
+        let tx = system_conn.transaction()?;
+
+        // Get all slugs owned by the user
+        let slugs: Vec<String> = {
+            let mut stmt = tx.prepare("SELECT slug FROM global_slugs WHERE owner_user_id = ?1;")?;
+            let rows = stmt.query_map([user_id], |row| row.get(0))?;
+            rows.filter_map(|r| r.ok()).collect()
+        };
+
+        // Delete from global_slugs and write to history
+        let now = Utc::now().to_rfc3339();
+        for slug in slugs {
+            let _ = tx.execute("DELETE FROM global_slugs WHERE slug = ?1;", [&slug]);
+            let _ = tx.execute(
+                "INSERT INTO slug_history (slug, old_owner_user_id, new_owner_user_id, action, timestamp, admin_username)
+                 VALUES (?1, ?2, NULL, 'deleted', ?3, ?4);",
+                rusqlite::params![slug, user_id, now, "cli"],
+            );
+        }
+
+        tx.commit()?;
+    }
+
+    // 2. Delete user folder and database files from disk
+    let user_dir = config.data_dir.join("users").join(user_id.to_string());
+    if user_dir.exists() {
+        let _ = std::fs::remove_dir_all(&user_dir);
+    }
+
+    // 3. Remove user entry from users.db (cascading deletes quotas/sessions/tokens)
+    {
+        let conn = db.users.lock().unwrap();
+        crate::db::users::delete_user(&conn, user_id)?;
+    }
+
+    // Write audit event
+    {
+        let system_conn = db.system.lock().unwrap();
+        let _ = crate::db::audit_events::write_audit_event(
+            &system_conn,
+            "cli",
+            "USER_DELETION",
+            "user",
+            &user_id.to_string(),
+            Some(&format!("Username: {}", user_details.username)),
+        );
+    }
+
+    info!(
+        "Successfully deleted user {} (ID: {}) and all associated content",
+        user_details.username, user_id
+    );
+
+    Ok(())
+}

src/cli/disable_user.rs

@@ -0,0 +1,55 @@
+use crate::config::Config;
+use crate::db::Db;
+use std::path::PathBuf;
+use tracing::{error, info};
+
+pub async fn run(
+    user_id: i64,
+    data_dir: Option<String>,
+    mut config: Config,
+) -> Result<(), Box<dyn std::error::Error>> {
+    if let Some(d) = data_dir {
+        config.data_dir = PathBuf::from(d);
+    }
+    let db = Db::init(&config)?;
+
+    // Check user exists
+    let user = {
+        let conn = db.users.lock().unwrap();
+        crate::db::users::get_user_by_id(&conn, user_id)?
+    };
+
+    let user = match user {
+        Some(u) => u,
+        None => {
+            error!("User ID {} not found", user_id);
+            return Ok(());
+        }
+    };
+
+    if user.status == "disabled" {
+        info!("User {} is already disabled", user.username);
+        return Ok(());
+    }
+
+    {
+        let conn = db.users.lock().unwrap();
+        crate::db::users::update_user_status(&conn, user_id, "disabled")?;
+    }
+
+    // Write audit event
+    {
+        let system_conn = db.system.lock().unwrap();
+        let _ = crate::db::audit_events::write_audit_event(
+            &system_conn,
+            "cli",
+            "USER_DISABLED",
+            "user",
+            &user_id.to_string(),
+            Some(&format!("Username: {}", user.username)),
+        );
+    }
+
+    info!("User {} (ID: {}) has been disabled", user.username, user_id);
+    Ok(())
+}

src/cli/enable_user.rs

@@ -0,0 +1,58 @@
+use crate::config::Config;
+use crate::db::Db;
+use std::path::PathBuf;
+use tracing::{error, info};
+
+pub async fn run(
+    user_id: i64,
+    data_dir: Option<String>,
+    mut config: Config,
+) -> Result<(), Box<dyn std::error::Error>> {
+    if let Some(d) = data_dir {
+        config.data_dir = PathBuf::from(d);
+    }
+    let db = Db::init(&config)?;
+
+    // Check user exists
+    let user = {
+        let conn = db.users.lock().unwrap();
+        crate::db::users::get_user_by_id(&conn, user_id)?
+    };
+
+    let user = match user {
+        Some(u) => u,
+        None => {
+            error!("User ID {} not found", user_id);
+            return Ok(());
+        }
+    };
+
+    if user.status == "active" {
+        info!("User {} is already active", user.username);
+        return Ok(());
+    }
+
+    {
+        let conn = db.users.lock().unwrap();
+        crate::db::users::update_user_status(&conn, user_id, "active")?;
+    }
+
+    // Write audit event
+    {
+        let system_conn = db.system.lock().unwrap();
+        let _ = crate::db::audit_events::write_audit_event(
+            &system_conn,
+            "cli",
+            "USER_ENABLED",
+            "user",
+            &user_id.to_string(),
+            Some(&format!("Username: {}", user.username)),
+        );
+    }
+
+    info!(
+        "User {} (ID: {}) has been enabled (active)",
+        user.username, user_id
+    );
+    Ok(())
+}

src/cli/list_users.rs

@@ -0,0 +1,36 @@
+use crate::config::Config;
+use crate::db::Db;
+use std::path::PathBuf;
+
+pub async fn run(
+    data_dir: Option<String>,
+    mut config: Config,
+) -> Result<(), Box<dyn std::error::Error>> {
+    if let Some(d) = data_dir {
+        config.data_dir = PathBuf::from(d);
+    }
+    let db = Db::init(&config)?;
+
+    let users = {
+        let conn = db.users.lock().unwrap();
+        crate::db::users::list_users(&conn)?
+    };
+
+    println!(
+        "{:<6} | {:<20} | {:<10} | {:<12} | {:<24}",
+        "ID", "Username", "Status", "Type", "Created At"
+    );
+    println!(
+        "{:-<6}-+-{:-<20}-+-{:-<10}-+-{:-<12}-+-{:-<24}",
+        "", "", "", "", ""
+    );
+
+    for u in users {
+        println!(
+            "{:<6} | {:<20} | {:<10} | {:<12} | {:<24}",
+            u.id, u.username, u.status, u.account_type, u.created_at
+        );
+    }
+
+    Ok(())
+}

src/cli/mod.rs

@@ -11,6 +11,15 @@ pub mod shorten;
 pub mod stats;
 pub mod validate;
 
+pub mod backup_user;
+pub mod create_user;
+pub mod delete_user;
+pub mod disable_user;
+pub mod enable_user;
+pub mod list_users;
+pub mod reset_password;
+pub mod restore_user;
+
 #[derive(Parser)]
 #[command(name = "bzod")]
 #[command(about = "BZOD - Personal Redirector & Landing Page Platform")]
@@ -91,4 +100,69 @@ pub enum Commands {
         #[arg(long)]
         data_dir: Option<String>,
     },
+    /// Create a new standard user in the database
+    CreateUser {
+        #[arg(long)]
+        username: Option<String>,
+        #[arg(long)]
+        password: Option<String>,
+        #[arg(long)]
+        data_dir: Option<String>,
+    },
+    /// Delete a standard user and all their databases/slugs
+    DeleteUser {
+        /// User ID to delete
+        user_id: i64,
+        /// Force deletion of system account/legacy_admin
+        #[arg(long)]
+        force: bool,
+        #[arg(long)]
+        data_dir: Option<String>,
+    },
+    /// Disable a standard user
+    DisableUser {
+        /// User ID to disable
+        user_id: i64,
+        #[arg(long)]
+        data_dir: Option<String>,
+    },
+    /// Enable a standard user
+    EnableUser {
+        /// User ID to enable
+        user_id: i64,
+        #[arg(long)]
+        data_dir: Option<String>,
+    },
+    /// Reset standard user's password
+    ResetPassword {
+        /// User ID to reset
+        user_id: i64,
+        #[arg(long)]
+        password: Option<String>,
+        #[arg(long)]
+        data_dir: Option<String>,
+    },
+    /// List all standard/system users
+    ListUsers {
+        #[arg(long)]
+        data_dir: Option<String>,
+    },
+    /// Backup a standard user's databases to a .tar.zst package
+    BackupUser {
+        /// Username to backup
+        username: String,
+        /// Output .tar.zst filepath
+        #[arg(long)]
+        out: Option<String>,
+        #[arg(long)]
+        data_dir: Option<String>,
+    },
+    /// Restore a standard user's databases from a .tar.zst package
+    RestoreUser {
+        /// Input .tar.zst package path
+        #[arg(long, required = true)]
+        file: String,
+        #[arg(long)]
+        data_dir: Option<String>,
+    },
 }

src/cli/reset_password.rs

@@ -0,0 +1,75 @@
+use crate::auth::hash_password;
+use crate::config::Config;
+use crate::db::Db;
+use std::io::{self, Write};
+use std::path::PathBuf;
+use tracing::{error, info};
+
+pub async fn run(
+    user_id: i64,
+    password: Option<String>,
+    data_dir: Option<String>,
+    mut config: Config,
+) -> Result<(), Box<dyn std::error::Error>> {
+    if let Some(d) = data_dir {
+        config.data_dir = PathBuf::from(d);
+    }
+    let db = Db::init(&config)?;
+
+    // Check user exists
+    let user = {
+        let conn = db.users.lock().unwrap();
+        crate::db::users::get_user_by_id(&conn, user_id)?
+    };
+
+    let user = match user {
+        Some(u) => u,
+        None => {
+            error!("User ID {} not found", user_id);
+            return Ok(());
+        }
+    };
+
+    let final_password = match password {
+        Some(p) => p,
+        None => read_input("Enter new password: "),
+    };
+    if final_password.trim().is_empty() {
+        error!("Password cannot be empty");
+        return Ok(());
+    }
+
+    let hash = hash_password(&final_password).map_err(|e| e.to_string())?;
+
+    {
+        let conn = db.users.lock().unwrap();
+        crate::db::users::reset_user_password(&conn, user_id, &hash)?;
+    }
+
+    // Write audit event
+    {
+        let system_conn = db.system.lock().unwrap();
+        let _ = crate::db::audit_events::write_audit_event(
+            &system_conn,
+            "cli",
+            "USER_PASSWORD_RESET",
+            "user",
+            &user_id.to_string(),
+            Some(&format!("Username: {}", user.username)),
+        );
+    }
+
+    info!(
+        "Password for user {} (ID: {}) has been reset successfully",
+        user.username, user_id
+    );
+    Ok(())
+}
+
+fn read_input(prompt: &str) -> String {
+    print!("{}", prompt);
+    let _ = io::stdout().flush();
+    let mut input = String::new();
+    let _ = io::stdin().read_line(&mut input);
+    input.trim().to_string()
+}

src/cli/restore_user.rs

@@ -0,0 +1,269 @@
+use crate::config::Config;
+use crate::db::Db;
+use chrono::Utc;
+use rusqlite::OptionalExtension;
+use std::fs::File;
+use std::path::PathBuf;
+use tar::Archive;
+use tracing::{error, info};
+use zstd::Decoder;
+
+#[derive(serde::Serialize, serde::Deserialize)]
+struct UserBackupMetadata {
+    id: i64,
+    username: String,
+    password_hash: String,
+    status: String,
+    created_at: String,
+    account_type: String,
+    metadata: Option<String>,
+    quotas: UserBackupQuotas,
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+struct UserBackupQuotas {
+    max_urls: i64,
+    max_landings: i64,
+    max_api_tokens: i64,
+    max_storage_mb: i64,
+}
+
+pub async fn run(
+    file: String,
+    data_dir: Option<String>,
+    mut config: Config,
+) -> Result<(), Box<dyn std::error::Error>> {
+    if let Some(d) = data_dir {
+        config.data_dir = PathBuf::from(d);
+    }
+    let file_path = PathBuf::from(file);
+
+    if !file_path.exists() {
+        error!("Backup file not found: {:?}", file_path);
+        return Ok(());
+    }
+
+    let db = Db::init(&config)?;
+
+    // 1. Read metadata.json from the tar.zst archive
+    let f = File::open(&file_path)?;
+    let zst_dec = Decoder::new(f)?;
+    let mut archive = Archive::new(zst_dec);
+
+    let mut metadata_opt: Option<UserBackupMetadata> = None;
+    for entry_res in archive.entries()? {
+        let mut entry = entry_res?;
+        let path = entry.path()?;
+        let file_name = path.file_name().and_then(|n| n.to_str()).unwrap_or("");
+        if file_name == "metadata.json" {
+            let meta: UserBackupMetadata = serde_json::from_reader(&mut entry)?;
+            metadata_opt = Some(meta);
+            break;
+        }
+    }
+
+    let metadata = match metadata_opt {
+        Some(m) => m,
+        None => {
+            error!("Archive is missing metadata.json");
+            return Ok(());
+        }
+    };
+
+    info!("Restoring user {} from backup...", metadata.username);
+
+    // 2. Resolve target user ID and upsert user record in users.db
+    let target_user_id = {
+        let users_conn = db.users.lock().unwrap();
+        let existing_user =
+            crate::db::users::get_user_by_username(&users_conn, &metadata.username)?;
+
+        match existing_user {
+            Some(u) => {
+                users_conn.execute(
+                    "UPDATE users SET password_hash = ?1, status = ?2, account_type = ?3, metadata = ?4 WHERE id = ?5;",
+                    rusqlite::params![metadata.password_hash, metadata.status, metadata.account_type, metadata.metadata, u.id],
+                )?;
+                users_conn.execute(
+                    "INSERT OR REPLACE INTO quotas (user_id, max_urls, max_landings, max_api_tokens, max_storage_mb) 
+                     VALUES (?1, ?2, ?3, ?4, ?5);",
+                    rusqlite::params![u.id, metadata.quotas.max_urls, metadata.quotas.max_landings, metadata.quotas.max_api_tokens, metadata.quotas.max_storage_mb],
+                )?;
+                u.id
+            }
+            None => {
+                let id_taken: bool = users_conn
+                    .query_row(
+                        "SELECT EXISTS(SELECT 1 FROM users WHERE id = ?1);",
+                        [metadata.id],
+                        |row| row.get(0),
+                    )
+                    .unwrap_or(false);
+
+                let new_id = if !id_taken {
+                    users_conn.execute(
+                        "INSERT INTO users (id, username, password_hash, status, created_at, account_type, metadata) 
+                         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7);",
+                        rusqlite::params![metadata.id, metadata.username, metadata.password_hash, metadata.status, metadata.created_at, metadata.account_type, metadata.metadata],
+                    )?;
+                    metadata.id
+                } else {
+                    users_conn.execute(
+                        "INSERT INTO users (username, password_hash, status, created_at, account_type, metadata) 
+                         VALUES (?1, ?2, ?3, ?4, ?5, ?6);",
+                        rusqlite::params![metadata.username, metadata.password_hash, metadata.status, metadata.created_at, metadata.account_type, metadata.metadata],
+                    )?;
+                    users_conn.last_insert_rowid()
+                };
+
+                users_conn.execute(
+                    "INSERT OR REPLACE INTO quotas (user_id, max_urls, max_landings, max_api_tokens, max_storage_mb) 
+                     VALUES (?1, ?2, ?3, ?4, ?5);",
+                    rusqlite::params![new_id, metadata.quotas.max_urls, metadata.quotas.max_landings, metadata.quotas.max_api_tokens, metadata.quotas.max_storage_mb],
+                )?;
+                new_id
+            }
+        }
+    };
+
+    // 3. Extract database files to /data/users/<target_user_id>/
+    let dest_dir = config
+        .data_dir
+        .join("users")
+        .join(target_user_id.to_string());
+    std::fs::create_dir_all(&dest_dir)?;
+
+    let f2 = File::open(&file_path)?;
+    let zst_dec2 = Decoder::new(f2)?;
+    let mut archive2 = Archive::new(zst_dec2);
+
+    for entry_res in archive2.entries()? {
+        let mut entry = entry_res?;
+        let path = entry.path()?;
+        let file_name = path.file_name().and_then(|n| n.to_str()).unwrap_or("");
+        match file_name {
+            "content.db" => {
+                let mut out_file = File::create(dest_dir.join("content.db"))?;
+                std::io::copy(&mut entry, &mut out_file)?;
+            }
+            "analytics.db" => {
+                let mut out_file = File::create(dest_dir.join("analytics.db"))?;
+                std::io::copy(&mut entry, &mut out_file)?;
+            }
+            "profile.db" => {
+                let mut out_file = File::create(dest_dir.join("profile.db"))?;
+                std::io::copy(&mut entry, &mut out_file)?;
+            }
+            _ => {}
+        }
+    }
+
+    // 4. Register slugs in global_slugs
+    let restored_content_conn = rusqlite::Connection::open(dest_dir.join("content.db"))?;
+    {
+        let mut system_conn = db.system.lock().unwrap();
+        let tx = system_conn.transaction()?;
+
+        // Delete any existing global slugs owned by this user
+        tx.execute(
+            "DELETE FROM global_slugs WHERE owner_user_id = ?1;",
+            [target_user_id],
+        )?;
+
+        // Register URLs
+        {
+            let mut stmt =
+                restored_content_conn.prepare("SELECT code, id, created_at, status FROM urls;")?;
+            let mut rows = stmt.query([])?;
+            while let Some(row) = rows.next()? {
+                let slug: String = row.get(0)?;
+                let target_id: String = row.get(1)?;
+                let created_at: String = row.get(2)?;
+                let status: String = row.get(3)?;
+                let now = Utc::now().to_rfc3339();
+
+                let existing_owner: Option<i64> = tx
+                    .query_row(
+                        "SELECT owner_user_id FROM global_slugs WHERE slug = ?1;",
+                        [&slug],
+                        |r| r.get(0),
+                    )
+                    .optional()?;
+
+                if let Some(owner) = existing_owner {
+                    if owner != target_user_id {
+                        error!(
+                            "Conflict: Slug '{}' is already owned by user ID {}. Skipping.",
+                            slug, owner
+                        );
+                        continue;
+                    }
+                }
+
+                tx.execute(
+                    "INSERT OR REPLACE INTO global_slugs (slug, owner_user_id, target_type, target_id, created_at, updated_at, status) 
+                     VALUES (?1, ?2, 'url', ?3, ?4, ?5, ?6);",
+                    rusqlite::params![slug, target_user_id, target_id, created_at, now, status],
+                )?;
+            }
+        }
+
+        // Register Landing Pages
+        {
+            let mut stmt = restored_content_conn
+                .prepare("SELECT code, id, created_at, state FROM landing_pages;")?;
+            let mut rows = stmt.query([])?;
+            while let Some(row) = rows.next()? {
+                let slug: String = row.get(0)?;
+                let target_id: String = row.get(1)?;
+                let created_at: String = row.get(2)?;
+                let state: String = row.get(3)?;
+                let now = Utc::now().to_rfc3339();
+                let status = if state == "published" {
+                    "active"
+                } else {
+                    "disabled"
+                };
+
+                let existing_owner: Option<i64> = tx
+                    .query_row(
+                        "SELECT owner_user_id FROM global_slugs WHERE slug = ?1;",
+                        [&slug],
+                        |r| r.get(0),
+                    )
+                    .optional()?;
+
+                if let Some(owner) = existing_owner {
+                    if owner != target_user_id {
+                        error!(
+                            "Conflict: Slug '{}' is already owned by user ID {}. Skipping.",
+                            slug, owner
+                        );
+                        continue;
+                    }
+                }
+
+                tx.execute(
+                    "INSERT OR REPLACE INTO global_slugs (slug, owner_user_id, target_type, target_id, created_at, updated_at, status) 
+                     VALUES (?1, ?2, 'page', ?3, ?4, ?5, ?6);",
+                    rusqlite::params![slug, target_user_id, target_id, created_at, now, status],
+                )?;
+            }
+        }
+
+        tx.commit()?;
+    }
+
+    // 5. Reconcile quotas for restored user
+    crate::db::users::reconcile_user_quotas(
+        &db.users.lock().unwrap(),
+        target_user_id,
+        &restored_content_conn,
+    )?;
+
+    info!(
+        "User '{}' (ID: {}) successfully restored from backup.",
+        metadata.username, target_user_id
+    );
+    Ok(())
+}

src/cli/serve.rs

@@ -63,11 +63,29 @@ pub async fn run(
         crate::jobs::run_expiry_checker(expiry_db).await;
     });
 
+    let reconcile_db = db.clone();
+    let reconcile_interval_hours = {
+        let conn = db.system.lock().unwrap();
+        conn.query_row(
+            "SELECT value FROM settings WHERE key = 'quota_reconcile_interval_hours';",
+            [],
+            |row| row.get::<_, String>(0),
+        )
+        .ok()
+        .and_then(|val| val.parse::<u64>().ok())
+        .unwrap_or(24)
+    };
+    tokio::spawn(async move {
+        crate::jobs::run_quota_reconciliation(reconcile_db, reconcile_interval_hours).await;
+    });
+
     let state = AppState {
         admin_db: db.admin.clone(),
         content_db: db.content.clone(),
         analytics_db: db.analytics.clone(),
         system_db: db.system.clone(),
+        users_db: db.users.clone(),
+        user_dbs: std::sync::Arc::new(std::sync::Mutex::new(std::collections::HashMap::new())),
         db: db.clone(),
         config: config.clone(),
         analytics_queue: queue,