<?php

// Local operator procedure: preview before applying; obtain specific user confirmation.
require __DIR__.'/../vendor/autoload.php';
$app = require __DIR__.'/../bootstrap/app.php';
$app->make(\Illuminate\Contracts\Console\Kernel::class)->bootstrap();
if (! \App\Modules\Identity\Services\LocalDatabaseGuard::allows()) { throw new RuntimeException('Own local development database required.'); }
$args = array_values(array_filter(array_slice($argv, 1), fn ($arg) => $arg !== '--apply'));
if (count($args) !== 3 || array_filter($args, fn ($id) => ! ctype_digit($id))) { throw new RuntimeException('Usage: b1-access.php user_id company_id unit_id [--apply]'); }
[$userId, $companyId, $unitId] = array_map('intval', $args);
$user = \Illuminate\Support\Facades\DB::table('users')->where('id', $userId)->first(['id','name','email']);
$unit = \Illuminate\Support\Facades\DB::table('units as n')->join('companies as c', 'c.id', '=', 'n.company_id')->where('n.id', $unitId)->where('c.id', $companyId)->first(['n.tenant_id','n.company_id','n.id as unit_id','n.name as unit_name','c.name as company_name']);
if (! $user || ! $unit) { throw new RuntimeException('Existing account or scope not found.'); }
$permission = \App\Modules\Services\InternalConfirmation::PERMISSION;
$plan = ['user' => $user, 'scope' => $unit, 'permission' => $permission];
if (! in_array('--apply', $argv, true)) { echo json_encode($plan, JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE).PHP_EOL; exit(0); }
\Illuminate\Support\Facades\DB::transaction(function () use ($unit, $userId, $permission): void {
    \Illuminate\Support\Facades\DB::table('companies')->where('id', $unit->company_id)->lockForUpdate()->firstOrFail();
    foreach (['company.view','unit.view','billing_drafts.view'] as $required) { app(\App\Modules\Identity\Services\Permissions::class)->require($userId, $unit->tenant_id, $unit->company_id, $required, $required === 'company.view' ? null : $unit->unit_id); }
    $row = ['user_id' => $userId, 'tenant_id' => $unit->tenant_id, 'company_id' => $unit->company_id, 'unit_id' => $unit->unit_id, 'permission' => $permission];
    if (\Illuminate\Support\Facades\DB::table('permission_grants')->insertOrIgnore($row + ['created_at' => now(), 'updated_at' => now()])) {
        \App\Modules\Identity\Services\Audit::record('b1.access.initial_grant', null, $unit->tenant_id, $unit->company_id, $unit->unit_id, $userId, ['permission' => $permission, 'operator' => 'Codex por confirmação específica do utilizador', 'reason' => 'Confirmação interna B1, sem poderes fiscais ou contabilísticos.']);
    }
});
echo "One specifically confirmed internal-confirmation grant applied; no other rights changed.\n";