15,'permission'=>'general_ledger.statements.prepare'],['user_id'=>16,'permission'=>'general_ledger.statements.review']])throw new LogicException('Exact approved access required'); if($book==='8085'&&!is_file($s['root'].'/statements-backup-pointer.json'))throw new LogicException('Selected baseline required first'); $sql=file_get_contents($repo.'/database/sql/internal_statements.sql');$sha=hash('sha256',$sql);$native->transaction(function()use($native,$sql,$sha,$tag){if(!$native->getSchemaBuilder()->hasTable('fs_meta')){$native->unprepared($sql);$native->table('fs_meta')->insert(['policy'=>'SGF-INTERNAL-STATEMENTS-QA-v1','composition'=>$tag,'source_hash'=>$sha]);}else{$meta=$native->table('fs_meta')->where('policy','SGF-INTERNAL-STATEMENTS-QA-v1')->first();if(!$meta||$meta->composition!==$tag||$meta->source_hash!==$sha)throw new LogicException('Preserve different catalogue schema');}$native->statement('REVOKE ALL ON TABLE fs_meta,fs_versions,fs_commands,fs_results,fs_result_lines FROM PUBLIC');$native->statement('REVOKE ALL ON SEQUENCE fs_versions_id_seq,fs_commands_id_seq FROM PUBLIC');$native->statement('REVOKE ALL ON FUNCTION fs_append_only() FROM PUBLIC');}); $count=0;$host->transaction(function()use($host,$decision,&$count){$constraint=$host->selectOne("SELECT pg_get_constraintdef(oid) value FROM pg_constraint WHERE conrelid='permission_grants'::regclass AND conname='permission_grants_scope_check'")->value;if(!str_contains($constraint,'general_ledger.statements.prepare')){if(!preg_match('/^CHECK \((.*)\)$/s',$constraint,$m))throw new LogicException('Scope constraint changed');$host->statement('ALTER TABLE permission_grants DROP CONSTRAINT permission_grants_scope_check');$host->statement("ALTER TABLE permission_grants ADD CONSTRAINT permission_grants_scope_check CHECK ((".$m[1].") OR (unit_id IS NOT NULL AND permission IN ('general_ledger.statements.prepare','general_ledger.statements.review')))");}foreach($decision['grants_per_book']as$g){$values=['tenant_id'=>1,'company_id'=>2,'unit_id'=>2]+$g;if($host->table('permission_grants')->where($values)->exists())continue;$host->table('permission_grants')->insert($values);App\Modules\Identity\Services\Audit::record('access.granted_on_creation',null,1,2,2,$g['user_id'],['permission'=>$g['permission'],'reason'=>$decision['authorization'],'limits'=>'Somente correspondências/resultados internos parciais QA; sem contas/lançamentos novos.']);$count++;}}); file_put_contents($work.'/statements-setup.json',json_encode(['passed'=>true,'book'=>$book,'new_grants'=>$count,'new_pg_grants'=>0,'new_users'=>0,'new_demo'=>false,'schema_sha256'=>$sha],JSON_PRETTY_PRINT));echo json_encode(['passed'=>true,'new_grants'=>$count,'proof'=>$work.'/statements-setup.json']).PHP_EOL;