<?php

// Explicit additive installation into the two named synthetic hosts; no real settings changed.
$mode = $argv[1] ?? ''; $tag = $argv[2] ?? '';
if (! in_array($mode, ['compras', 'sgf'], true) || ! in_array($tag, ['proof', 'demo'], true)) throw new LogicException('Named synthetic host required.');
$settings = json_decode(file_get_contents('C:/laragon/data/sgf-tempo/secrets/payables-'.$tag.'-'.$mode.'.json'), true, 32, JSON_THROW_ON_ERROR);
foreach ($settings as $k => $v) { putenv($k.'='.$v); $_ENV[$k] = $_SERVER[$k] = $v; }
require $settings['HOST_ROOT'].'/vendor/autoload.php';
$app = require $settings['HOST_ROOT'].'/bootstrap/app.php'; $app->make(\Illuminate\Contracts\Console\Kernel::class)->bootstrap();
use Illuminate\Support\Facades\DB;
use Tempo\Finance\Payables\SettlementSchema;
$db = DB::connection();
if (! preg_match('/^(compras_receipts_test_|payable_sgf_)[a-f0-9]{12}$/D', $db->getDatabaseName()) || $db->getConfig('host') !== '127.0.0.1'
    || $db->selectOne('select current_database() as d')->d !== $settings['DB_DATABASE'] || ! app()->environment('payable-testing')) throw new LogicException('Synthetic database guard refused.');
$role = $db->selectOne('select rolsuper,rolcreatedb,rolcreaterole from pg_roles where rolname=current_user');
if ($role->rolsuper || $role->rolcreatedb || $role->rolcreaterole) throw new LogicException('Restricted QA role required.');
$existing = array_filter(SettlementSchema::TABLES, fn ($t) => $db->getSchemaBuilder()->hasTable($t));
if ($existing && count($existing) !== count(SettlementSchema::TABLES)) throw new LogicException('Incomplete schema, nothing repaired.');
if (! $existing) SettlementSchema::install();
$fixture = json_decode(file_get_contents($settings['PAYABLE_ACCESS_FILE']), true, 32, JSON_THROW_ON_ERROR);
$grants = 0;
DB::transaction(function () use ($fixture, &$grants): void {
    foreach (['preparacao' => ['payments_view', 'payment_prepare', 'allocation_prepare'], 'validacao' => ['payments_view', 'payment_confirm', 'allocation_confirm'], 'consulta' => ['payments_view']] as $role => $actions) {
        $account = $fixture['accounts'][$role];
        $user = \App\Models\User::findOrFail($account['id']);
        if ($user->email !== $role.'-obrigacoes@example.test') throw new LogicException('Existing synthetic identity required; no accounts created.');
        $person = DB::table('pa_access')->where($fixture['scope'])->where(['user_id' => $user->id, 'action' => 'view'])->value('person');
        if ($person !== 'synthetic-person-'.$role) throw new LogicException('Synthetic person mapping differs.');
        foreach ($actions as $action) $grants += DB::table('pa_access')->insertOrIgnore($fixture['scope'] + ['user_id' => $user->id, 'person' => $person, 'action' => $action]);
    }
});
echo json_encode(['host' => $mode, 'isolated' => true, 'schema_tables' => count(SettlementSchema::TABLES), 'synthetic_grants_added' => $grants,
    'accounts_created' => 0, 'documents_changed' => false, 'payments_created' => 0], JSON_THROW_ON_ERROR).PHP_EOL;