<?php

// Configuration and capability inspection only: no providers, session or active DDL.
use Illuminate\Foundation\Bootstrap\LoadConfiguration;
use Illuminate\Foundation\Bootstrap\LoadEnvironmentVariables;

$root = dirname(__DIR__);
require $root.'/vendor/autoload.php';
$app = require $root.'/bootstrap/app.php';
(new LoadEnvironmentVariables)->bootstrap($app);
(new LoadConfiguration)->bootstrap($app);
$c = config('database.connections.'.config('database.default'));
throw_unless($c['driver'] === 'pgsql' && empty($c['url']) && (int) $c['port'] === 5432 && $c['database'] === 'investemoz', RuntimeException::class, 'Exact read-only source required');
$pdo = new PDO('pgsql:host='.$c['host'].';port='.$c['port'].';dbname='.$c['database'], $c['username'], $c['password'], [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$pdo->exec('BEGIN READ ONLY');
$identity = $pdo->query("SELECT current_database() AS database,inet_server_port() AS port,current_setting('transaction_read_only') AS read_only")->fetch(PDO::FETCH_ASSOC);
throw_unless($identity['database'] === 'investemoz' && (int) $identity['port'] === 5432 && $identity['read_only'] === 'on', RuntimeException::class, 'Source refused');
$capability = $pdo->query("SELECT ((SELECT rolsuper FROM pg_roles WHERE rolname=current_user) OR pg_has_role(current_user,(SELECT tableowner FROM pg_tables WHERE schemaname='public' AND tablename='organizations'),'USAGE')) AS alter_organizations,
    has_schema_privilege(current_user,'public','USAGE') AS schema_usage,
    has_table_privilege(current_user,'public.migrations','SELECT,INSERT') AS migration_ledger,
    has_table_privilege(current_user,'public.audit_events','SELECT,INSERT') AS audit,
    has_table_privilege(current_user,'public.users','SELECT') AS users_read,
    has_table_privilege(current_user,'public.memberships','SELECT') AS memberships_read")->fetch(PDO::FETCH_ASSOC);
$pdo->exec('ROLLBACK');
throw_unless(! in_array(false, $capability, true), RuntimeException::class, 'Active service-role capability missing');
$result = ['result' => 'passed', 'at' => gmdate('c'), 'identity' => $identity, 'capability' => $capability, 'active_writes' => 0,
    'scope' => 'Existing database service role inspected; no privileges assigned. Dump includes ownership/ACL; QA restore intentionally uses --no-owner --no-privileges, not a rehearsal of changing active grants.'];
file_put_contents($root.'/storage/app/private/investmoz-v2/portal-audit/country-target-capabilities-20261011.json', json_encode($result, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR));
echo json_encode($result, JSON_THROW_ON_ERROR).PHP_EOL;