7 lines
3.5 KiB
PHP
7 lines
3.5 KiB
PHP
<?php
|
|
$book=$argv[1]??'regression';require __DIR__.'/sgf-single-bootstrap.php';$decision=json_decode(file_get_contents($repo.'/docs/integration/sgf-stock-catalogue-access-proposal.json'),true);if(($decision['approved']??false)!==true||($decision['authorization']['decision']??null)!=='Autorizar o cadastro QA e os dois direitos apresentados'||$decision['grants_per_book']!==[['user_id'=>2,'permission'=>'stock.items.prepare'],['user_id'=>12,'permission'=>'stock.items.review']])throw new LogicException('Exact approved access required');
|
|
if($book==='8085'&&!is_file($s['root'].'/stock-catalogue-backup-pointer.json'))throw new LogicException('Selected baseline required first');
|
|
$sql=file_get_contents($repo.'/database/sql/stock_catalogue.sql');$sha=hash('sha256',$sql);$native->transaction(function()use($native,$sql,$sha,$tag){if(!$native->getSchemaBuilder()->hasTable('sc_catalogue_meta')){$native->unprepared($sql);$native->table('sc_catalogue_meta')->insert(['policy'=>'SGF-STOCK-CATALOGUE-QA-v1','composition'=>$tag,'source_hash'=>$sha]);}else{$meta=$native->table('sc_catalogue_meta')->where('policy','SGF-STOCK-CATALOGUE-QA-v1')->first();if(!$meta||$meta->composition!==$tag||$meta->source_hash!==$sha)throw new LogicException('Preserve different catalogue schema');}$native->statement('REVOKE ALL ON TABLE sc_catalogue_meta,sc_catalogue_versions,sc_catalogue_commands FROM PUBLIC');$native->statement('REVOKE ALL ON SEQUENCE sc_catalogue_versions_id_seq,sc_catalogue_commands_id_seq FROM PUBLIC');$native->statement('REVOKE ALL ON FUNCTION sc_catalogue_append_only() FROM PUBLIC');});
|
|
$count=0;$host->transaction(function()use($host,$decision,&$count){$constraint=$host->selectOne("SELECT pg_get_constraintdef(oid) value FROM pg_constraint WHERE conrelid='permission_grants'::regclass AND conname='permission_grants_scope_check'")->value;if(!str_contains($constraint,'stock.items.prepare')){if(!preg_match('/^CHECK \((.*)\)$/s',$constraint,$m))throw new LogicException('Scope constraint changed');$host->statement('ALTER TABLE permission_grants DROP CONSTRAINT permission_grants_scope_check');$host->statement("ALTER TABLE permission_grants ADD CONSTRAINT permission_grants_scope_check CHECK ((".$m[1].") OR (unit_id IS NOT NULL AND permission IN ('stock.items.prepare','stock.items.review')))");}foreach($decision['grants_per_book']as$g){$values=['tenant_id'=>1,'company_id'=>2,'unit_id'=>2]+$g;if($host->table('permission_grants')->where($values)->exists())continue;$host->table('permission_grants')->insert($values);App\Modules\Identity\Services\Audit::record('access.granted_on_creation',null,1,2,2,$g['user_id'],['permission'=>$g['permission'],'reason'=>$decision['authorization'],'limits'=>'Somente o cadastro QA aprovado; sem artigos anteriores ou movimentos.']);$count++;}});
|
|
$binding=['policy'=>'SGF-STOCK-CATALOGUE-QA-v1','composition'=>$tag,'scope'=>['tenant_id'=>1,'company_id'=>2,'unit_id'=>2],'preparer_host_id'=>2,'reviewer_host_id'=>12,'preparer_native_id'=>6,'reviewer_native_id'=>3];$file=$s['root'].'/stock-catalogue-binding.json';if(is_file($file)&&json_decode(file_get_contents($file),true)!==$binding)throw new LogicException('Preserve different binding');if(!is_file($file))file_put_contents($file,json_encode($binding,JSON_PRETTY_PRINT));file_put_contents($work.'/stock-catalogue-setup.json',json_encode(['passed'=>true,'book'=>$book,'new_grants'=>$count,'new_pg_grants'=>0,'new_users'=>0,'new_demo'=>false,'schema_sha256'=>$sha],JSON_PRETTY_PRINT));echo json_encode(['passed'=>true,'new_grants'=>$count,'proof'=>$work.'/stock-catalogue-setup.json']).PHP_EOL;
|