<?php
declare(strict_types=1);date_default_timezone_set('Asia/Shanghai');$lane=getenv('CORE_LANE');$dm=getenv('POC_DIALECT')==='dm';$file=__DIR__.'/private/protection-'.$lane.'.json';if(is_file($file))throw new RuntimeException('Protection immutable once');$pre=json_decode(file_get_contents(__DIR__.'/private/preflight-'.$lane.'.json'),true);$pdo=[];$events=[];$check=static function($ok,$m){if(!$ok)throw new RuntimeException($m);};foreach(['AI','ZHCT'] as $db){$dsn=$dm?'dm:host=127.0.0.1;port='.getenv('POC_'.$db.'_PORT').';schema='.getenv('POC_'.$db.'_SCHEMA'):'mysql:host='.getenv('POC_'.$db.'_HOST').';port='.getenv('POC_'.$db.'_PORT').';dbname='.getenv('POC_'.$db.'_SCHEMA').';charset='.getenv('POC_'.$db.'_CHARSET');$pdo[$db]=new PDO($dsn,getenv('POC_'.$db.'_USER'),getenv('POC_'.$db.'_PASSWORD'),[PDO::ATTR_CASE=>PDO::CASE_LOWER,PDO::ATTR_ERRMODE=>PDO::ERRMODE_EXCEPTION,PDO::ATTR_ORACLE_NULLS=>PDO::NULL_NATURAL,PDO::ATTR_STRINGIFY_FETCHES=>false,PDO::ATTR_EMULATE_PREPARES=>false]);}
$q=static function($db,$sql,$params=[],$hashed=false)use($pdo,&$events,$check){$check(strpos($sql,'SELECT ')===0&&!preg_match('/;|--|\/\*|\b(?:INSERT|UPDATE|DELETE|REPLACE|CREATE|ALTER|DROP|INTO|CALL|FOR UPDATE)\b/i',$sql),'Exact native SELECT-only protection');$s=$pdo[$db]->prepare($sql);$bind=[];foreach($params as $i=>$v){$s->bindValue($i+1,(string)$v,PDO::PARAM_STR);$bind[]=['position'=>$i+1,'value'=>(string)$v,'pdo_type'=>PDO::PARAM_STR];}$s->execute();$rows=$s->fetchAll(PDO::FETCH_ASSOC);foreach($rows as &$r){foreach($r as &$v)if(is_resource($v))$v=stream_get_contents($v);unset($v);ksort($r);}unset($r);$json=json_encode($rows,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_PRESERVE_ZERO_FRACTION);$check($json!==false,'Native rows encoding');$events[]=['connection'=>$db,'queryString'=>$s->queryString,'operation'=>'SELECT','bindValue'=>$bind,'execute_success'=>true,'rowCount'=>$s->rowCount(),'rows'=>$hashed?'SECRET_CONFIG_ONLY_FULLROW_SHA256_PERSISTED':$rows,'full_rows_sha256'=>hash('sha256',$json)];return ['rows'=>$hashed?null:$rows,'count'=>count($rows),'sha256'=>hash('sha256',$json)];};
$ids=$lane==='B'?[44676,97274,107491]:[1836,2642,2182];$data=[];$excluded=[];foreach([['AI','user','user_id',$ids[0]],['ZHCT','user','id',$ids[1]],['ZHCT','staff','id',$ids[2]]] as [$db,$table,$pk,$id]){$cols=[];foreach($pre['schema'][$db][$table]['columns'] as $col){$name=strtolower($col['column_name']);if(preg_match('/password|^pwd$|^salt$|token|secret|openid|unionid|oauth/',$name)){$excluded[$db.'.'.$table][]=$name;continue;}$check(preg_match('/^[a-z_][a-z0-9_]*$/D',$name)===1,'Source metadata safe column');$cols[]=$name;}$data[$db.'.'.$table]=$q($db,'SELECT '.implode(',',$cols).' FROM '.getenv('POC_'.$db.'_PREFIX').$table.' WHERE '.$pk.'=?',[$id]);$check($data[$db.'.'.$table]['count']===1,'Old own exact principal row exists');}
foreach(['account_settlement'=>'settlement_id','user_balance_log'=>'log_id','user_subsidy'=>'id','user_gift_log'=>'log_id'] as $t=>$pk)$data['AI.'.$t]=$q('AI','SELECT * FROM yoshop_'.$t.' WHERE user_id=? ORDER BY '.$pk,[$ids[0]]);
$orders=$q('ZHCT','SELECT * FROM ydy_meal_order WHERE user_id=? ORDER BY id',[$ids[1]]);$data['ZHCT.meal_order']=$orders;$orderIds=[];foreach($orders['rows'] as $r){$check((int)$r['user_id']===$ids[1],'Order actual own user lease');$orderIds[]=(int)$r['id'];}foreach(['initial_menu','meal_order_pickup'] as $t){if($orderIds)$data['ZHCT.'.$t]=$q('ZHCT','SELECT * FROM ydy_'.$t.' WHERE meal_order_id IN ('.implode(',',array_fill(0,count($orderIds),'?')).') ORDER BY id',$orderIds);else $data['ZHCT.'.$t]=['rows'=>[],'count'=>0,'sha256'=>hash('sha256','[]')];}
$data['ZHCT.prepay_order']=$q('ZHCT','SELECT * FROM ydy_prepay_order WHERE user_id=? ORDER BY id',[$ids[1]]);$data['ZHCT.staff_department']=$q('ZHCT','SELECT * FROM ydy_staff_department WHERE staff_uuid=? ORDER BY id',[$data['ZHCT.staff']['rows'][0]['uuid']]);$data['ZHCT.exact_config_hashes']=$q('ZHCT','SELECT * FROM ydy_config WHERE config_key IN (?,?) ORDER BY id',['one_card','account_deduction_order'],true);
$result=['lane'=>$lane,'scope'=>'Only fixed original marked mobile principals and their complete owned business rows; credential columns excluded, exact config full rows hashes only','HTTP'=>0,'DML'=>0,'DDL'=>0,'SELECT'=>count($events),'credential_columns_not_queried'=>$excluded,'protected'=>$data,'native_SELECT_events'=>$events,'no_fixture_created'=>true];$json=json_encode($result,JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_PRESERVE_ZERO_FRACTION);$check($json!==false,'Protection encoding');file_put_contents($file,$json);chmod($file,0600);echo json_encode(['lane'=>$lane,'HTTP'=>0,'DML'=>0,'DDL'=>0,'SELECT'=>count($events),'owned_protected_surfaces'=>count($data),'own_order_count'=>count($orderIds),'credential_columns_excluded'=>true]),"\n";