<?php
require __DIR__.'/../vendor/autoload.php';
$app=require __DIR__.'/../bootstrap/app.php'; $app->make(\Illuminate\Contracts\Console\Kernel::class)->bootstrap();
if (!\App\Modules\Identity\Services\LocalDatabaseGuard::allows()) throw new RuntimeException('Own local development database required.');
$args=array_values(array_filter(array_slice($argv,1),fn($v)=>$v!=='--apply'));
if(count($args)!==4 || array_filter($args,fn($v)=>!ctype_digit($v))) throw new RuntimeException('Usage: service-fiscal-access.php proposer validator company unit [--apply]; specific confirmation required.');
[$proposer,$validator,$companyId,$unitId]=array_map('intval',$args);
if($proposer===$validator) throw new RuntimeException('Distinct proposer and validator required.');
$db=\Illuminate\Support\Facades\DB::class;
$preview=function() use($proposer,$validator,$companyId,$unitId,$db) {
    $company=$db::table('companies')->where('id',$companyId)->first(['id','tenant_id','name']);
    if(!$company) throw new RuntimeException('Existing company required.');
    $unit=$db::table('units')->where('id',$unitId)->where('company_id',$companyId)->where('tenant_id',$company->tenant_id)->first(['id','name']);
    if(!$unit) throw new RuntimeException('Existing unit required.');
    $accounts=$db::table('users')->whereIn('id',[$proposer,$validator])->orderBy('id')->get(['id','name','email']);
    if($accounts->count()!==2) throw new RuntimeException('Two existing accounts required.');
    $operations=[];
    foreach($accounts as $a) {
        if(!$db::table('company_memberships')->where('user_id',$a->id)->where('tenant_id',$company->tenant_id)->where('company_id',$companyId)->exists()) throw new RuntimeException('No membership inference allowed.');
        foreach(['company.view','services.view'] as $right) app(\App\Modules\Identity\Services\Permissions::class)->require($a->id,$company->tenant_id,$companyId,$right);
        app(\App\Modules\Identity\Services\Permissions::class)->require($a->id,$company->tenant_id,$companyId,'unit.view',$unitId);
        foreach(['view',$a->id===$proposer?'propose':'approve'] as $action) $operations[]=['user_id'=>$a->id,'tenant_id'=>$company->tenant_id,'company_id'=>$companyId,'unit_id'=>null,'permission'=>'service_fiscal.'.$action];
        if($a->id===$proposer) $operations[]=['user_id'=>$a->id,'tenant_id'=>$company->tenant_id,'company_id'=>$companyId,'unit_id'=>$unitId,'permission'=>'service_fiscal.calculate'];
    }
    return ['accounts'=>$accounts,'company'=>$company,'unit'=>$unit,'proposed_grants'=>$operations,'applied'=>false];
};
if(!in_array('--apply',$argv,true)) { echo json_encode($preview(),JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE).PHP_EOL; exit; }
$count=$db::transaction(function() use($db,$companyId,$preview) {
    $db::table('companies')->where('id',$companyId)->lockForUpdate()->firstOrFail(); $p=$preview(); $count=0;
    foreach($p['proposed_grants'] as $grant) if($db::table('permission_grants')->insertOrIgnore($grant+['created_at'=>now(),'updated_at'=>now()])) {
        $count++; \App\Modules\Identity\Services\Audit::record('service_fiscal.initial_grant',null,$grant['tenant_id'],$grant['company_id'],$grant['unit_id'],subject:$grant['user_id'],details:['permission'=>$grant['permission'],'reason'=>'Initial grants require exact specific user confirmation; no activation or emission right.']);
    }
    return $count;
});
echo "Applied $count specifically confirmed fiscal grants; no profile activated.\n";