#!/usr/bin/env bash

set -Eeuo pipefail

dhv2_project="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
dhv2_requested="${1:-}"

if [ -z "$dhv2_requested" ]; then
  echo "Uso: bash scripts/verify-backup.sh /var/www/dh-backup/dhv2-..." >&2
  exit 1
fi

dhv2_backup="$(realpath -e "$dhv2_requested")"
case "$dhv2_backup" in
  /var/www/dh-backup/dhv2-*) ;;
  *) echo "Ruta de backup no permitida: $dhv2_backup" >&2; exit 1 ;;
esac

for dhv2_file in source.tar.gz database.dump .env MANIFEST.txt SHA256SUMS; do
  test -s "$dhv2_backup/$dhv2_file" || { echo "Falta $dhv2_file" >&2; exit 1; }
done

test "$(stat -c '%a' "$dhv2_backup/.env")" = "600" || {
  echo "El backup de .env no tiene permisos 600" >&2
  exit 1
}

(
  cd "$dhv2_backup"
  sha256sum -c SHA256SUMS
)

dhv2_archive_listing="$(tar -tzf "$dhv2_backup/source.tar.gz")"
if grep -Eq '(^|/)\.env$|(^|/)(node_modules|dist)/' <<< "$dhv2_archive_listing"; then
  echo "El archivo de fuentes contiene elementos excluidos" >&2
  exit 1
fi

if [ -f "$dhv2_backup/asset-media.tar.gz" ]; then
  tar -tzf "$dhv2_backup/asset-media.tar.gz" >/dev/null
fi

cd "$dhv2_project"
docker compose exec -T db pg_restore --list < "$dhv2_backup/database.dump" >/dev/null

echo "Backup verificable y legible: OK"
echo "$dhv2_backup"