<?php
// Read-only. No apply branch; technician and verifier real identities remain unassigned.
require __DIR__.'/../vendor/autoload.php';
$app=require __DIR__.'/../bootstrap/app.php';$app->make(\Illuminate\Contracts\Console\Kernel::class)->bootstrap();
if(!\App\Modules\Identity\Services\LocalDatabaseGuard::allows())throw new RuntimeException('Development read-only scope refused.');
$db=\Illuminate\Support\Facades\DB::class;
$u=$db::table('users')->where('id',1)->first(['id','name','email']);$c=$db::table('companies')->where('id',1)->first(['id','tenant_id','name']);$unit=$db::table('units')->where(['id'=>1,'company_id'=>1])->first(['id','name']);
if(!$u||!$c||!$unit||!$db::table('company_memberships')->where(['user_id'=>1,'tenant_id'=>$c->tenant_id,'company_id'=>1])->exists())throw new RuntimeException('Existing opener/scope not confirmed.');
$rights=[];foreach(['view','open','assign','authorize'] as $r)$rights[]=['permission'=>'workshop.'.$r,'already_granted'=>$db::table('permission_grants')->where(['user_id'=>1,'tenant_id'=>$c->tenant_id,'company_id'=>1,'unit_id'=>1,'permission'=>'workshop.'.$r])->exists()];
echo json_encode(['mode'=>'preview_only','opener'=>$u,'company'=>$c,'unit'=>$unit,'proposed'=>$rights,'technician'=>'not_identified_no_grant','verifier'=>'not_identified_no_grant','applied'=>false],JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE|JSON_THROW_ON_ERROR).PHP_EOL;