30 lines
2.6 KiB
PHP
30 lines
2.6 KiB
PHP
<?php
|
|
|
|
// Configuration and capability inspection only: no providers, session or active DDL.
|
|
use Illuminate\Foundation\Bootstrap\LoadConfiguration;
|
|
use Illuminate\Foundation\Bootstrap\LoadEnvironmentVariables;
|
|
|
|
$root = dirname(__DIR__);
|
|
require $root.'/vendor/autoload.php';
|
|
$app = require $root.'/bootstrap/app.php';
|
|
(new LoadEnvironmentVariables)->bootstrap($app);
|
|
(new LoadConfiguration)->bootstrap($app);
|
|
$c = config('database.connections.'.config('database.default'));
|
|
throw_unless($c['driver'] === 'pgsql' && empty($c['url']) && (int) $c['port'] === 5432 && $c['database'] === 'investemoz', RuntimeException::class, 'Exact read-only source required');
|
|
$pdo = new PDO('pgsql:host='.$c['host'].';port='.$c['port'].';dbname='.$c['database'], $c['username'], $c['password'], [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
|
|
$pdo->exec('BEGIN READ ONLY');
|
|
$identity = $pdo->query("SELECT current_database() AS database,inet_server_port() AS port,current_setting('transaction_read_only') AS read_only")->fetch(PDO::FETCH_ASSOC);
|
|
throw_unless($identity['database'] === 'investemoz' && (int) $identity['port'] === 5432 && $identity['read_only'] === 'on', RuntimeException::class, 'Source refused');
|
|
$capability = $pdo->query("SELECT ((SELECT rolsuper FROM pg_roles WHERE rolname=current_user) OR pg_has_role(current_user,(SELECT tableowner FROM pg_tables WHERE schemaname='public' AND tablename='organizations'),'USAGE')) AS alter_organizations,
|
|
has_schema_privilege(current_user,'public','USAGE') AS schema_usage,
|
|
has_table_privilege(current_user,'public.migrations','SELECT,INSERT') AS migration_ledger,
|
|
has_table_privilege(current_user,'public.audit_events','SELECT,INSERT') AS audit,
|
|
has_table_privilege(current_user,'public.users','SELECT') AS users_read,
|
|
has_table_privilege(current_user,'public.memberships','SELECT') AS memberships_read")->fetch(PDO::FETCH_ASSOC);
|
|
$pdo->exec('ROLLBACK');
|
|
throw_unless(! in_array(false, $capability, true), RuntimeException::class, 'Active service-role capability missing');
|
|
$result = ['result' => 'passed', 'at' => gmdate('c'), 'identity' => $identity, 'capability' => $capability, 'active_writes' => 0,
|
|
'scope' => 'Existing database service role inspected; no privileges assigned. Dump includes ownership/ACL; QA restore intentionally uses --no-owner --no-privileges, not a rehearsal of changing active grants.'];
|
|
file_put_contents($root.'/storage/app/private/investmoz-v2/portal-audit/country-target-capabilities-20261011.json', json_encode($result, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR));
|
|
echo json_encode($result, JSON_THROW_ON_ERROR).PHP_EOL;
|