fix: close backup review findings

scripts/backup/container-entrypoint.sh

@@ -27,6 +27,40 @@ require_directory() {
   fi
 }
 
+validate_restic_repository() {
+  local canonical_repository
+
+  canonical_repository="$(realpath -m -- "$RESTIC_REPOSITORY")"
+  if [[ "$canonical_repository" == "$BACKUP_ROOT" || "$canonical_repository" != "$BACKUP_ROOT"/* ]]; then
+    printf 'RESTIC_REPOSITORY must be strictly below /backup; got %s.\n' "$RESTIC_REPOSITORY" >&2
+    return 1
+  fi
+
+  RESTIC_REPOSITORY="$canonical_repository"
+  export RESTIC_REPOSITORY
+}
+
+validate_restic_configuration() {
+  require_value RESTIC_REPOSITORY
+  require_value RESTIC_PASSWORD_FILE
+
+  if [[ ! -r "$RESTIC_PASSWORD_FILE" ]]; then
+    printf 'Restic password file %s is not readable.\n' "$RESTIC_PASSWORD_FILE" >&2
+    return 1
+  fi
+
+  require_directory "$BACKUP_ROOT"
+  validate_restic_repository
+}
+
+ensure_repository_initialized() {
+  if ! restic cat config >/dev/null; then
+    printf 'Restic repository %s is not initialized or could not be opened. Verify the backup mount, repository path, and password.\n' "$RESTIC_REPOSITORY" >&2
+    printf 'For an intended first-time repository, initialize it explicitly with: docker compose --profile backup run --rm backup init\n' >&2
+    return 1
+  fi
+}
+
 json_escape() {
   local input="$1"
   local output=""
@@ -72,22 +106,16 @@ run_backup() {
   local timestamp
   local checksum
   local app_version
+  local applied_migrations
 
   require_value DATABASE_URL
-  require_value RESTIC_REPOSITORY
-  require_value RESTIC_PASSWORD_FILE
   require_value BACKUP_RETENTION_DAYS
-
-  if [[ ! -r "$RESTIC_PASSWORD_FILE" ]]; then
-    printf 'Restic password file %s is not readable.\n' "$RESTIC_PASSWORD_FILE" >&2
-    return 1
-  fi
-
-  require_directory "$BACKUP_ROOT"
+  validate_restic_configuration
   require_directory "$STAGING_ROOT"
   require_directory "$UPLOADS_PATH"
   require_directory "$TDLIB_WORKER_PATH"
   require_directory "$TDLIB_BOT_PATH"
+  ensure_repository_initialized
 
   timestamp="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
   RUN_DIR="$STAGING_ROOT/backup-${timestamp//[:]/}-$$"
@@ -105,6 +133,26 @@ run_backup() {
   sha256sum "$RUN_DIR/database.dump" > "$RUN_DIR/manifest/database.dump.sha256"
   checksum="$(awk '{print $1}' "$RUN_DIR/manifest/database.dump.sha256")"
   app_version="${BACKUP_APP_VERSION:-unknown}"
+  applied_migrations="$(
+    psql --dbname "$DATABASE_URL" --no-psqlrc --tuples-only --no-align --quiet \
+      --set ON_ERROR_STOP=on <<'SQL'
+      SELECT COALESCE(
+        json_agg(
+          json_build_object(
+            'name', "migration_name",
+            'finishedAtUtc', to_char(
+              "finished_at" AT TIME ZONE 'UTC',
+              'YYYY-MM-DD"T"HH24:MI:SS.US"Z"'
+            )
+          )
+          ORDER BY "finished_at", "migration_name"
+        ),
+        '[]'::json
+      )::text
+      FROM "_prisma_migrations"
+      WHERE "finished_at" IS NOT NULL AND "rolled_back_at" IS NULL;
+SQL
+  )"
 
   cat > "$RUN_DIR/manifest/backup-manifest.json" <<EOF
 {
@@ -112,6 +160,7 @@ run_backup() {
   "repository": "$(json_escape "$RESTIC_REPOSITORY")",
   "retentionDays": "$(json_escape "$BACKUP_RETENTION_DAYS")",
   "applicationVersion": "$(json_escape "$app_version")",
+  "appliedPrismaMigrations": $applied_migrations,
   "databaseDump": {
     "filename": "database.dump",
     "sha256": "$(json_escape "$checksum")"
@@ -142,11 +191,17 @@ EOF
 
 run_restore() {
   shift
+  validate_restic_configuration
   exec restic restore "$@"
 }
 
+run_restic() {
+  validate_restic_configuration
+  exec restic "$@"
+}
+
 case "${1:-backup}" in
   backup) run_backup ;;
   restore) run_restore "$@" ;;
-  *) exec restic "$@" ;;
+  *) run_restic "$@" ;;
 esac