<?php
declare(strict_types=1);require __DIR__.'/NativeGate.php';
$n=0;$check=static function($v)use(&$n){$n++;if(!$v)throw new RuntimeException('Gate assertion '.$n);};
$good=['SELECT * FROM `ydy_config` WHERE `name` = :where_name','SELECT s.id FROM ydy_meal_order_supplement s LEFT JOIN ydy_user u ON u.id=s.user_id WHERE s.id=?','SHOW COLUMNS FROM `ydy_user`','SHOW FULL COLUMNS FROM `ydy_meal_order_supplement`','SELECT COLUMN_NAME FROM USER_TAB_COLUMNS WHERE TABLE_NAME=?','SELECT cc.COLUMN_NAME FROM USER_CONSTRAINTS c JOIN USER_CONS_COLUMNS cc ON c.CONSTRAINT_NAME=cc.CONSTRAINT_NAME WHERE c.TABLE_NAME=?', 'CALL SP_TABLEDEF(?, ?)'];
foreach($good as $sql)$check(is_string(FLGate::sql($sql)));
$bad=['UPDATE ydy_user SET balance=0','DELETE FROM ydy_user','INSERT INTO ydy_user(id) VALUES(1)','ALTER TABLE ydy_user ADD x INT','DROP TABLE ydy_user','CALL EVIL(?, ?)','SELECT * INTO foo FROM ydy_user','SELECT * FROM external.ydy_user','SELECT * FROM yoshop_user','SELECT * FROM ydy_user FOR UPDATE','SELECT SLEEP(1) FROM ydy_user','SELECT * FROM ydy_user; DELETE FROM ydy_user','SELECT * FROM ydy_user -- bypass','SELECT * FROM ydy_user /* bypass */','SHOW COLUMNS FROM `ydy_bank_account`','DO 1','SELECT 1'];
foreach($bad as $sql){$denied=false;try{FLGate::sql($sql);}catch(RuntimeException $e){$denied=true;}$check($denied);}
$binds=['1'=>['value'=>'ZHCT_APP','type'=>2],'2'=>['value'=>'YDY_MEAL_ORDER_SUPPLEMENT','type'=>2]];FLGate::callBinds('CALL SP_TABLEDEF(?, ?)',$binds);$check(true);
foreach([['1'=>['value'=>'AIZHCT_APP','type'=>2],'2'=>$binds['2']],['1'=>$binds['1'],'2'=>['value'=>'YOSHOP_USER','type'=>2]],['1'=>['value'=>'ZHCT_APP','type'=>1],'2'=>$binds['2']],[]] as $badBind){$denied=false;try{FLGate::callBinds('CALL SP_TABLEDEF(?, ?)',$badBind);}catch(RuntimeException $e){$denied=true;}$check($denied);}
FLGate::$deny=true;foreach($good as $sql){$denied=false;try{FLGate::sql($sql);}catch(RuntimeException $e){$denied=true;}$check($denied);}FLGate::$deny=false;
echo json_encode(['passed'=>true,'assertions'=>$n,'database_connections'=>0,'http'=>0]),"\n";