5 lines
3.6 KiB
PHP
5 lines
3.6 KiB
PHP
<?php
|
|
$book=$argv[1]??'regression';require __DIR__.'/sgf-ledger-proof-bootstrap.php';$p=json_decode(file_get_contents($repo.'/docs/integration/sgf-human-resources-personnel-access-proposal.json'),true);if(($p['approved']??false)!==true||($p['authorization']['decision']??null)!=='Autorizar o bloco e as30 concessões QA apresentadas')throw new LogicException('Exact access approval required');if($book==='8085'&&!is_file($s['root'].'/hr-personnel-backup-pointer.json'))throw new LogicException('Original baseline required');$expected=[];foreach(['hr_prepare','hr_review','hr_read']as$role)foreach(['contracts','attendance','leave']as$area){$expected[]=['profile_key'=>$role,'permission'=>'human_resources.'.$area.'.view'];if($role!=='hr_read')$expected[]=['profile_key'=>$role,'permission'=>'human_resources.'.$area.'.'.($role==='hr_prepare'?'prepare':'review')];}if($p['grants_per_book']!==$expected||$p['scope']!==['tenant_id'=>1,'company_id'=>2,'unit_id'=>2])throw new LogicException('Do not widen reviewed matrix');$sql=file_get_contents($repo.'/database/sql/hr_personnel.sql');$sha=hash('sha256',$sql);$rights=$p['new_host_rights'];$count=0;$accessHash=hash('sha256',Tempo\Finance\Payables\Payables::canonical(['scope'=>$p['scope'],'grants'=>$expected]));
|
|
$host->transaction(function()use($host,$p,$sql,$sha,$rights,$tag,$accessHash,&$count){if(!$host->getSchemaBuilder()->hasTable('hp_meta')){$host->unprepared($sql);$host->table('hp_meta')->insert(['policy'=>'SGF-HR-PERSONNEL-QA-v1','composition'=>$tag,'source_hash'=>$sha]);}else{$m=$host->table('hp_meta')->first();if($m->composition!==$tag||$m->source_hash!==$sha)throw new LogicException('Preserve different schema');}$host->statement('REVOKE ALL ON TABLE hp_meta,hp_versions,hp_commands FROM PUBLIC');$host->statement('REVOKE ALL ON SEQUENCE hp_versions_id_seq,hp_commands_id_seq FROM PUBLIC');$host->statement('REVOKE ALL ON FUNCTION hp_append_only() FROM PUBLIC');$pin=App\Shared\Installation\HumanResourcesProfiles::fingerprint(App\Shared\Installation\HumanResourcesProfiles::policy());$profiles=$host->table('hr_qa_profiles')->get()->keyBy('profile_key');if($profiles->count()!==3||!$profiles->every(fn($r)=>hash_equals($pin,$r->source_hash)))throw new LogicException('Original profile pin changed');$old=$host->selectOne("SELECT pg_get_constraintdef(oid) d FROM pg_constraint WHERE conrelid='permission_grants'::regclass AND conname='permission_grants_scope_check'")->d;if(!str_contains($old,'human_resources.contracts.view')){if(!preg_match('/^CHECK \((.*)\)$/s',$old,$m))throw new LogicException('Unexpected scope check');$list=implode(',',array_map(fn($r)=>"'".$r."'",$rights));$host->statement('ALTER TABLE permission_grants DROP CONSTRAINT permission_grants_scope_check');$host->statement('ALTER TABLE permission_grants ADD CONSTRAINT permission_grants_scope_check CHECK (('.$m[1].') OR (unit_id IS NOT NULL AND permission IN('.$list.')))');}foreach($p['grants_per_book']as$g){$q=$p['scope']+['user_id'=>$profiles[$g['profile_key']]->user_id,'permission'=>$g['permission']];if($host->table('permission_grants')->where($q)->exists())continue;$host->table('permission_grants')->insert($q);App\Modules\Identity\Services\Audit::record('access.granted_on_creation',null,1,2,2,$q['user_id'],['permission'=>$q['permission'],'reason'=>'Bloco contratos/assiduidade/férias QA expressamente autorizado11/11.']);$count++;}});
|
|
file_put_contents($work.'/hp-setup.json',json_encode(['passed'=>true,'book'=>$book,'new_grants'=>$count,'new_profiles'=>0,'new_pg_grants'=>0,'schema_sha256'=>$sha,'access_sha256'=>$accessHash],JSON_PRETTY_PRINT));echo json_encode(['passed'=>true,'book'=>$book,'new_grants'=>$count,'proof'=>$work.'/hp-setup.json']).PHP_EOL;
|