<?php
declare(strict_types=1);
require __DIR__.'/common.php';$path=parse_url($_SERVER['REQUEST_URI']??'',PHP_URL_PATH);$method=$_SERVER['REQUEST_METHOD']??'';$allow=['/__poc_boundary'=>'GET'];
foreach(['store','terminal'] as $module){foreach(['list'=>'GET','detail'=>'GET','add'=>'POST','edit'=>'POST','delete'=>'POST'] as $action=>$m){$allow['/'.$module.'/market.Coupon/'.$action]=$m;}}
if(($allow[$path]??null)!==$method){http_response_code(403);echo '{"admin_coupon_allowlist":false}';return;}
$root=getenv('COUPON_APP_ROOT');$runtime=getenv('PILOT_RUNTIME');$tenant=1930501010;$marker='CDXAC10E4C6A28B1D09';$_SERVER['SCRIPT_FILENAME']=$root.'/public/index.php';$_SERVER['SCRIPT_NAME']='/index.php';$_SERVER['PHP_SELF']='/index.php';
try{
    $app=cpBootstrap($root,$runtime);if($path==='/__poc_boundary'){echo json_encode(['new_private_root'=>realpath(root_path())===realpath($root),'file_cache'=>$app->config->get('cache.default')==='file','external_stubs'=>class_exists(\app\common\Serve::class,false),'admin_coupon_allowlist'=>true]);return;}
    $map=json_decode(file_get_contents($runtime.'/fixture_map.json'),true);if(!hash_equals($map['token'],$_SERVER['HTTP_ACCESS_TOKEN']??'')){throw new RuntimeException('Private token guard');}
    $scenario=$_SERVER['HTTP_X_PILOT_SCENARIO']??'';if(!preg_match('/^PILOT_ACP_[A-Z0-9_]{1,50}$/D',$scenario)){throw new RuntimeException('Scenario guard');}
    $module=explode('/',$path)[1];$action=basename($path);$payload=[];if($method==='POST'){$payload=json_decode(file_get_contents('php://input'),true);if(!is_array($payload)){throw new RuntimeException('Actual client JSON form required');}}
    $params=array_merge($_GET,$payload);$db=cpPdo();
    if(in_array($action,['detail','edit','delete'],true)){$id=$params['couponId']??null;if(!is_int($id)&&!(is_string($id)&&ctype_digit($id))){throw new RuntimeException('Owned ID type');}$own=cpRows($db,'SELECT coupon_id FROM yoshop_coupon WHERE coupon_id=? AND store_id=? AND name LIKE ?',[(int)$id,$tenant,$marker.'_'.$module.'%']);if(count($own)!==1){throw new RuntimeException('Owned coupon guard');}}
    if(in_array($action,['add','edit'],true)){$form=$payload['form']??null;$allowed=['name','coupon_type','reduce_price','discount','min_price','expire_type','expire_day','betweenTime','apply_range','apply_range_config','total_num','describe','status','sort','write_off_limit_amount','unavailable_dates','unavailable_time_ranges'];if(!is_array($form)||array_diff(array_keys($form),$allowed)||strpos($form['name']??'',$marker.'_'.$module)!==0){throw new RuntimeException('Owned form guard');}}
    require __DIR__.'/SqlCoverageRecorder.php';$recorder=new SqlCoverageRecorder($runtime.'/queries.jsonl',realpath($root),$scenario);$app->db->listen(static function($sql,$time=null)use($recorder){if(strpos($sql,'CONNECT:')!==0){$recorder->observe($sql,$time);}});register_shutdown_function([$recorder,'finish']);
    $http=$app->http;$response=$http->run();$response->send();$http->end($response);
}catch(Throwable $e){http_response_code(500);echo json_encode(['private_error'=>get_class($e),'file'=>basename($e->getFile()),'line'=>$e->getLine()]);file_put_contents($runtime.'/errors-private.jsonl',json_encode(['class'=>get_class($e),'file'=>basename($e->getFile()),'line'=>$e->getLine(),'message_sha256'=>hash('sha256',$e->getMessage())])."\n",FILE_APPEND|LOCK_EX);}