<?php

/** Initialize three separate test accounts with one demo grant each. */
declare(strict_types=1);

require dirname(__DIR__) . '/vendor/autoload.php';
\Dotenv\Dotenv::createUnsafeMutable(dirname(__DIR__))->load();
\support\App::loadAllConfig(['route']);
date_default_timezone_set('Asia/Shanghai');

use app\miniapi\auth\TestPhoneIdentityProvider;
use app\miniapi\model\MiniUser;
use app\miniapi\model\MiniGrant;
use app\miniapi\service\Access;
use app\miniapi\service\IdentityManagement;

if (!TestPhoneIdentityProvider::enabled()) {
    throw new RuntimeException('Requires MINI_TEST_PHONE_LOGIN=true');
}
$targets = [
    ['enterprise_admin', TestPhoneIdentityProvider::PHONES['enterprise_admin'], '【测试0910】科技园配送测试'],
    ['driver', TestPhoneIdentityProvider::PHONES['driver'], '【测试】地图配送员-KJY'],
    ['agent', TestPhoneIdentityProvider::PHONES['agent'], '测试商贸'],
];
$apply = in_array('--apply', $argv, true);
$result = (new MiniUser())->getConnection()->transaction(function () use ($targets, $apply) {
    $accounts = [];
    foreach ($targets as [$role, $phone, $name]) {
        $model = Access::resourceModel($role);
        $rows = $model::query()->where('name', $name)->where('status', 1)->get();
        if ($rows->count() !== 1) {
            throw new RuntimeException('Expected one active demo resource: ' . $name);
        }
        $accounts[] = ['role' => $role, 'phone' => $phone, 'resource_id' => (int) $rows[0]->id, 'name' => $name];
    }
    if (!$apply) {
        return ['mode' => 'inspect', 'accounts' => $accounts];
    }

    foreach ($accounts as &$account) {
        $user = MiniUser::query()->firstOrCreate(
            ['appid' => TestPhoneIdentityProvider::APP_ID, 'openid' => $account['phone']],
            ['nickname' => '本地' . $account['name'], 'status' => 1, 'created_at' => date('Y-m-d H:i:s'), 'updated_at' => date('Y-m-d H:i:s')]
        );
        if ((int) $user->status !== 1) {
            throw new RuntimeException('Test account disabled: ' . $account['phone']);
        }
        $account['user_id'] = (int) $user->id;
    }
    unset($account);

    $enterpriseUser = $accounts[0]['user_id'];
    foreach (array_slice($accounts, 1) as $account) {
        $oldGrant = MiniGrant::query()->where([
            'user_id' => $enterpriseUser,
            'role' => $account['role'],
            'resource_id' => $account['resource_id'],
        ])->where('status', 1)->first();
        if ($oldGrant) {
            (new IdentityManagement())->grant(1, [
                'user_id' => $enterpriseUser,
                'role' => $account['role'],
                'resource_id' => $account['resource_id'],
                'status' => 0,
            ]);
        }
    }

    foreach ($accounts as $account) {
        $key = ['user_id' => $account['user_id'], 'role' => $account['role'], 'resource_id' => $account['resource_id']];
        $otherGrant = MiniGrant::query()->where('user_id', $account['user_id'])->where('status', 1)
            ->where(function ($query) use ($account) {
                $query->where('role', '!=', $account['role'])->orWhere('resource_id', '!=', $account['resource_id']);
            })->exists();
        if ($otherGrant) {
            throw new RuntimeException('Test account has another active grant: ' . $account['phone']);
        }
        $existing = MiniGrant::query()->where($key)->first();
        if ($existing && (int) $existing->status !== 1) {
            throw new RuntimeException('Test grant disabled; do not silently reactivate: ' . $account['phone']);
        }
        if (!$existing) {
            (new IdentityManagement())->grant(1, $key);
        }
    }

    return ['mode' => 'applied', 'accounts' => $accounts];
});
echo json_encode($result, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) . PHP_EOL;