<?php

use Illuminate\Contracts\Console\Kernel;
use Illuminate\Support\Facades\Crypt;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Storage;

require dirname(__DIR__).'/vendor/autoload.php';
require __DIR__.'/portal-qa-environment.php';
$target = portalQaEnvironment();
$app = require dirname(__DIR__).'/bootstrap/app.php';
$app->make(Kernel::class)->bootstrap();
portalQaAssertTarget($target);
$private = storage_path('app/private/investmoz-v2/portal-audit');
$http = json_decode(file_get_contents($private.'/independent-documents-http-qa.json'), true, 512, JSON_THROW_ON_ERROR);
if ($http['result'] !== 'passed' || $http['target'] !== $target['database'].':'.$target['port']) {
    throw new RuntimeException('Successful HTTP proof for this QA target required.');
}
$proof = DB::transaction(function () use ($http, $target): array {
    DB::statement('SET TRANSACTION READ ONLY');
    $documents = [];
    foreach (['land' => 'land_assistance_documents', 'room' => 'partnership_documents'] as $scope => $table) {
        foreach ($http[$scope] as $row) {
            $link = DB::table($table)->where('id', $row['attachment_id'])->first();
            $document = DB::table('documents')->where('id', $link->document_id)->first();
            $bytes = Storage::disk('local')->get($document->storage_key);
            if ($document->storage_encryption === 'laravel') {
                $bytes = Crypt::decryptString($bytes);
            }
            $scan = DB::table('document_malware_scans')->where('document_id', $document->id)->where('result', 'clean')->exists();
            $valid = $document->status === 'active' && $document->malware_scan_status === 'clean'
                && $document->malware_engine === 'ClamAV' && $document->malware_signatures_at !== null && $scan
                && trim($document->sha256) === $row['sha256'] && $document->malware_scanned_sha256 === $row['sha256']
                && hash('sha256', $bytes) === $row['sha256'] && strlen($bytes) === $document->size_bytes
                && $document->uploaded_by === 21 && ($scope !== 'room' || ! $link->shared);
            if (! $valid) {
                throw new RuntimeException('Original/scan/permission evidence mismatch: '.$scope.'/'.$row['type']);
            }
            $documents[] = ['scope' => $scope, 'type' => $row['type'], 'document_id' => $document->id,
                'sha256' => $row['sha256'], 'engine' => $document->malware_engine, 'signatures_at' => $document->malware_signatures_at,
                'scanned_hash_matches_original' => true, 'original_bytes_preserved' => true, 'encrypted' => $document->storage_encryption === 'laravel'];
        }
    }
    $events = DB::table('partnership_events')->where('partnership_id', $http['receipts']['offer_id'])
        ->where('event_type', 'partnership.document_sharing_changed.v1')->count();
    if (count($documents) !== 6 || $events < 6) {
        throw new RuntimeException('Expected six originals and six explicit sharing transitions.');
    }

    return ['result' => 'passed', 'target' => $target, 'captured_at' => gmdate('c'), 'documents' => $documents,
        'sharing_audit_events' => $events, 'active_writes' => 0, 'interface_observed' => false];
});
file_put_contents($private.'/independent-documents-verification-qa.json', json_encode($proof, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR));
echo json_encode(['result' => $proof['result'], 'documents' => count($proof['documents']), 'sharing_audit_events' => $proof['sharing_audit_events'], 'active_writes' => 0], JSON_THROW_ON_ERROR).PHP_EOL;