<?php

use App\Services\Malware\MalwareScanner;
use Illuminate\Contracts\Console\Kernel;
use Illuminate\Support\Facades\DB;

$root = dirname(__DIR__);
require $root.'/vendor/autoload.php';
require __DIR__.'/portal-qa-environment.php';
$target = portalQaEnvironment();
$app = require $root.'/bootstrap/app.php';
$app->make(Kernel::class)->bootstrap();
$identity = portalQaAssertTarget($target);
$dir = $root.'/storage/app/private/investmoz-v2/portal-audit';
$file = $dir.'/consumer-land-derived-20261010.pdf';
throw_unless(is_file($file), RuntimeException::class, 'Browser derivative required.');
$before = hash_file('sha256', $file);
$scanner = app(MalwareScanner::class);
$health = $scanner->health();
$scan = $scanner->scan($file, filesize($file), storage_path('app/private'));
$scan['signatures_at'] = $scan['signatures_at']?->format(DATE_ATOM);
$health['signatures_at'] = $health['signatures_at']?->format(DATE_ATOM);
throw_unless(hash_file('sha256', $file) === $before, RuntimeException::class, 'Derivative changed during scan.');
$originals = DB::transaction(function () use ($dir) {
    DB::statement('SET TRANSACTION READ ONLY');
    $previous = json_decode(file_get_contents($dir.'/independent-documents-http-qa.json'), true, 512, JSON_THROW_ON_ERROR);
    $rows = [];
    foreach ($previous['land'] as $original) {
        $doc = DB::table('land_assistance_documents as l')->join('documents as d', 'd.id', '=', 'l.document_id')->where('l.id', $original['attachment_id'])->first(['d.id', 'd.sha256', 'd.malware_scanned_sha256', 'd.malware_engine', 'd.malware_scan_status']);
        throw_unless($doc && trim($doc->sha256) === $original['sha256'] && $doc->malware_scanned_sha256 === $original['sha256'], RuntimeException::class, 'Original hash changed.');
        $rows[] = ['document_id' => $doc->id, 'sha256' => trim($doc->sha256), 'preserved' => true, 'previous_scan_preserved' => $doc->malware_scan_status === 'clean'];
    }

    return $rows;
});
$proof = ['at' => gmdate('c'), 'target' => $identity, 'result' => $scan['result'] === 'clean' && $scan['engine'] === 'ClamAV' ? 'passed_real_derivative_scan' : 'scan_pending', 'derivative' => ['file' => basename($file), 'sha256' => $before, 'bytes' => filesize($file), 'scan' => $scan], 'health' => $health, 'originals' => $originals, 'active_writes' => 0, 'database_write' => false, 'published' => false, 'source_private_permissions' => 'consumer-documents-chromium-20261010.json'];
file_put_contents($dir.'/consumer-pdf-scan-qa.json', json_encode($proof, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR));
echo json_encode(['result' => $proof['result'], 'target' => $identity, 'originals_preserved' => count($originals), 'scan' => $scan['result'], 'active_writes' => 0]).PHP_EOL;