# AI-SiteArk — Cloud Destination Setup (Developer Guide)

How to enable the **Amazon S3** and **Dropbox** off-site backup destinations.

- **Amazon S3** is credential-based — the plugin talks to S3 directly, so there's **no broker work**. You just create a bucket + an IAM key and paste them into Settings.
- **Dropbox** uses OAuth through the shared broker (`connect.wp.aiappstore.in`), which currently supports only Google/Microsoft — so Dropbox needs **(a) a Dropbox app** and **(b) a broker code change + redeploy**.

> Google Drive & OneDrive need nothing here — they reuse the existing Google/Microsoft apps and the broker is already deployed with their storage scopes.

---

## 1. Amazon S3

### 1.1 Create a bucket
1. AWS Console → **S3** → **Create bucket**.
2. Pick a globally-unique name (e.g. `mycompany-site-backups`) and a **Region** (note it — e.g. `us-east-1`).
3. Keep **Block all public access = ON** (backups are sensitive).
4. (Optional) Enable **Default encryption** (SSE-S3 / SSE-KMS) and a **Lifecycle rule** to expire very old objects.

### 1.2 Create a least-privilege IAM policy
IAM → **Policies** → **Create policy** → JSON. Replace `BUCKET`:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AISiteVaultBackups",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts",
        "s3:ListBucketMultipartUploads",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::BUCKET",
        "arn:aws:s3:::BUCKET/*"
      ]
    }
  ]
}
```

> This is upload-only (plus the multipart calls the plugin uses). Add `s3:GetObject` + `s3:DeleteObject` later if you want restore-from-S3 / remote pruning.

### 1.3 Create an access key
1. IAM → **Users** → **Create user** (no console access needed).
2. Attach the policy from 1.2.
3. **Security credentials** → **Create access key** → *Application running outside AWS* → copy the **Access key ID** and **Secret access key** (shown once).

### 1.4 Enter it in AI-SiteArk
**AI-SiteArk → Settings → Off-site destination → Amazon S3**, then **select S3** as the active destination and **Save**:

| Field | Value |
|-------|-------|
| Access key | from 1.3 |
| Secret key | from 1.3 |
| Region | bucket region, e.g. `us-east-1` |
| Bucket | bucket name from 1.1 |
| Folder prefix | optional, e.g. `site-backups` |

Notes:
- The adapter uses **SigV4** + **multipart upload** (virtual-hosted-style `https://{bucket}.s3.{region}.amazonaws.com`), so the **Region must match the bucket**.
- The **secret key is encrypted at rest** (AES-256-GCM, keyed off your `wp-config.php` salts), so a stolen database or DB backup can't read it without `wp-config.php`. The form never re-displays it — leave the Secret field blank to keep the stored one. Still, use a dedicated, **scoped** IAM key (the upload-only policy above), never a root key.

---

## 2. Dropbox

Two parts: the Dropbox app (your task) and the broker change (code + redeploy).

### 2.1 Create the Dropbox app
1. <https://www.dropbox.com/developers/apps> → **Create app**.
2. **Scoped access** → **App folder** (recommended; sandboxes uploads to one folder) → name it (e.g. `AI-SiteArk Backups`).
3. **Permissions** tab → enable: `files.content.write`, `files.content.read` → **Submit**.
4. **Settings** tab:
   - **OAuth 2 → Redirect URIs** → add: `https://connect.wp.aiappstore.in/calendar/callback`
   - Copy the **App key** and **App secret**.
   - (For more than a few users, click **Enable additional users** / apply for production.)

> Refresh tokens: the broker must request `token_access_type=offline` on authorize (handled in 2.2), so scheduled/unattended uploads keep working.

### 2.2 Broker support — already implemented ✅
The broker (`ai-mailbridge-broker`) now ships a Dropbox provider: `lib/Dropbox.php`
(`AIMB_Broker_Dropbox`), `provider=dropbox` allowed via `aimb_validate_cal_provider()`,
`service=dropbox` → storage flow, and `AIMB_DROPBOX_*` config constants. Nothing more to
code — you only need to supply the app credentials (§2.3) and redeploy (§2.4).

### 2.3 Put the secret in the cluster (never in git)
Add the Dropbox client id/secret to the broker's runtime `config.php` Kubernetes Secret (same Secret that holds the Google/Microsoft secrets), e.g.:

```bash
kubectl -n aiappstore-wp edit secret mailbridge-broker-config   # add the AIMB_DROPBOX_* values
```

### 2.4 Rebuild + redeploy the broker
```bash
az acr build --registry atozimages --image atoz-mailbridge-broker:prod ./ai-mailbridge-broker
kubectl rollout restart deployment/mailbridge-broker -n aiappstore-wp
kubectl rollout status  deployment/mailbridge-broker -n aiappstore-wp
# rollback if needed:
# kubectl rollout undo  deployment/mailbridge-broker -n aiappstore-wp
```

Verify the storage flow:
```bash
curl -s -D - -o /dev/null \
  "https://connect.wp.aiappstore.in/calendar/authorize?provider=dropbox&service=dropbox&site=https%3A%2F%2Fexample.com&return=https%3A%2F%2Fexample.com" \
  | grep -i location
# expect a 302 to dropbox.com/oauth2/authorize with token_access_type=offline
```

### 2.5 Connect in AI-SiteArk
The plugin side is already built (`Dropbox_Storage` + `Backup_Sync`). Once 2.1–2.4 are live:
**AI-SiteArk → Settings → Off-site destination → Dropbox → Connect** → approve → it becomes the active destination and new backups upload to the `/AI-SiteArk Backups` app folder.

---

## Quick status

| Destination | Console work | Broker work | Plugin |
|-------------|--------------|-------------|--------|
| Google Drive | none (reused) | ✅ deployed | ✅ done |
| OneDrive | none (reused) | ✅ deployed | ✅ done |
| Amazon S3 | bucket + IAM key (§1) | none | ✅ done |
| FTP / FTPS | server credentials | none | ✅ done |
| Dropbox | Dropbox app (§2.1) | ✅ handler done — add secret + redeploy (§2.3–2.4) | ✅ done |