<?php
require __DIR__.'/../vendor/autoload.php';
$app=require __DIR__.'/../bootstrap/app.php'; $app->make(\Illuminate\Contracts\Console\Kernel::class)->bootstrap();
if(!\App\Modules\Identity\Services\LocalDatabaseGuard::allows())throw new RuntimeException('Own SGF development database required.');
$args=array_values(array_filter(array_slice($argv,1),fn($v)=>$v!=='--apply'));
if(count($args)!==4 || array_filter($args,fn($v)=>!ctype_digit($v)))throw new RuntimeException('Usage: invoice-access.php proposer validator company unit [--apply]; exact prior confirmation required.');
[$proposer,$validator,$companyId,$unitId]=array_map('intval',$args);
if($proposer===$validator)throw new RuntimeException('Distinct proposer and validator required.');
$db=\Illuminate\Support\Facades\DB::class;
$preview=function()use($db,$proposer,$validator,$companyId,$unitId){
 $company=$db::table('companies')->where('id',$companyId)->first(['id','tenant_id','name']);
 if(!$company)throw new RuntimeException('Existing company required.');
 $unit=$db::table('units')->where('tenant_id',$company->tenant_id)->where('company_id',$companyId)->where('id',$unitId)->first(['id','name']);
 $accounts=$db::table('users')->whereIn('id',[$proposer,$validator])->orderBy('id')->get(['id','name','email']);
 if(!$unit || $accounts->count()!==2)throw new RuntimeException('Existing unit and two existing accounts required.');
 $grants=[];
 foreach($accounts as $a){
  if(!$db::table('company_memberships')->where('user_id',$a->id)->where('tenant_id',$company->tenant_id)->where('company_id',$companyId)->exists())throw new RuntimeException('Membership missing; no association inferred.');
  app(\App\Modules\Identity\Services\Permissions::class)->require($a->id,$company->tenant_id,$companyId,'company.view');
  app(\App\Modules\Identity\Services\Permissions::class)->require($a->id,$company->tenant_id,$companyId,'unit.view',$unitId);
  foreach(['invoice_series.view',$a->id===$proposer?'invoice_series.propose':'invoice_series.approve'] as $permission)$grants[]=['user_id'=>$a->id,'tenant_id'=>$company->tenant_id,'company_id'=>$companyId,'unit_id'=>null,'permission'=>$permission];
  foreach($a->id===$proposer?['service_invoices.view','service_invoices.issue','service_invoices.correction_request']:['service_invoices.view'] as $permission)$grants[]=['user_id'=>$a->id,'tenant_id'=>$company->tenant_id,'company_id'=>$companyId,'unit_id'=>$unitId,'permission'=>$permission];
 }
 return ['company'=>$company,'unit'=>$unit,'accounts'=>$accounts,'proposed_grants'=>$grants,'applied'=>false];
};
if(!in_array('--apply',$argv,true)){echo json_encode($preview(),JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE).PHP_EOL;exit;}
$count=$db::transaction(function()use($db,$companyId,$preview){
 $db::table('companies')->where('id',$companyId)->lockForUpdate()->firstOrFail();$p=$preview();$count=0;
 foreach($p['proposed_grants'] as $g)if($db::table('permission_grants')->insertOrIgnore($g+['created_at'=>now(),'updated_at'=>now()])){
  $count++;\App\Modules\Identity\Services\Audit::record('service_invoice.initial_grant',null,$g['tenant_id'],$g['company_id'],$g['unit_id'],subject:$g['user_id'],details:['permission'=>$g['permission'],'reason'=>'Eight initial grants specifically confirmed; real issuance remains blocked.']);
 }
 return $count;
});
echo "Applied $count specifically confirmed grants; no series or document created.\n";