<?php

use Illuminate\Contracts\Console\Kernel;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Schema;

require dirname(__DIR__).'/vendor/autoload.php';
$root = dirname(__DIR__);
$settings = json_decode(file_get_contents('C:/laragon/data/sgf-tempo/secrets/payables-demo-compras.json'), true, 32, JSON_THROW_ON_ERROR);
if (($settings['APP_ENV'] ?? '') !== 'payable-testing' || ($settings['DB_HOST'] ?? '') !== '127.0.0.1' || realpath($settings['HOST_ROOT'] ?? '') !== realpath($root)
    || ! preg_match('/^compras_receipts_test_([a-f0-9]{12})$/D', $settings['DB_DATABASE'] ?? '', $matches) || $settings['DB_USERNAME'] !== 'payable_qa_'.$matches[1]) {
    throw new LogicException('Wrong pilot destination.');
}
$app = require $root.'/bootstrap/app.php';
$app->make(Kernel::class)->bootstrap();
$base = DB::connection('pgsql')->getConfig();
unset($base['name']);
config(['database.connections.cancel_pilot_read' => [...$base, 'url' => null, 'host' => $settings['DB_HOST'], 'port' => $settings['DB_PORT'],
    'database' => $settings['DB_DATABASE'], 'username' => $settings['DB_USERNAME'], 'password' => $settings['DB_PASSWORD']]]);
$db = DB::connection('cancel_pilot_read');
$result = $db->transaction(function () use ($db, $settings) {
    $db->statement('SET TRANSACTION ISOLATION LEVEL REPEATABLE READ READ ONLY');
    $identity = $db->selectOne('select current_database() as db, current_user as role');
    if ($identity->db !== $settings['DB_DATABASE'] || $identity->role !== $settings['DB_USERNAME']) {
        throw new LogicException('Identity mismatch.');
    }
    $schema = Schema::connection('cancel_pilot_read');
    $installed = $schema->hasTable('order_cancellations');

    return ['checked_at' => gmdate('c'), 'environment' => 'http://127.0.0.1:8005', 'result' => 'passed',
        'schema_installed' => $installed, 'migration_applied' => $db->table('migrations')->where('migration', '2026_11_03_000003_create_order_cancellations')->exists(),
        'cancellations' => $installed ? $db->table('order_cancellations')->count() : 0,
        'policies' => $schema->hasTable('order_cancellation_policies') ? $db->table('order_cancellation_policies')->count() : 0,
        'mfa_accounts_enrolled' => $db->table('users')->where(fn ($q) => $q->whereNotNull('two_factor_secret')->orWhereNotNull('two_factor_recovery_codes')->orWhereNotNull('two_factor_confirmed_at'))->count(),
        'audit_permission_profiles' => $db->table('organization_profiles')->whereJsonContains('permissions', 'audit_metadata_read')->count(),
        'access_version' => (int) $db->table('organization_access')->where('tenant_id', 1)->value('version'), 'business_commands' => false];
});
if ($result['schema_installed'] || $result['migration_applied'] || $result['cancellations'] || $result['policies'] || $result['mfa_accounts_enrolled'] || $result['audit_permission_profiles']) {
    throw new LogicException('Pilot state differs from the authorized disabled scope.');
}
file_put_contents($root.'/docs/proofs/issued-order-cancellation-pilot.json', json_encode($result, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES).PHP_EOL);
echo 'Pilot inspected read-only: circuit uninstalled and disabled; no policies, cancellations or MFA enrollments.'.PHP_EOL;