Add Backup & Recovery to V2 Admin Settings with V1 parity

[Paul Lizer (paullizer)]

Summary

• V2 Admin Settings listed the Backup & Recovery group but showed "No settings match" for it. Admins had to switch to the classic page to back up, restore, migrate, repair a Cosmos DB document, or follow a job.
  • Each of the group's nine sections now has a V2 card with the classic page's capabilities.
  • The cards follow V2's design: section cards, list-and-detail workbenches like the Model Catalog, and V2 dialogs.
  • They call the existing admin-only /api/admin/data-management/* routes. There are no backend changes.
• Backup settings join the page's Save bar. They save after the main settings, as the same 42-key document the classic page sends.
  • Actions that run against saved settings save pending backup edits first: queueing a backup, retention cleanup, restore review and queue, and starting a migration.
  • Retry and resume never save.
  • When unsaved Enhanced Citations or Key Vault settings would change how an action is checked, the action offers "Save all and continue".
  • Leaving the page with unsaved work asks first.
• Restore and migration queue only from a current, passing server review. Overwrite restores and mirror migrations need a typed confirmation.
  • Restore asks for a destination only for the surfaces being restored.
  • Migration "All" shows the server's count, and the Confirm step shows the plan as the server normalized it.
  • The Cosmos DB editor stays locked until the admin accepts the risk, and its saves are ETag-guarded.
  • Jobs follows running jobs and offers retry/resume, cancel, and manifest downloads.
• Also fixes the literal & in the "Backup Inventory & Restore" navigation label, on both the classic and V2 pages.

Notes for reviewers

• Up to date with the base. paullizer-react-v2-ui is merged in, at b8db49d71, including Governance (Add the Governance group to V2 Admin Settings #1680) and Scale (Bring V2 admin Scale settings to parity with the classic page #1681). Conflicts were resolved by keeping both sides, except for the two points below.
• One navigation blocker. The base added a useBlocker that asks before opening a global agent or action editor with unsaved settings. React Router honours one blocker at a time and silently ignores the others, so the page now has a single guard:
  • Opening an editor with only main settings unsaved keeps the base's "Discard unsaved changes?" prompt.
  • Anything else asks with this PR's "Leave Admin settings?" dialog, which also covers unsaved Backup & Recovery settings, an edited Cosmos DB document, or a request still being sent.
  • Whether the held navigation targets an editor is decided inside the blocker function, because blocker.location keeps the /v2 base path.
  • A functional test fails if the page ever has more than one useBlocker.
• Agent delegation. The base removed it from this page, so it is no longer part of the leave guard.
• XSS checker change. scripts/check_xss_sinks.py now lists migrationManifestUrl as a reviewed same-origin URL builder. It is apiUrl() over a literal prefix and an encoded job id, and a functional test pins that shape. Worth a look since it is a security tool.
• State. The cards unmount when a category or search hides them, so their state lives in a zustand store that outlives them. An epoch counter discards async results that arrive after the page is left.
• Left out deliberately.
  • Light-mode contrast of status text on tinted fills: the same pattern appears in about 89 other V2 files, so it needs a theme-level fix.
  • Toasts appearing above dialogs, and small touch targets: both come from shared V2 primitives.

Linked issue

N/A - no tracking issue was filed for this work.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
  • 0.261.274 (base) -> 0.261.275. The release-notes entry is in its own v0.261.275 section, and this feature's test and doc headers use the same version.
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Testing / validation

All results are from the branch after the base was merged in.

• npx tsc -p tsconfig.json --noEmit (in application/v2_ui): passed
• npm run build (in application/v2_ui): passed
• python -m pytest ui_tests/test_v2_admin*.py: 223 passed. This includes the 64 Backup & Recovery browser tests, which run against the built SPA with an in-memory copy of the data-management API, and the base's global agents/actions tests for its editor prompt.
• python functional_tests/test_v2_admin_backup_recovery.py: 4/4 passed, including 42 TypeScript logic checks
• python functional_tests/test_v2_admin_backup_recovery_parity.py: 5/5 passed
• python -m pytest functional_tests/test_v2_admin_*.py: 367 passed, 3 failed. None of the three is caused by this PR:
  • test_v2_admin_security_parity.py::test_every_v1_security_field_is_claimed fails without this PR.
  • test_v2_admin_settings_schema.py::test_defaults_match_their_field_type fails without this PR.
  • test_v2_admin_settings_rail_collapse.py::test_the_rail_collapses_to_labelled_icons fails on the base itself: it still expects disabled={delegationDirty}, which the base removed.
• python functional_tests/test_docs_app_surface_coverage.py: 7/7 passed. Regenerating the inventory with python scripts/build_docs_inventory.py changed nothing.
• python functional_tests/test_docs_site_quality.py: 6/6 passed
• python functional_tests/test_data_management_security_patterns.py: passed
• python scripts/check_xss_sinks.py over the 24 .ts/.tsx files this PR changes: passed. Run over every file the merge brought in, it also flags pages/workspace/AgentEditorPage.tsx:195, which is unchanged from the base.
• git diff --check: clean
• An independent code review raised 8 findings, including a job-detail fetch loop and a Cosmos container retry loop. All 8 are fixed, and the reviewer re-checked each fix.

Documentation

• Release notes updated, or not needed (v0.261.275 entry)
• Feature documentation updated, or not needed
  • New docs/explanation/features/V2_ADMIN_BACKUP_RECOVERY.md.
  • Rewrote the section text and settings tables in docs/admin/backup-recovery.md.
• Fix documentation updated, or not needed (not needed: the label fix is one line and is covered in the release notes)

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) (no new routes)
• Settings sent to non-admin frontends use sanitize_settings_for_user() (no change: the cards use the existing admin-only routes)
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included