#!/usr/bin/env bash
set -euo pipefail

if [[ "${1:-}" == "--help" || "${1:-}" == "-h" || $# -ne 1 ]]; then
  cat <<'USAGE'
Usage:
  scripts/ops/verify-backup.sh <backup-dir>

Checks:
  - postgres.sql.gz integrity
  - checksums.sha256 verification
USAGE
  exit 0
fi

BACKUP_DIR="$1"

if [[ ! -d "$BACKUP_DIR" ]]; then
  echo "[error] backup directory not found: $BACKUP_DIR" >&2
  exit 1
fi
if [[ ! -f "$BACKUP_DIR/postgres.sql.gz" ]]; then
  echo "[error] missing postgres.sql.gz in $BACKUP_DIR" >&2
  exit 1
fi
if [[ ! -f "$BACKUP_DIR/checksums.sha256" ]]; then
  echo "[error] missing checksums.sha256 in $BACKUP_DIR" >&2
  exit 1
fi

echo "[step] validating postgres.sql.gz stream..."
gunzip -t "$BACKUP_DIR/postgres.sql.gz"

echo "[step] validating checksums..."
(cd "$BACKUP_DIR" && sha256sum -c checksums.sha256)

echo "[ok] backup verified: $BACKUP_DIR"