<?php
// Read-only verification of the two user-designated destination accounts.
ini_set('zend.exception_ignore_args', '1');
set_exception_handler(static function (Throwable $e): void {
    fwrite(STDERR, 'Designation verification stopped: '.get_class($e).PHP_EOL);
    exit(1);
});
$root = dirname(__DIR__);
require $root.'/vendor/autoload.php';
$app = require $root.'/bootstrap/app.php';
(new Illuminate\Foundation\Bootstrap\LoadEnvironmentVariables)->bootstrap($app);
(new Illuminate\Foundation\Bootstrap\LoadConfiguration)->bootstrap($app);
$c = config('database.connections.'.config('database.default'));
throw_unless($c['driver'] === 'pgsql' && empty($c['url'])
    && in_array($c['host'], ['127.0.0.1', 'localhost'], true)
    && (int) $c['port'] === 5432 && $c['database'] === 'investemoz', RuntimeException::class);
$pdo = new PDO('pgsql:host='.$c['host'].';port=5432;dbname=investemoz', $c['username'], $c['password'], [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$pdo->exec('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
throw_unless($pdo->query('SELECT current_database()')->fetchColumn() === 'investemoz'
    && (int) $pdo->query('SELECT inet_server_port()')->fetchColumn() === 5432, RuntimeException::class);
$designatedEmails = ['nala@tempo.co.mz', 'onala@me.com'];
$statement = $pdo->prepare('SELECT id,email,email_verified_at IS NOT NULL AS verified,two_factor_secret IS NOT NULL AS mfa_present,two_factor_confirmed_at IS NOT NULL AS mfa_confirmed FROM users WHERE lower(email) IN (?,?) ORDER BY id');
$statement->execute($designatedEmails);
$rows = $statement->fetchAll(PDO::FETCH_ASSOC);
$accounts = [];
foreach ($designatedEmails as $email) {
    $row = collect($rows)->first(fn ($row) => strtolower($row['email']) === $email);
    $accounts[] = $row ? [
        'id' => (int) $row['id'], 'exists_in_destination' => true, 'email' => $row['email'],
        'email_verified' => (bool) $row['verified'], 'mfa_configured' => (bool) $row['mfa_present'],
        'mfa_confirmed' => (bool) $row['mfa_confirmed'],
        'current_legacy_manager_authorized' => in_array(strtolower($row['email']), array_map('strtolower', config('portal.managers', [])), true),
    ] : ['email' => $email, 'exists_in_destination' => false];
}
$ledger = $pdo->query("SELECT migration FROM migrations WHERE migration IN ('2026_10_09_030000_extend_opportunity_resources','2026_10_10_040000_create_portal_profile_authorization','2026_10_10_050000_extend_organization_country') ORDER BY migration")->fetchAll(PDO::FETCH_COLUMN);
$count = (int) $pdo->query('SELECT count(*) FROM users')->fetchColumn();
$pdo->exec('ROLLBACK');
$proof = ['at' => gmdate('c'), 'target' => 'investemoz:5432', 'read_only' => true,
    'initial_user_supplied_ids' => [3,18], 'user_confirmed_destination_emails' => $designatedEmails,
    'accounts' => $accounts, 'existing_account_count' => $count,
    'installed' => $ledger, 'country_enabled' => (bool) config('portal.organization_country_enabled'),
    'profile_enabled' => (bool) config('portal.profile_access_enabled'), 'active_writes' => 0,
    'designation_is_not_bootstrap_or_role_assignment' => true, 'secrets_selected_or_output' => false];
file_put_contents($root.'/storage/app/private/investmoz-v2/portal-audit/consolidated-designations-readonly.json', json_encode($proof, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR));
echo json_encode($proof, JSON_THROW_ON_ERROR).PHP_EOL;