param(
    [string]$DockerContext = "docker-prod",
    [string]$PostgresContainer = "assistant-postgres-1"
)

$ErrorActionPreference = "Stop"

$environment = docker --context $DockerContext inspect --format '{{range .Config.Env}}{{println .}}{{end}}' $PostgresContainer
$userLine = $environment | Where-Object { $_.StartsWith("POSTGRES_USER=") } | Select-Object -First 1
$databaseLine = $environment | Where-Object { $_.StartsWith("POSTGRES_DB=") } | Select-Object -First 1
if (-not $userLine -or -not $databaseLine) { throw "PostgreSQL bootstrap identity is unavailable" }
$user = $userLine.Substring("POSTGRES_USER=".Length)
$database = $databaseLine.Substring("POSTGRES_DB=".Length)

$previousErrorAction = $ErrorActionPreference
$ErrorActionPreference = "Continue"
$denied = "SET ROLE continuity_role; INSERT INTO work.tasks (task_id, goal_id, scope_id, revision) VALUES ('acl-negative-probe', 'goal', 'scope', 1);" | docker --context $DockerContext exec -i $PostgresContainer psql -U $user -d $database -v ON_ERROR_STOP=1 2>&1
$deniedExitCode = $LASTEXITCODE
$ErrorActionPreference = $previousErrorAction
if ($deniedExitCode -eq 0) { throw "cross-owner write unexpectedly succeeded" }

"SET ROLE work_role; SELECT count(*) FROM work.tasks;" | docker --context $DockerContext exec -i $PostgresContainer psql -U $user -d $database -v ON_ERROR_STOP=1 | Out-Null
if ($LASTEXITCODE -ne 0) { throw "owner-local read failed" }

Write-Output "INV-OWN-001 owner ACL verification: PASS"