#!/usr/bin/env bash
# Read-only, verified backup of ONE database (e.g. an existing POS database before adoption).
#   BACKUP_DB_PASSWORD='<password>' bash scripts/backup-database.sh --db-name=<db> --db-user=<user> [--db-host=localhost] [--out=<folder>]
# Writes <out>/<db>_<UTC time>.sql.gz + .sha256 (mode 0600), then verifies: gzip integrity, checksum, dump completed,
# and that the dump contains every table of the database. Exit code 0 only if everything is verified.
set -euo pipefail
umask 077
DB=""; USER_=""; HOST="localhost"; OUT="${HOME}/kaabe-backups/pre-adoption"
for a in "$@"; do case "$a" in --db-name=*) DB="${a#*=}";; --db-user=*) USER_="${a#*=}";; --db-host=*) HOST="${a#*=}";; --out=*) OUT="${a#*=}";; esac; done
[ -n "$DB" ] && [ -n "$USER_" ] || { echo "Missing --db-name / --db-user"; exit 2; }
[ -n "${BACKUP_DB_PASSWORD:-}" ] || { echo "Set BACKUP_DB_PASSWORD in the environment."; exit 2; }
mkdir -p "$OUT"; chmod 700 "$OUT"
CNF="$(mktemp)"; trap 'rm -f "$CNF"' EXIT
printf '[client]\nuser="%s"\npassword="%s"\nhost="%s"\n' "$USER_" "$(printf '%s' "$BACKUP_DB_PASSWORD" | sed 's/\\/\\\\/g; s/"/\\"/g')" "$HOST" > "$CNF"
FILE="$OUT/${DB}_$(date -u +%Y%m%dT%H%M%SZ).sql.gz"
echo "Dumping $DB (read-only, single transaction) → $FILE"
mysqldump --defaults-extra-file="$CNF" --single-transaction --quick --routines --triggers --events --hex-blob --default-character-set=utf8mb4 "$DB" | gzip -9 > "$FILE"
( cd "$OUT" && sha256sum "$(basename "$FILE")" > "$(basename "$FILE").sha256" )
echo "Verifying"
gzip -t "$FILE"                                                        || { echo "FAIL: gzip integrity"; exit 1; }
( cd "$OUT" && sha256sum -c "$(basename "$FILE").sha256" >/dev/null )   || { echo "FAIL: checksum"; exit 1; }
gzip -dc "$FILE" | tail -n 5 | grep -q "Dump completed"                || { echo "FAIL: dump did not complete"; exit 1; }
LIVE=$(mysql --defaults-extra-file="$CNF" -N -B -e "SELECT COUNT(*) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$DB' AND TABLE_TYPE='BASE TABLE'")
DUMPED=$(gzip -dc "$FILE" | grep -c '^CREATE TABLE ' || true)
[ "$LIVE" = "$DUMPED" ] || { echo "FAIL: database has $LIVE tables, dump has $DUMPED"; exit 1; }
echo "VERIFIED: $FILE  ($DUMPED tables, $(du -h "$FILE" | cut -f1), sha256 $(cut -d' ' -f1 "$FILE.sha256"))"
echo "Copy this file OFF the server before continuing."