<?php

// QA-only production-bundle rehearsal. No active bootstrap, credentials output or identity designation.
use App\Models\User;
use App\Services\OrganizationCountryInstallation;
use Illuminate\Contracts\Console\Kernel;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Vite;
use Illuminate\Support\Str;
use Laravel\Fortify\Actions\ConfirmTwoFactorAuthentication;
use Laravel\Fortify\Actions\EnableTwoFactorAuthentication;
use Laravel\Fortify\Fortify;
use PragmaRX\Google2FA\Google2FA;

ini_set('zend.exception_ignore_args', '1');
$root = dirname(__DIR__);
$dir = $root.'/storage/app/private/investmoz-v2/portal-audit';
$link = json_decode(file_get_contents($dir.'/country-candidate-backup-latest.json'), true, 512, JSON_THROW_ON_ERROR);
$proof = json_decode(file_get_contents($link['path']), true, 512, JSON_THROW_ON_ERROR);
$stage = json_decode(file_get_contents($dir.'/country-production-stage-latest.json'), true, 512, JSON_THROW_ON_ERROR);
$target = $proof['restored_target'];
if (! $proof['restore_verified'] || ! $proof['files_verified'] || (int) $target['port'] !== 55441 || ! preg_match('/^country_candidate_\d{8}_\d{6}_test$/D', $target['database'])) {
    throw new RuntimeException('Verified isolated clone required');
}
$path = rawurldecode(parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?: '/');
// Mirror the web server's immutable asset serving, without Laravel/session startup for each font/chunk.
if (PHP_SAPI !== 'cli' && str_starts_with($path, '/build/')) {
    $asset = realpath($stage['build_directory'].'/'.substr($path, 7));
    $base = realpath($stage['build_directory']);
    if (! $asset || ! $base || ! str_starts_with(strtolower($asset), strtolower($base.DIRECTORY_SEPARATOR)) || ! is_file($asset)) {
        http_response_code(404);
        exit;
    }
    header('X-Investmoz-QA-Target: '.$target['database'].':'.$target['port']);
    $mime = ['js' => 'text/javascript', 'css' => 'text/css', 'woff2' => 'font/woff2', 'woff' => 'font/woff', 'svg' => 'image/svg+xml'];
    header('Content-Type: '.($mime[pathinfo($asset, PATHINFO_EXTENSION)] ?? 'application/octet-stream'));
    readfile($asset);
    exit;
}
$runtime = $link['directory'].'/browser-runtime';
$key = json_decode(file_get_contents($link['directory'].'/files-restored/runtime/effective-runtime.json'), true, 512, JSON_THROW_ON_ERROR);
require __DIR__.'/portal-qa-environment.php';
portalQaEnvironment('file');
foreach (['DB_DATABASE' => $target['database'], 'DB_USERNAME' => 'postgres', 'DB_PASSWORD' => '', 'APP_KEY' => $key['app_key'], 'APP_URL' => 'http://127.0.0.1:18101', 'SESSION_COOKIE' => 'country_candidate_18101_qa', 'APP_DEBUG' => 'false', 'APP_CONFIG_CACHE' => $runtime.'/framework/absent-config.php'] as $k => $v) {
    putenv($k.'='.$v);
    $_ENV[$k] = $_SERVER[$k] = $v;
}
require $root.'/vendor/autoload.php';
$app = require $root.'/bootstrap/app.php';
$app->useStoragePath($runtime);
foreach (['framework/sessions', 'framework/views', 'framework/cache', 'logs', 'app/private/investmoz-v2/organization-country-installation'] as $d) {
    if (! is_dir($runtime.'/'.$d)) {
        mkdir($runtime.'/'.$d, 0700, true);
    }
}
$app->make(Kernel::class)->bootstrap();
$identity = portalQaAssertTarget($target);
config(['app.cipher' => $key['cipher'], 'inertia.ssr.enabled' => false, 'portal.profile_access_enabled' => false, 'portal.opportunity_dashboard_access_enabled' => false,
    'portal.opportunity_specialized_drafts_enabled' => false, 'portal.opportunity_modular_profiles_qa_enabled' => false, 'investor-path.enabled' => false,
    'portal.legacy_content_qa_enabled' => false, 'portal.organization_country_enabled' => true, 'portal.managers' => ['country-production-installer@example.invalid']]);
config(['session.driver' => $proof['runtime']['session_driver'], 'session.files' => $runtime.'/framework/sessions', 'portal.qa_build_directory' => 'build']);
Vite::useHotFile($runtime.'/framework/hot-absent');
Vite::useBuildDirectory('build');
$relativeBuild = str_replace('\\', '/', substr($stage['build_directory'], strlen($root) + 1));
Vite::useManifestFilename('../../'.$relativeBuild.'/manifest.json');
$credentials = $runtime.'/actors-private.json';
if (PHP_SAPI === 'cli' && ($argv[1] ?? '') === 'prepare') {
    $actor = User::firstOrCreate(['email' => 'country-production-installer@example.invalid'], ['name' => 'Synthetic COUNTRY02 production QA installer', 'password' => Hash::make(Str::random(45))]);
    $password = Str::random(45);
    $actor->forceFill(['password' => Hash::make($password), 'email_verified_at' => now()])->save();
    app(EnableTwoFactorAuthentication::class)($actor, true);
    $secret = Fortify::currentEncrypter()->decrypt($actor->fresh()->two_factor_secret);
    app(ConfirmTwoFactorAuthentication::class)($actor->fresh(), (new Google2FA)->getCurrentOtp($secret));
    file_put_contents($credentials, json_encode(['id' => $actor->id, 'email' => $actor->email, 'password' => $password, 'totp_secret' => $secret], JSON_THROW_ON_ERROR));
    $cloneReadiness = [...$proof, 'target' => ['database' => $identity->database, 'port' => $identity->port], 'qa_passed' => true,
        'compatibility_verified' => true, 'reversal_verified' => true, 'scope' => 'QA rehearsal only, restored target; never an active readiness substitute'];
    file_put_contents($runtime.'/app/private/investmoz-v2/organization-country-installation/readiness.json', json_encode($cloneReadiness, JSON_THROW_ON_ERROR));
    file_put_contents($dir.'/country-production-browser-target.json', json_encode(['target' => $target, 'base' => 'http://127.0.0.1:18101', 'credentials_path' => $credentials, 'runtime' => $runtime, 'session_driver' => config('session.driver'), 'code_hash' => app(OrganizationCountryInstallation::class)->fingerprint()], JSON_THROW_ON_ERROR));
    echo json_encode(['result' => 'prepared', 'target' => $target, 'actor_synthetic' => true, 'mfa_normal_fortify_actions' => true, 'active_writes' => 0]).PHP_EOL;
    exit;
}
if (PHP_SAPI === 'cli' && ($argv[1] ?? '') === 'seed') {
    $actor = User::where('email', 'country-production-installer@example.invalid')->firstOrFail();
    $org = DB::table('organizations')->where('source_system', 'candidate-browser-qa-only')->where('name', 'Synthetic COUNTRY02 production bundle organization')->value('id');
    if ($org === null) {
        $org = (string) Str::uuid();
        DB::table('organizations')->insert(['id' => $org, 'name' => 'Synthetic COUNTRY02 production bundle organization', 'source_system' => 'candidate-browser-qa-only', 'organization_type' => 'private']);
    }
    if (! DB::table('memberships')->where('organization_id', $org)->where('user_id', $actor->id)->exists()) {
        DB::table('memberships')->insert(['organization_id' => $org, 'user_id' => $actor->id, 'role' => 'officer']);
    }
    file_put_contents($runtime.'/organization-qa.json', json_encode(['id' => $org], JSON_THROW_ON_ERROR));
    echo json_encode(['result' => 'seeded_qa_only', 'active_writes' => 0]).PHP_EOL;
    exit;
}
if (PHP_SAPI === 'cli') {
    throw new RuntimeException('Unknown QA command');
}
header('X-Investmoz-QA-Target: '.$identity->database.':'.$identity->port);
header('X-Investmoz-Candidate-Code: '.app(OrganizationCountryInstallation::class)->fingerprint());
if ($path !== '/' && is_file($root.'/public'.$path) && str_starts_with(realpath($root.'/public'.$path), realpath($root.'/public').DIRECTORY_SEPARATOR)) {
    return false;
}
$app->handleRequest(Request::capture());