<?php

namespace App\Services;

use App\Models\User;
use Illuminate\Support\Facades\Artisan;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Schema;
use Illuminate\Support\Facades\Validator;
use Illuminate\Support\Str;

/** Additive installation and separate, explicit bootstrap. No identities are inferred. */
class PortalProfileInstallation
{
    public const MIGRATION = '2026_10_10_040000_create_portal_profile_authorization';

    public const TABLES = ['portal_profile_requests', 'portal_role_assignments', 'portal_superuser_pair', 'portal_security_approvals'];

    public function __construct(private PortalProfileAccess $access) {}

    public function fingerprint(): string
    {
        $files = [...PortalProfileAccess::fingerprintFiles(), __FILE__, config_path('portal_profiles.php'),
            app_path('Services/TechnicalSupportProfileSchema.php'), app_path('Services/OpportunityTechnicalSupport.php'), app_path('Services/TechnicalIncidentHandling.php'), app_path('Services/OpportunityTechnicalIncidents.php'), app_path('Services/OpportunityWorkflowExecution.php'), app_path('Exceptions/OpportunityWorkflowUnavailable.php'), app_path('Http/Controllers/TechnicalSupportController.php'),
            database_path('migrations/'.TechnicalSupportProfileSchema::MIGRATION.'.php'), resource_path('js/pages/profiles/support-installation.tsx'), resource_path('js/lib/profile-support-installation.ts'), resource_path('js/lib/page-preparation-guard.ts'), resource_path('js/lib/portal-api.ts'), resource_path('js/lib/operation-key.ts'), resource_path('js/pages/profiles/technical-support.tsx'), resource_path('js/pages/profiles/technical-incident.tsx'), resource_path('js/components/technical-incident-handling.tsx'), resource_path('js/components/opportunity-technical-incidents.tsx'), resource_path('js/lib/technical-incident-handling.ts'), resource_path('js/lib/technical-incident-labels.ts'),
            app_path('Jobs/ScanDocumentForMalware.php'), app_path('Services/Malware/DocumentScanAttempts.php'), app_path('Services/Malware/DocumentScanDelivery.php'), app_path('Services/Malware/DocumentScanRetry.php'), app_path('Http/Controllers/DocumentMalwareController.php'), resource_path('js/pages/management/shared.tsx'), resource_path('js/pages/investment/zone-attachments.tsx'), app_path('Services/OpportunityScanDispatch.php'), app_path('Services/OpportunityTechnicalExecution.php'), app_path('Services/OpportunityResourceFileCleanup.php'), resource_path('js/components/technical-incident-notice.tsx'), app_path('Http/Controllers/PortalProfileInstallationController.php'), resource_path('js/pages/profiles/installation.tsx'), resource_path('js/pages/profiles/bootstrap-confirmation.tsx'), base_path('routes/web.php')];

        return hash('sha256', json_encode(array_map(fn ($path) => hash_file('sha256', $path), array_unique($files)), JSON_THROW_ON_ERROR));
    }

    /** @return array{verified:bool,date:string|null,fingerprint:string|null} */
    private function readiness(\stdClass $identity, string $code): array
    {
        $path = config('portal_profiles.proof_directory').'/readiness.json';
        $bytes = is_file($path) && is_readable($path) ? file_get_contents($path) : false;
        $decoded = is_string($bytes) ? json_decode($bytes, true) : null;
        $proof = is_array($decoded) ? $decoded : [];
        $date = is_string($proof['verified_at'] ?? null) ? $proof['verified_at'] : null;
        $timestamp = $date !== null ? strtotime($date) : false;
        $target = is_array($proof['target'] ?? null) ? $proof['target'] : [];
        $port = $target['port'] ?? null;
        $dump = $proof['dump_path'] ?? null;
        $files = $proof['files_path'] ?? null;
        $verified = $timestamp !== false && $timestamp >= time() - 86400 && $timestamp <= time() && ($proof['code_hash'] ?? null) === $code && ($target['database'] ?? null) === $identity->database
            && (is_int($port) || (is_string($port) && ctype_digit($port))) && (int) $port === (int) $identity->port
            && ($proof['restore_verified'] ?? null) === true && ($proof['files_verified'] ?? null) === true && ($proof['compatibility_verified'] ?? null) === true && ($proof['qa_passed'] ?? null) === true
            && is_string($dump) && is_file($dump) && is_readable($dump) && hash_file('sha256', $dump) === ($proof['dump_sha256'] ?? null)
            && is_string($files) && is_file($files) && is_readable($files) && hash_file('sha256', $files) === ($proof['files_sha256'] ?? null);

        return ['verified' => $verified, 'date' => $date, 'fingerprint' => is_string($bytes) ? hash('sha256', $bytes) : null];
    }

    /** @return array<string,mixed> */
    public function supportPreview(User $actor): array
    {
        $this->authorize($actor);
        $base = $this->preview($actor);
        $schema = app(TechnicalSupportProfileSchema::class)->inspect();
        $dependencies = ['profiles_installed' => $base['installed'], 'profiles_consistent' => $base['consistent'], ...$base['dependencies']];
        $readiness = $this->readiness($base['target'], $base['code_hash']);
        $action = $schema['installed'] ? 'none' : ($schema['repairable'] ? 'repair_known_base' : ($schema['state'] === 'base' && ! $schema['ledger'] ? 'install' : 'blocked'));
        $plan = ['target' => $base['target'], 'actorId' => $actor->id, 'code_hash' => $base['code_hash'], 'migration' => TechnicalSupportProfileSchema::MIGRATION, 'schema' => $schema,
            'dependencies' => $dependencies, 'installed' => $schema['installed'], 'consistent' => $schema['consistent'], 'repairable' => $schema['repairable'], 'action' => $action,
            'ready' => ! in_array(false, $dependencies, true) && ($schema['consistent'] || $schema['repairable']) && $readiness['verified'] && $action !== 'blocked',
            'backupDate' => $readiness['date'], 'readiness_fingerprint' => $readiness['fingerprint'],
            'changes' => ['Acrescenta Suporte técnico aos papéis reconhecidos. Atribuir o perfil é uma operação posterior na Gestão de perfis.', 'Conserva contas, atribuições, oportunidades, incidentes e histórico.', 'Aplica apenas a actualização de perfis indicada neste destino.'],
            'rollback' => 'A reversão da actualização exige preservar atribuições de Suporte técnico, incluindo as históricas; o downgrade recusa removê-las.'];
        $commands = [];
        foreach (DB::table('audit_events')->where('source_system', 'portal-profile-installation')->where('action', 'technical-support-install')->where('actor_user_id', $actor->id)->get(['correlation_id', 'after_data']) as $event) {
            $data = json_decode($event->after_data, true, 512, JSON_THROW_ON_ERROR);
            $commands[] = ['key' => $event->correlation_id, 'code_hash' => $data['code_hash'] ?? null];
        }
        $plan['hash'] = hash('sha256', json_encode($plan, JSON_THROW_ON_ERROR));
        $plan['commands'] = $commands;
        $plan['mfa_confirmed'] = $this->access->mfa($actor);

        return $plan;
    }

    /** @param array<string,mixed> $input
     * @return array<string,mixed> */
    public function applySupport(User $actor, array $input): array
    {
        $this->authorize($actor, true);
        $data = Validator::make($input, ['hash' => 'required|string|size:64', 'confirm' => 'required|accepted', 'idempotency_key' => 'required|uuid', 'reason' => 'required|string|min:20|max:1000'])->validate();
        $data['idempotency_key'] = strtolower($data['idempotency_key']);
        $data['confirm'] = true;
        $data['reason'] = trim($data['reason']);
        Validator::make(['reason' => $data['reason']], ['reason' => 'required|string|min:20|max:1000'])->validate();

        return $this->receipt($actor, 'technical-support-install', $data, function () use ($actor, $data) {
            $plan = $this->supportPreview($actor);
            abort_unless(hash_equals($plan['hash'], $data['hash']), 409, 'O plano mudou. Consulte e compare a prévia actual.');
            abort_unless($plan['consistent'] || $plan['repairable'], 409, 'A estrutura dos perfis diverge da versão reconhecida. Preserve os dados e reconcilie a divergência.');
            abort_unless(! in_array(false, $plan['dependencies'], true), 422, 'Instale e confira primeiro a base dos perfis e as suas dependências.');
            $identity = ['actor_id' => $actor->id, 'command_key' => $data['idempotency_key'], 'target' => $plan['target']];
            if ($plan['installed']) {
                return [...$identity, 'installed' => true, 'changed' => false, 'migration' => TechnicalSupportProfileSchema::MIGRATION, 'code_hash' => $plan['code_hash'], 'mode' => 'already_installed', 'flags_changed' => false, 'privileges_granted' => false];
            }
            abort_unless($plan['ready'] && in_array($plan['action'], ['install', 'repair_known_base'], true), 422, 'Provas actuais de backup, restauro, ficheiros e compatibilidade são necessárias.');
            $previousFlag = config('portal_profiles.authenticated_installation');
            config(['portal_profiles.authenticated_installation' => true]);
            try {
                if ($plan['action'] === 'repair_known_base') {
                    (require database_path('migrations/'.TechnicalSupportProfileSchema::MIGRATION.'.php'))->up();
                } else {
                    abort_unless(Artisan::call('migrate', ['--path' => 'database/migrations/'.TechnicalSupportProfileSchema::MIGRATION.'.php', '--force' => true]) === 0, 500, 'A actualização dos perfis falhou.');
                }
            } finally {
                config(['portal_profiles.authenticated_installation' => $previousFlag]);
            }
            $after = app(TechnicalSupportProfileSchema::class)->inspect();
            abort_unless($after['installed'] && $after['consistent'], 500, 'A verificação da actualização falhou; a transacção será revertida.');

            return [...$identity, 'installed' => true, 'changed' => true, 'migration' => TechnicalSupportProfileSchema::MIGRATION, 'code_hash' => $plan['code_hash'], 'mode' => $plan['action'], 'flags_changed' => false, 'privileges_granted' => false];
        });
    }

    public function designatedBootstrap(User $actor): bool
    {
        $emails = config('portal_profiles.bootstrap_designated_emails', []);
        if (! config('portal.homologation_only', false) || count(array_unique($emails)) !== 2
            || ! in_array(strtolower(trim($actor->email)), $emails, true)) {
            return false;
        }
        $target = config('portal_profiles.bootstrap_designated_database', '');

        return $target !== '' && DB::selectOne('SELECT current_database() AS database')->database === $target;
    }

    public function authorize(User $actor, bool $write = false, bool $bootstrapOnly = false): void
    {
        abort_unless($actor->hasVerifiedEmail(), 403);
        if (Schema::hasTable('portal_role_assignments')) {
            abort_if(DB::table('portal_role_assignments')->where('user_id', $actor->id)->where('role', 'auditor')->whereNull('revoked_at')
                ->where('starts_at', '<=', now())->where(fn ($q) => $q->whereNull('expires_at')->orWhere('expires_at', '>', now()))->exists(), 403, 'A restrição do Auditor prevalece.');
        }
        $pair = Schema::hasTable('portal_superuser_pair') ? DB::table('portal_superuser_pair')->where('id', 1)->first() : null;
        abort_unless($pair ? in_array($actor->id, [(int) $pair->first_user_id, (int) $pair->second_user_id], true) : ($actor->can('manage-portal') || ($bootstrapOnly && $this->access->installed() && $this->designatedBootstrap($actor))), 403, 'Gestor de instalação ou titular designado necessário.');
        if ($write) {
            abort_unless($this->access->mfa($actor), 403, 'Conclua MFA nesta sessão; configuração de MFA isoladamente não autoriza a operação.');
        }
    }

    /** @return array<string,mixed> */
    public function preview(User $actor): array
    {
        $this->authorize($actor, false, true);
        $identity = DB::selectOne('SELECT current_database() AS database,inet_server_port() AS port');
        $ledger = DB::table('migrations')->where('migration', self::MIGRATION)->exists();
        $schema = [];
        foreach (self::TABLES as $table) {
            $schema[$table] = Schema::hasTable($table);
        }
        foreach (['users' => ['portal_access_revision'], 'opportunities' => ['owner_user_id', 'organization_id', 'workflow_context']] as $table => $columns) {
            foreach ($columns as $column) {
                $schema[$table.'.'.$column] = Schema::hasColumn($table, $column);
            }
        }
        $all = ! in_array(false, $schema, true);
        $none = ! in_array(true, $schema, true);
        $consistent = ($ledger && $all) || (! $ledger && $none);
        $installed = $ledger && $all;
        $dependencies = [
            'management_020000' => DB::table('migrations')->where('migration', '2026_10_09_020000_extend_opportunity_management')->exists() && Schema::hasColumn('opportunities', 'management_draft'),
            'resources_030000' => DB::table('migrations')->where('migration', '2026_10_09_030000_extend_opportunity_resources')->exists()
                && Schema::hasTable('opportunity_documents') && Schema::hasTable('opportunity_images') && Schema::hasTable('opportunity_location_drafts') && Schema::hasColumn('documents', 'storage_encryption'),
            'existing_identity_organization_audit' => Schema::hasTable('users') && Schema::hasTable('organizations') && Schema::hasTable('memberships') && Schema::hasTable('audit_events'),
        ];
        $code = $this->fingerprint();
        $readiness = $this->readiness($identity, $code);
        $evidence = $readiness['verified'];
        $ready = $consistent && ! in_array(false, $dependencies, true) && $evidence;
        $pair = $installed ? DB::table('portal_superuser_pair')->where('id', 1)->first() : null;
        $bootstrap = ['initialized' => $pair !== null, 'holders' => $pair ? [(int) $pair->first_user_id, (int) $pair->second_user_id] : [], 'version' => $pair?->version,
            'rule' => 'O primeiro titular apresenta o pedido com MFA e autorização de instalação; o segundo confirma numa operação separada com MFA. Sem autoaprovação, terceira pessoa obrigatória ou escolha automática.'];
        $pending = $installed && ! $pair ? DB::table('portal_security_approvals')->where('kind', 'bootstrap')->whereNull('consumed_at')->where('expires_at', '>', now())
            ->where(fn ($q) => $q->where('requested_by', $actor->id)->orWhere('subject_user_id', $actor->id))->first() : null;
        $bootstrap['pending'] = $pending ? ['approval_id' => $pending->id, 'confirmation_url' => '/management/profile-install/bootstrap/'.$pending->id, 'expires_at' => $pending->expires_at] : null;
        $plan = ['target' => $identity, 'code_hash' => $code, 'installed' => $installed, 'consistent' => $consistent, 'ledger' => $ledger, 'schema' => $schema,
            'dependencies' => $dependencies, 'ready' => $ready, 'backupDate' => $readiness['date'], 'readiness_fingerprint' => $readiness['fingerprint'], 'bootstrap' => $bootstrap,
            'path_190000_installed' => DB::table('migrations')->where('migration', '2026_10_09_190000_prepare_investor_path')->exists(),
            'technicalSupportUpdateUrl' => '/management/profile-install/technical-support',
            'migration' => self::MIGRATION, 'changes' => ['Quatro tabelas, uma coluna em users e três em opportunities; zero contas e zero atribuições automáticas.',
                '030000 precede esta ação; 190000 continua etapa posterior do percurso, sem dependência DDL desta migração.', 'Nenhuma flag ativada, dado publicado, titular escolhido ou privilégio legado removido.'],
            'rollback' => 'DDL e ledger são atómicos em PostgreSQL. Se vazio, down deve remover todas as colunas adicionadas; se houver uso/histórico, preservar e restaurar backup verificado, sem rollback destrutivo.'];
        $plan['hash'] = hash('sha256', json_encode($plan, JSON_THROW_ON_ERROR));

        return $plan;
    }

    /** @param array<string,mixed> $input
     * @return array<string,mixed> */
    public function apply(User $actor, array $input): array
    {
        $this->authorize($actor, true);
        $data = Validator::make($input, ['hash' => 'required|string|size:64', 'confirm' => 'required|accepted', 'idempotency_key' => 'required|uuid', 'reason' => 'required|string|min:20|max:1000'])->validate();

        return $this->receipt($actor, 'install', $data, function () use ($actor, $data) {
            $p = $this->preview($actor);
            abort_unless(hash_equals($p['hash'], $data['hash']), 409, 'Plano alterado; consulte a pré-visualização.');
            abort_unless($p['consistent'], 409, 'Ledger/schema incoerentes; recuperar antes de instalar.');
            if ($p['installed']) {
                return ['installed' => true, 'changed' => false, 'migration' => self::MIGRATION, 'bootstrap_required' => ! $p['bootstrap']['initialized'], 'flags_changed' => false];
            }
            abort_unless($p['ready'], 422, 'Dependências e provas atuais de backup/restauro/QA são necessárias.');
            config(['portal_profiles.authenticated_installation' => true]);
            try {
                abort_unless(Artisan::call('migrate', ['--path' => 'database/migrations/'.self::MIGRATION.'.php', '--force' => true]) === 0, 500, 'A instalação falhou; a transação é revertida.');
            } finally {
                config(['portal_profiles.authenticated_installation' => false]);
            }
            $after = $this->preview($actor);
            abort_unless($after['installed'] && $after['consistent'], 500, 'Verificação pós-instalação falhou; reverter transação.');

            return ['installed' => true, 'changed' => true, 'migration' => self::MIGRATION, 'bootstrap_required' => true, 'flags_changed' => false];
        });
    }

    /** @param array<string,mixed> $input
     * @return array<string,mixed> */
    public function bootstrap(User $actor, array $input): array
    {
        $this->authorize($actor, true, true);
        $data = Validator::make($input, ['hash' => 'required|string|size:64', 'confirm' => 'required|accepted', 'idempotency_key' => 'required|uuid',
            'first_user_id' => 'required|integer|exists:users,id', 'second_user_id' => 'required|integer|different:first_user_id|exists:users,id', 'reason' => 'required|string|min:20|max:1000'])->validate();
        abort_unless((int) $data['first_user_id'] === $actor->id, 403, 'O primeiro titular deve apresentar o seu próprio pedido; não é permitido inicializar terceiros.');

        return $this->receipt($actor, 'bootstrap-request', $data, function () use ($actor, $data) {
            $p = $this->preview($actor);
            abort_unless(hash_equals($p['hash'], $data['hash']), 409, 'Plano alterado.');
            abort_unless($p['installed'] && $p['consistent'] && ! in_array(false, $p['dependencies'], true) && ! $p['bootstrap']['initialized'], 409, 'Schema consistente instalado e dupla não inicializada necessários.');
            $second = User::whereKey($data['second_user_id'])->firstOrFail();
            if ($this->designatedBootstrap($actor)) {
                abort_unless($this->designatedBootstrap($second), 403, 'Use os dois titulares expressamente designados para este destino.');
            }
            foreach ([$actor, $second] as $user) {
                app(PortalSuperusers::class)->validateBootstrapHolder($user);
            }
            abort_if(DB::table('portal_security_approvals')->where('kind', 'bootstrap')->whereNull('consumed_at')->where('expires_at', '>', now())->exists(), 409, 'Já existe pedido pendente. Recupere-o; não duplique a cerimónia.');
            $id = (string) Str::uuid();
            DB::table('portal_security_approvals')->insert(['id' => $id, 'kind' => 'bootstrap', 'requested_by' => $actor->id, 'subject_user_id' => $second->id,
                'scope' => json_encode(['first_user_id' => $actor->id, 'second_user_id' => $second->id, 'code_hash' => $this->fingerprint(),
                    'target' => $p['target'], 'preview_hash' => $p['hash']], JSON_THROW_ON_ERROR), 'reason' => $data['reason'],
                'expires_at' => now()->addMinutes(15), 'created_at' => now(), 'updated_at' => now()]);

            return ['initialized' => false, 'pending' => true, 'approval_id' => $id, 'confirmation_url' => '/management/profile-install/bootstrap/'.$id,
                'holders' => [$actor->id, $second->id], 'expires_in_seconds' => 900, 'flags_changed' => false, 'privileges_granted' => false];
        });
    }

    /** Purpose-specific view; designation grants no general management access.
     * @return array<array-key, mixed>
     */
    public function bootstrapPreview(User $actor, string $id): array
    {
        abort_unless($actor->hasVerifiedEmail(), 403);
        $row = DB::table('portal_security_approvals')->where('id', $id)->where('kind', 'bootstrap')->first();
        abort_unless($row !== null, 404);
        if (! (in_array($actor->id, [(int) $row->requested_by, (int) $row->subject_user_id], true))) {
            abort(403, 'Apenas os dois titulares designados consultam este pedido.');
        }
        app(PortalSuperusers::class)->validateBootstrapHolder($actor);
        $scope = json_decode($row->scope, true, 512, JSON_THROW_ON_ERROR);
        $identity = DB::selectOne('SELECT current_database() AS database,inet_server_port() AS port');
        $current = $scope['code_hash'] === $this->fingerprint() && $scope['target']['database'] === $identity->database && (int) $scope['target']['port'] === (int) $identity->port;
        $view = ['approval_id' => $id, 'requested_by' => (int) $row->requested_by, 'second_user_id' => (int) $row->subject_user_id,
            'reason' => $row->reason, 'expires_at' => $row->expires_at, 'consumed' => $row->consumed_at !== null, 'code_current' => $current,
            'expired' => strtotime($row->expires_at) <= time(), 'target' => $identity,
            'can_confirm' => $actor->id === (int) $row->subject_user_id && $row->consumed_at === null && strtotime($row->expires_at) > time() && $current,
            'mfa_confirmed_in_session' => $this->access->mfa($actor)];
        $view['hash'] = hash('sha256', json_encode([$id, $row->requested_by, $row->subject_user_id, $row->scope, $row->reason, $row->expires_at], JSON_THROW_ON_ERROR));

        return $view;
    }

    /**
     * @param  array<array-key, mixed>  $input
     * @return array<array-key, mixed>
     */
    public function confirmBootstrap(User $actor, string $id, array $input): array
    {
        $view = $this->bootstrapPreview($actor, $id);
        abort_unless($actor->id === $view['second_user_id'] && $actor->id !== $view['requested_by'], 403, 'O pedido não pode ser autoaprovado.');
        abort_unless($this->access->mfa($actor), 403, 'Conclua MFA nesta sessão.');
        $data = Validator::make($input, ['hash' => 'required|string|size:64', 'confirm' => 'required|accepted', 'idempotency_key' => 'required|uuid', 'reason' => 'required|string|min:20|max:1000'])->validate();
        $data['approval_id'] = $id;

        return $this->receipt($actor, 'bootstrap-confirm', $data, function () use ($actor, $id, $data) {
            $row = DB::table('portal_security_approvals')->where('id', $id)->lockForUpdate()->first();
            $view = $this->bootstrapPreview($actor, $id);
            abort_unless(hash_equals($view['hash'], $data['hash']), 409, 'Pedido alterado; consulte novamente.');
            abort_unless($view['can_confirm'], 409, 'Pedido expirado, já consumido ou revisão/destino alterados.');
            $first = User::whereKey($row->requested_by)->firstOrFail();
            $this->authorize($first, false, true);
            $p = $this->preview($first);
            abort_unless($p['installed'] && $p['consistent'] && ! in_array(false, $p['dependencies'], true) && ! $p['bootstrap']['initialized'], 409, 'Dependências ou dupla alteradas.');
            app(PortalSuperusers::class)->validateBootstrapHolder($first);
            DB::table('portal_security_approvals')->where('id', $id)->update(['approved_by' => $actor->id, 'updated_at' => now()]);
            config(['portal_profiles.bootstrap_authorized' => true]);
            try {
                app(PortalSuperusers::class)->initialize($first, $actor, $actor, $id);
            } finally {
                config(['portal_profiles.bootstrap_authorized' => false]);
            }

            return ['initialized' => true, 'approval_id' => $id, 'holders' => [$first->id, $actor->id], 'version' => 1, 'flags_changed' => false];
        });
    }

    /** @param array<string,mixed> $data
     * @param callable():array<string,mixed> $operation
     * @return array<string,mixed> */
    private function receipt(User $actor, string $scope, array $data, callable $operation): array
    {
        return DB::transaction(function () use ($actor, $scope, $data, $operation) {
            DB::select('SELECT pg_advisory_xact_lock(101026, 40000)');
            $requestHash = hash('sha256', json_encode($data, JSON_THROW_ON_ERROR));
            $previous = DB::table('audit_events')->where('source_system', 'portal-profile-installation')->where('action', $scope)->where('actor_user_id', $actor->id)->where('correlation_id', $data['idempotency_key'])->first();
            if ($previous) {
                $receipt = json_decode($previous->after_data, true, 512, JSON_THROW_ON_ERROR);
                abort_unless(hash_equals($receipt['request_hash'], $requestHash), 409, 'Chave de repetição reutilizada com outro conteúdo.');

                return $receipt['result'];
            }
            $result = $operation();
            DB::table('audit_events')->insert(['source_system' => 'portal-profile-installation', 'entity_type' => 'installation', 'actor_user_id' => $actor->id, 'action' => $scope,
                'correlation_id' => $data['idempotency_key'], 'data_classification' => 'restricted', 'after_data' => json_encode(['request_hash' => $requestHash, 'reason' => $data['reason'], 'result' => $result, 'code_hash' => $this->fingerprint()], JSON_THROW_ON_ERROR)]);

            return $result;
        });
    }
}