<?php

require __DIR__.'/../vendor/autoload.php';
$app = require __DIR__.'/../bootstrap/app.php';
$app->make(\Illuminate\Contracts\Console\Kernel::class)->bootstrap();
if (! \App\Modules\Identity\Services\LocalDatabaseGuard::allows()) { throw new RuntimeException('Own local development database required.'); }
$args = array_values(array_filter(array_slice($argv, 1), fn ($arg) => $arg !== '--apply'));
if (count($args) !== 2 || array_filter($args, fn ($id) => ! ctype_digit($id))) { throw new RuntimeException('Usage: preview-access.php user_id company_id [--apply]; specific confirmation required.'); }
[$user, $company] = array_map('intval', $args); $db = \Illuminate\Support\Facades\DB::class;
$account = $db::table('users')->where('id', $user)->first(['id','name','email']);
$scope = $db::table('companies')->where('id', $company)->first(['id','tenant_id','name']);
if (! $account || ! $scope) { throw new RuntimeException('Existing account/company not found; nothing created.'); }
$permission = \App\Modules\Services\DocumentPreview::CONFIGURE;
if (! in_array('--apply', $argv, true)) { echo json_encode(['account' => $account, 'company' => $scope, 'permission' => $permission, 'unit_id' => null], JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE).PHP_EOL; exit(0); }
$db::transaction(function () use ($db, $scope, $user, $permission): void {
    $db::table('companies')->where('id', $scope->id)->lockForUpdate()->firstOrFail();
    foreach (['company.view','issuer_documents.view'] as $right) { app(\App\Modules\Identity\Services\Permissions::class)->require($user, $scope->tenant_id, $scope->id, $right); }
    if ($db::table('permission_grants')->insertOrIgnore(['user_id' => $user, 'tenant_id' => $scope->tenant_id, 'company_id' => $scope->id, 'unit_id' => null, 'permission' => $permission, 'created_at' => now(), 'updated_at' => now()])) {
        \App\Modules\Identity\Services\Audit::record('document_preview.access.initial_grant', null, $scope->tenant_id, $scope->id, subject: $user, details: ['permission' => $permission, 'reason' => 'Configuração da apresentação especificamente confirmada pelo utilizador.']);
    }
});
echo "Specifically confirmed company preview-configuration grant applied; no financial powers.\n";