<?php
require __DIR__.'/sgc-invoice-proof-bootstrap.php';
if(!is_file($proofRoot.'/security-result.json')||is_file($proofRoot.'/context-result.json'))throw new LogicException('Fresh context proof only');
$fixture=json_decode(file_get_contents($proofRoot.'/source-fixture.json'),true);$url='/api/v1/integration/sgc/invoices/orders/'.$fixture['order'];
$before=$native->table('invoices')->count();$beforeAudit=$native->table('audit_logs')->count();
$checks=[];$ok=function($v,$name)use(&$checks){if(!$v)throw new RuntimeException($name);$checks[]=$name;};
$get=fn($path,$headers=[],$raw=null)=>$send([],null,$headers,$path,$raw,'GET');
$r=$get($url);$ok($r['status']===200&&$r['data']['order']['id']===$fixture['order']&&strlen($r['data']['revision'])===64,'authenticated exact order exposes current revision and lines');
$ok($r['no_store']&&!isset($r['data']['invoices']),'context response is uncached and excludes unrelated invoice list');
$ok($get($url,['HTTP_AUTHORIZATION'=>null])['status']===401,'context read requires bearer');
$ok($get('/api/v1/integration/sgc/invoices/orders/'.$nativeFixture['foreign_order'])['status']===403,'context read refuses foreign tenant order');
$ok($get($url.'?unit_id=1')['status']===422,'context read rejects query authority');
$ok($get($url,[],'{}')['status']===422,'context read rejects a request body');
$host->beginTransaction();try{$host->table('permission_grants')->where('user_id',$f['issuer'])->where('permission','purchasing_invoices.view')->delete();$ok($get($url)['status']===403,'context read revalidates view grant');}finally{$host->rollBack();}
config(['sgc_invoice.enabled'=>false]);$ok($get($url)['status']===404,'context route also remains disabled');config(['sgc_invoice.enabled'=>true]);
$cut=json_decode(Illuminate\Support\Facades\Crypt::decryptString(json_decode(file_get_contents($proofRoot.'/initial-preview.json'),true)['data']['preview']),true);
$retry=['phase'=>'preview','order_id'=>$fixture['order'],'revision'=>$cut['revision'],'reason'=>$cut['reason'],'data'=>$cut['data']];
$ok($send($retry,$cut['operation_key'])['status']===200,'POST durable replay unchanged after adding read-only context route');
$ok($native->table('invoices')->count()===$before&&$native->table('audit_logs')->count()===$beforeAudit,'context checks add no business effects');
file_put_contents($proofRoot.'/context-result.json',json_encode(['passed'=>true,'checks'=>$checks,'new_business_rows'=>0,'previous_security_sha256'=>hash_file('sha256',$proofRoot.'/security-result.json')],JSON_PRETTY_PRINT|JSON_THROW_ON_ERROR));
echo json_encode(['passed'=>true,'checks'=>count($checks)]).PHP_EOL;