<?php
// Read-only proposal. Deliberately has no apply mode.
require __DIR__.'/../vendor/autoload.php';
$app=require __DIR__.'/../bootstrap/app.php'; $app->make(\Illuminate\Contracts\Console\Kernel::class)->bootstrap();
if(!\App\Modules\Identity\Services\LocalDatabaseGuard::allows()) throw new RuntimeException('Development read-only scope refused.');
$db=\Illuminate\Support\Facades\DB::class;
$company=$db::table('companies')->where('id',1)->first(['id','tenant_id','name']);
$unit=$db::table('units')->where('id',1)->where('company_id',1)->first(['id','name']);
if(!$company || !$unit) throw new RuntimeException('Proposed scope not found; no operation performed.');
$rows=[];
foreach([1=>['view','prepare','allocate','correction_request'],2=>['view','confirm','reconcile','correction_approve']] as $id=>$rights) {
    $user=$db::table('users')->where('id',$id)->first(['id','name','email']);
    if(!$user || !$db::table('company_memberships')->where(['user_id'=>$id,'tenant_id'=>$company->tenant_id,'company_id'=>1])->exists()) throw new RuntimeException('Existing account/scope not confirmed.');
    foreach($rights as $right) $rows[]=['user_id'=>$id,'name'=>$user->name,'email'=>$user->email,'tenant_id'=>$company->tenant_id,'company_id'=>1,'company'=>$company->name,'unit_id'=>1,'unit'=>$unit->name,'permission'=>'service_receivables.'.$right,'already_granted'=>$db::table('permission_grants')->where(['user_id'=>$id,'company_id'=>1,'unit_id'=>1,'permission'=>'service_receivables.'.$right])->exists()];
}
echo json_encode(['mode'=>'preview_only','grants'=>$rows,'applied'=>false],JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE|JSON_THROW_ON_ERROR).PHP_EOL;