<?php

// Synthetic actor for authenticated cartography, on the existing isolated restore only.
use App\Models\User;
use Illuminate\Contracts\Console\Kernel;
use Illuminate\Support\Facades\Crypt;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Str;

$root = dirname(__DIR__);
require_once $root.'/tools/portal-qa-environment.php';
$directory = $root.'/storage/app/private/investmoz-v2/portal-audit';
$backup = json_decode(file_get_contents(dirname($directory).'/opportunity-resources-backup-proof.json'), true, 512, JSON_THROW_ON_ERROR);
$target = $backup['restored_target'];
if (! $backup['restore_verified'] || ! preg_match('/^desk_restore_\d{8}_\d{6}_test$/D', $target['database']) || (int) $target['port'] !== 55441) {
    throw new RuntimeException('Verified QA restore only.');
}
$target = portalQaEnvironment();
require $root.'/vendor/autoload.php';
$app = require $root.'/bootstrap/app.php';
$app->make(Kernel::class)->bootstrap();
$identity = portalQaAssertTarget($target);
$file = $directory.'/i0-qa-actor-private.json';
$credentials = is_file($file) ? json_decode(file_get_contents($file), true) : ['email' => 'geo-manager-qa@example.invalid', 'password' => 'QA-'.Str::uuid(), 'totp_secret' => 'JBSWY3DPEHPK3PXP'];
$actor = User::firstOrCreate(['email' => $credentials['email']], ['name' => 'Synthetic cartography manager QA', 'password' => Hash::make($credentials['password'])]);
$actor->forceFill(['email_verified_at' => now(), 'two_factor_confirmed_at' => now(), 'two_factor_secret' => Crypt::encrypt($credentials['totp_secret']), 'two_factor_recovery_codes' => Crypt::encrypt('[]')])->save();
file_put_contents($file, json_encode($credentials, JSON_THROW_ON_ERROR));
chmod($file, 0600);
echo json_encode(['qa_target' => $identity, 'actor_id' => $actor->id, 'mfa_configured' => true, 'credentials' => 'retained privately, not exported', 'active_writes' => 0]).PHP_EOL;