<?php

$state = json_decode(file_get_contents(getenv('IR_COMPOSITION_STATE')), true, 64, JSON_THROW_ON_ERROR);
require $state['app'].'/vendor/autoload.php';
$app = require $state['app'].'/bootstrap/app.php';
$app->make(Illuminate\Contracts\Console\Kernel::class)->bootstrap();
$f = json_decode(file_get_contents($state['root'].'/fixture.json'), true, 32, JSON_THROW_ON_ERROR);
// Test entry only, outside production routes. Reuses real sessions, CSRF and context middleware.
Illuminate\Support\Facades\Route::middleware('web')->get('/qa/enter/{role}', function (Illuminate\Http\Request $r, string $role) use ($f) {
    abort_unless(in_array($role, ['actor','validator'], true), 404);
    $u = App\Models\User::findOrFail($f[$role]); auth()->login($u);
    $r->session()->put('auth_version', $u->auth_version);
    $token = bin2hex(random_bytes(20));
    $r->session()->put('company_context', $f['scope'] + ['token'=>$token,'module_id'=>$r->query('module', 'purchasing')]);
    return response()->json(['csrf'=>csrf_token(),'context'=>$token]);
});
$app->handleRequest(Illuminate\Http\Request::capture());