<?php

// Evidence only: configuration loading and guarded PostgreSQL READ ONLY.
// No Laravel providers, HTTP requests, jobs, notifications or identity writes.
ini_set('zend.exception_ignore_args', '1');
$root = dirname(__DIR__);
require $root.'/vendor/autoload.php';
$app = require $root.'/bootstrap/app.php';
(new Illuminate\Foundation\Bootstrap\LoadEnvironmentVariables)->bootstrap($app);
(new Illuminate\Foundation\Bootstrap\LoadConfiguration)->bootstrap($app);
$db = config('database.connections.'.config('database.default'));
if ($db['driver'] !== 'pgsql' || ! empty($db['url'])
    || ! in_array($db['host'], ['127.0.0.1', 'localhost'], true)
    || (int) $db['port'] !== 5432 || $db['database'] !== 'investemoz') {
    throw new RuntimeException('Unexpected destination; inspection refused.');
}
$pdo = new PDO('pgsql:host='.$db['host'].';port='.$db['port'].';dbname='.$db['database'],
    $db['username'], $db['password'], [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$pdo->exec('BEGIN READ ONLY');
$pair = $pdo->query('SELECT first_user_id, second_user_id FROM portal_superuser_pair WHERE id = 1')->fetch(PDO::FETCH_ASSOC);
$owners = $pdo->query("SELECT id, email, portal_access_revision, email_verified_at IS NOT NULL AS verified,
    two_factor_secret IS NOT NULL AND two_factor_confirmed_at IS NOT NULL AS mfa_enrolled
    FROM users WHERE id IN (2,13) ORDER BY id")->fetchAll(PDO::FETCH_ASSOC);
foreach ($owners as &$owner) {
    $owner['existing_management_allowlist'] = $owner['verified']
        && in_array(strtolower($owner['email']), config('portal.managers', []), true);
    $owner['superuser_pair_member'] = in_array((int) $owner['id'], array_map('intval', array_values($pair)), true);
    unset($owner['email']);
}
unset($owner);
$pdo->exec('ROLLBACK');
$out = $root.'/outputs/investmoz-internal-designation-20261011';
$manifest = json_decode(file_get_contents($out.'/manifesto.json'), true, flags: JSON_THROW_ON_ERROR);
$proof = json_decode(file_get_contents($out.'/verificacao-final.json'), true, flags: JSON_THROW_ON_ERROR);
$hashErrors = [];
foreach ($manifest['files'] as $item) {
    $path = $root.'/'.$item['path'];
    $actual = is_file($path) ? hash_file('sha256', $path) : null;
    if ($actual !== $item['before_sha256']) {
        $hashErrors[] = ['path' => $item['path'], 'state' => 'destination_differs_from_prepared_base'];
    }
}
$packageHash = hash_file('sha256', $out.'/'.$manifest['package']);
$manifestHash = hash_file('sha256', $out.'/manifesto.json');
$result = [
    'at' => gmdate('c'), 'destination' => 'https://portal-investidor.test',
    'database' => 'investemoz', 'port' => 5432, 'read_only' => true,
    'revision' => $proof['revision'], 'owners' => $owners,
    'package_hash_matches' => hash_equals($proof['package_sha256'], $packageHash),
    'manifest_hash_matches' => hash_equals($proof['manifest_sha256'], $manifestHash),
    'prepared_source_base_matches' => $hashErrors === [], 'differences' => $hashErrors,
    'backup_verified_at' => $proof['backup']['verified_at'],
    'backup_within_recorded_validity' => time() < strtotime($proof['backup']['valid_until']),
    'backup_valid_until' => $proof['backup']['valid_until'],
    'staff_registration_required_for_administrative_deployment' => false,
    'administrative_flag' => (bool) config('portal.profile_administration_enabled', false),
    'workflow_flag' => (bool) config('portal.profile_access_enabled', false),
    'COUNTRY02' => (bool) config('portal.organization_country_enabled', false),
    'source_writes' => 0, 'providers_booted' => false, 'messages_sent' => 0,
    'no_mfa_secrets_or_session_tokens_recorded' => true,
];
file_put_contents($out.'/inspecao-proprietario-leitura.json', json_encode($result, JSON_PRETTY_PRINT|JSON_THROW_ON_ERROR).PHP_EOL);
echo json_encode($result, JSON_THROW_ON_ERROR).PHP_EOL;