<?php

namespace App\Modules\Identity\Services;

use Illuminate\Support\Facades\DB;

final class LocalDatabaseGuard
{
    public static function allows(): bool
    {
        if (! app()->environment('local')) { return false; }
        $connection = config('database.default');
        $config = config("database.connections.$connection", []);
        foreach (['driver' => 'pgsql', 'host' => '127.0.0.1', 'port' => '55432', 'database' => 'sgf_tempo_dev', 'username' => 'sgf_dev_app'] as $key => $expected) {
            if ((string) ($config[$key] ?? '') !== $expected) { return false; }
        }
        if (! empty($config['url']) || ! empty($config['read']) || ! empty($config['write'])) { return false; }
        try {
            $identity = DB::selectOne('SELECT current_database() AS db, current_user AS role, rolsuper, rolcreatedb, rolcreaterole, rolbypassrls FROM pg_roles WHERE rolname = current_user');
            return $identity->db === 'sgf_tempo_dev' && $identity->role === 'sgf_dev_app'
                && ! $identity->rolsuper && ! $identity->rolcreatedb && ! $identity->rolcreaterole && ! $identity->rolbypassrls;
        } catch (\Throwable) { return false; }
    }
}