Backup panel PostgreSQL database as .sql dump (v2.6.2).

Co-authored-by: Cursor <cursoragent@cursor.com>

app.py

@@ -103,7 +103,7 @@ else:
     application_path = os.path.dirname(__file__)
 
 DATA_FILE = os.path.join(application_path, 'data.json')  # legacy JSON; used only for one-shot import / export
-CURRENT_VERSION = "v2.6.1"
+CURRENT_VERSION = "v2.6.2"
 RELEASES_REPO_URL = repo_url()
 RELEASES_API_LATEST = api_latest_url()
 BIN_DIR = os.environ.get('TUNNEL_BIN_DIR', os.path.join(application_path, 'bin'))
@@ -111,11 +111,14 @@ TUNNEL_STATE_FILE = os.environ.get('TUNNEL_STATE_FILE', os.path.join(application
 
 # Panel state lives in PostgreSQL 17 (see db/). load_data/save_data keep the old dict API.
 from db import (  # noqa: E402
+    backup_filename,
     clear_tunnel_state,
     ensure_db_ready,
     export_data_dict,
+    export_database_sql,
     load_data,
     load_tunnel_state,
+    restore_database_sql,
     save_data,
     save_tunnel_state,
     update_tunnel_state,
@@ -6591,6 +6594,24 @@ async def api_revoke_token(request: Request, token_id: str):
 
 @app.get('/api/settings/backup/download', tags=["Settings"])
 async def api_backup_download(request: Request):
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        content = await asyncio.to_thread(export_database_sql)
+    except Exception as e:
+        logger.exception('Database backup failed')
+        return JSONResponse({'error': str(e)}, status_code=500)
+    filename = backup_filename()
+    return StreamingResponse(
+        io.BytesIO(content),
+        media_type='application/sql',
+        headers={'Content-Disposition': f'attachment; filename="{filename}"'},
+    )
+
+
+@app.get('/api/settings/backup/download/json', tags=["Settings"])
+async def api_backup_download_json(request: Request):
+    """Legacy JSON export (same shape as old data.json)."""
     if not _check_admin(request):
         return JSONResponse({'error': 'Forbidden'}, status_code=403)
     payload = await asyncio.to_thread(export_data_dict)
@@ -6610,33 +6631,39 @@ async def api_backup_restore(request: Request, file: UploadFile = File(...)):
         content = await file.read()
         if not content:
             return JSONResponse({'error': 'Empty file'}, status_code=400)
-        
+
+        filename = (file.filename or '').lower()
+        is_json = filename.endswith('.json') or content.lstrip().startswith(b'{')
+
+        if is_json:
+            try:
+                backup_data = json.loads(content)
+            except json.JSONDecodeError:
+                return JSONResponse({'error': 'Invalid JSON format'}, status_code=400)
+
+            required_keys = ['servers', 'users']
+            missing = [k for k in required_keys if k not in backup_data]
+            if missing:
+                return JSONResponse({'error': f'Invalid structure. Missing keys: {", ".join(missing)}'}, status_code=400)
+
+            if not isinstance(backup_data['servers'], list) or not isinstance(backup_data['users'], list):
+                return JSONResponse({'error': 'Invalid structure: servers and users must be lists'}, status_code=400)
+
+            backup_data.setdefault('user_connections', [])
+            backup_data.setdefault('api_tokens', [])
+            backup_data.setdefault('invite_links', [])
+            backup_data.setdefault('settings', {})
+
+            async with DATA_LOCK:
+                save_data(backup_data)
+            return {'status': 'success', 'format': 'json'}
+
         try:
-            backup_data = json.loads(content)
-        except json.JSONDecodeError:
-            return JSONResponse({'error': 'Invalid JSON format'}, status_code=400)
-
-        # Basic structure validation
-        required_keys = ['servers', 'users']
-        missing = [k for k in required_keys if k not in backup_data]
-        if missing:
-            return JSONResponse({'error': f'Invalid structure. Missing keys: {", ".join(missing)}'}, status_code=400)
-
-        # Ensure types are correct
-        if not isinstance(backup_data['servers'], list) or not isinstance(backup_data['users'], list):
-            return JSONResponse({'error': 'Invalid structure: servers and users must be lists'}, status_code=400)
-
-        backup_data.setdefault('user_connections', [])
-        backup_data.setdefault('api_tokens', [])
-        backup_data.setdefault('invite_links', [])
-        backup_data.setdefault('settings', {})
-
-        # Save the new data
-        async with DATA_LOCK:
-            save_data(backup_data)
-        
-        # In a real app we might want to restart or re-init background tasks
-        return {'status': 'success'}
+            await asyncio.to_thread(restore_database_sql, content)
+        except Exception as e:
+            logger.exception('Database restore failed')
+            return JSONResponse({'error': str(e)}, status_code=400)
+        return {'status': 'success', 'format': 'sql'}
     except Exception as e:
         logger.exception("Error during restore")
         return JSONResponse({'error': str(e)}, status_code=500)