64 lines
3.8 KiB
PHP
64 lines
3.8 KiB
PHP
<?php
|
|
|
|
// Evidence only: configuration loading and guarded PostgreSQL READ ONLY.
|
|
// No Laravel providers, HTTP requests, jobs, notifications or identity writes.
|
|
ini_set('zend.exception_ignore_args', '1');
|
|
$root = dirname(__DIR__);
|
|
require $root.'/vendor/autoload.php';
|
|
$app = require $root.'/bootstrap/app.php';
|
|
(new Illuminate\Foundation\Bootstrap\LoadEnvironmentVariables)->bootstrap($app);
|
|
(new Illuminate\Foundation\Bootstrap\LoadConfiguration)->bootstrap($app);
|
|
$db = config('database.connections.'.config('database.default'));
|
|
if ($db['driver'] !== 'pgsql' || ! empty($db['url'])
|
|
|| ! in_array($db['host'], ['127.0.0.1', 'localhost'], true)
|
|
|| (int) $db['port'] !== 5432 || $db['database'] !== 'investemoz') {
|
|
throw new RuntimeException('Unexpected destination; inspection refused.');
|
|
}
|
|
$pdo = new PDO('pgsql:host='.$db['host'].';port='.$db['port'].';dbname='.$db['database'],
|
|
$db['username'], $db['password'], [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
|
|
$pdo->exec('BEGIN READ ONLY');
|
|
$pair = $pdo->query('SELECT first_user_id, second_user_id FROM portal_superuser_pair WHERE id = 1')->fetch(PDO::FETCH_ASSOC);
|
|
$owners = $pdo->query("SELECT id, email, portal_access_revision, email_verified_at IS NOT NULL AS verified,
|
|
two_factor_secret IS NOT NULL AND two_factor_confirmed_at IS NOT NULL AS mfa_enrolled
|
|
FROM users WHERE id IN (2,13) ORDER BY id")->fetchAll(PDO::FETCH_ASSOC);
|
|
foreach ($owners as &$owner) {
|
|
$owner['existing_management_allowlist'] = $owner['verified']
|
|
&& in_array(strtolower($owner['email']), config('portal.managers', []), true);
|
|
$owner['superuser_pair_member'] = in_array((int) $owner['id'], array_map('intval', array_values($pair)), true);
|
|
unset($owner['email']);
|
|
}
|
|
unset($owner);
|
|
$pdo->exec('ROLLBACK');
|
|
$out = $root.'/outputs/investmoz-internal-designation-20261011';
|
|
$manifest = json_decode(file_get_contents($out.'/manifesto.json'), true, flags: JSON_THROW_ON_ERROR);
|
|
$proof = json_decode(file_get_contents($out.'/verificacao-final.json'), true, flags: JSON_THROW_ON_ERROR);
|
|
$hashErrors = [];
|
|
foreach ($manifest['files'] as $item) {
|
|
$path = $root.'/'.$item['path'];
|
|
$actual = is_file($path) ? hash_file('sha256', $path) : null;
|
|
if ($actual !== $item['before_sha256']) {
|
|
$hashErrors[] = ['path' => $item['path'], 'state' => 'destination_differs_from_prepared_base'];
|
|
}
|
|
}
|
|
$packageHash = hash_file('sha256', $out.'/'.$manifest['package']);
|
|
$manifestHash = hash_file('sha256', $out.'/manifesto.json');
|
|
$result = [
|
|
'at' => gmdate('c'), 'destination' => 'https://portal-investidor.test',
|
|
'database' => 'investemoz', 'port' => 5432, 'read_only' => true,
|
|
'revision' => $proof['revision'], 'owners' => $owners,
|
|
'package_hash_matches' => hash_equals($proof['package_sha256'], $packageHash),
|
|
'manifest_hash_matches' => hash_equals($proof['manifest_sha256'], $manifestHash),
|
|
'prepared_source_base_matches' => $hashErrors === [], 'differences' => $hashErrors,
|
|
'backup_verified_at' => $proof['backup']['verified_at'],
|
|
'backup_within_recorded_validity' => time() < strtotime($proof['backup']['valid_until']),
|
|
'backup_valid_until' => $proof['backup']['valid_until'],
|
|
'staff_registration_required_for_administrative_deployment' => false,
|
|
'administrative_flag' => (bool) config('portal.profile_administration_enabled', false),
|
|
'workflow_flag' => (bool) config('portal.profile_access_enabled', false),
|
|
'COUNTRY02' => (bool) config('portal.organization_country_enabled', false),
|
|
'source_writes' => 0, 'providers_booted' => false, 'messages_sent' => 0,
|
|
'no_mfa_secrets_or_session_tokens_recorded' => true,
|
|
];
|
|
file_put_contents($out.'/inspecao-proprietario-leitura.json', json_encode($result, JSON_PRETTY_PRINT|JSON_THROW_ON_ERROR).PHP_EOL);
|
|
echo json_encode($result, JSON_THROW_ON_ERROR).PHP_EOL;
|