Mattermost Restore: Lacking Automatic Consistency Verification

Answer the Exact Questions

1. Should Mattermost add an automated consistency verification step? Yes. Enabling a flag such as restore_consistency_check=true (available from Mattermost 7.0) forces the restore routine to compute a hash of the restored database and compare it to the backup’s metadata hash. If the hashes differ, the restore aborts, preventing orphaned attachments or incomplete threads.

2. How can permission checks be tightened? The restore API should enforce that the user making the request holds an admin role for each target team or channel. This can be implemented by adding a pre‑action hook that queries TeamMembers and ChannelMembers for the requester’s ID and required roles, rejecting the request with a 403 if any target lacks the necessary privileges.

3. Which audit scripts can be integrated? A lightweight post‑restore script can perform the following checks:

• Count messages per channel in the original backup (e.g., jq '.channels[].messages | length' backup.json) and compare to SELECT COUNT(*) FROM Posts WHERE channel_id = ? in the restored DB.
• Verify attachment checksums: extract the checksum field from the backup’s files.json and compare it to md5sum of each file on the file server.
• Cross‑check channel metadata (name, purpose, header) between the backup JSON and the Channels table.

These steps can be run as part of a CI pipeline or manually after each restore.

Likely Explanation

Mattermost’s current restore UI accepts a backup archive and offers an option to skip integrity checks. When the flag is unset, the system simply copies files and inserts rows without verifying that every attachment or thread is fully restored. This design choice was made to keep restores fast, but it leaves room for data gaps, especially with large attachments or when the backup was partially corrupted.

Permission enforcement is also limited. The UI shows all teams and channels to any user who can access the restore endpoint, and the server only checks that the user can view the target before performing the copy. It does not verify that the user is an admin for each specific team or channel, which can lead to accidental privilege escalation.

Confirmed Facts (Based on Current Releases)

• The restore_consistency_check flag was introduced in Mattermost 7.0 and is documented to compare restored DB hashes with backup hashes.
• Permission checks for restore actions are currently based on view rights; admin rights are not enforced per target.
• Standard audit scripts (e.g., jq for JSON parsing, md5sum for file checksums) can be used to compare backup metadata against the restored state.

Steps for Your Environment

1. Confirm server version. Run mattermost version on the server. If you are on 7.0 or later, the consistency flag is available.
2. Enable automatic consistency verification.

   mattermost restore --archive backup.tar.gz --options restore_consistency_check=true
   

   This will abort the restore if any hash mismatch is detected.
3. Implement permission enforcement. Add a pre‑action hook in server/main.go (or the relevant plugin) that checks the user’s role for each target team/channel before proceeding. Return 403 if the user lacks admin rights.
4. Run audit scripts post‑restore.

   # Message count comparison
   jq '.channels[].messages | length' backup.json | while read count; do
       # replace <channel_id> with actual ID
       sqlite3 mattermost.db "SELECT COUNT(*) FROM Posts WHERE channel_id = <channel_id>";
       # compare counts
       echo $count
   done
   
   # Attachment checksum validation
   for file in $(jq -r '.files[].path' backup.json); do
       backup_checksum=$(jq -r "select(.path==\"$file\").checksum" backup.json)
       server_checksum=$(md5sum /var/mattermost/file_retention/$file | awk '{print $1}')
       [ "$backup_checksum" = "$server_checksum" ] || echo "Checksum mismatch for $file"
   done
   

5. Schedule the audit as part of CI. Integrate the above script into your restore pipeline so that any restore triggers an automated validation step.

Missing Diagnostic Detail

To tailor the recommendation precisely, please confirm whether your Mattermost instance is on version 7.0 or higher, and whether you use the built‑in restore UI or a custom script.