#!/usr/bin/env bash
set -Eeuo pipefail
umask 022
script_dir=$(cd "$(dirname "$0")" && pwd)
backup=${1:?Recovery directory required}
mode=${2:?Choose --code-only-compatible or --restore-database-confirm-data-loss}
source "$script_dir/runtime.sh"
[[ "$backup" == "$backups/"* && "$backup" != *..* ]] || exit 2
[[ "$mode" == --code-only-compatible || "$mode" == --restore-database-confirm-data-loss ]] || exit 2
previous=$(cat "$backup/previous-commit")
python3 "$script_dir/release.py" preflight --root "$app" --artifact "$backup/code.tar.gz" --version "$previous" > /dev/null
if [[ "$mode" == --restore-database-confirm-data-loss ]]; then
    gzip -t "$backup/database.sql.gz"
fi
maintenance_on
stop_worker
trap 'echo "Rollback failed; maintenance remains enabled. Inspect the recovery logs." >&2' ERR
if [[ "$mode" == --restore-database-confirm-data-loss ]]; then
    # The restore connection is loaded from private backup metadata, not from
    # potentially incompatible new application code. Credentials stay off argv.
    php "$script_dir/restore.php" "$backup/database-config.json" "$backup/database.sql.gz"
fi
python3 "$script_dir/release.py" install --root "$app" --artifact "$backup/code.tar.gz" --version "$previous"
if [[ -f "$backup/environment-updated" ]]; then
    envtool "$script_dir/environment.py" restore --env-file "$app/.env" --backup "$backup/app.env"
fi
refresh_app
phpweb artisan up
if ! start_worker || ! healthy; then
    maintenance_on
    exit 1
fi
echo "Rollback verified: $previous (recovery directory $backup)"