<?php

declare(strict_types=1);

// Independent process, SELECT only. Never prints POC credentials or real data.
$marker=(string)getenv('CDXPARRECIPE_MARKER');
$pid=(string)getenv('POC_RUNTIME_PID');
if (!preg_match('/^CDXPARRECIPE[A-F0-9]{8}$/',$marker)
    || !ctype_digit($pid)) {
    fwrite(STDERR,"Exact synthetic marker/PID required\n");
    exit(2);
}

try {
    $path='/tmp/zhct-store-read5.1QIRH4/manifest-'.$marker.'.json';
    if (!is_file($path) || (fileperms($path)&0777)!==0600) {
        throw new RuntimeException('Private manifest absent or permissions wrong');
    }
    $manifest=json_decode((string)file_get_contents($path),true);
    if (!is_array($manifest) || ($manifest['marker']??'')!==$marker
        || ($manifest['schema']??'')!=='ZHCT_APP'
        || ($manifest['permission_fixture_phase']??'')!=='cleaned') {
        throw new RuntimeException('Manifest cleanup state not proven');
    }
    $userUuid=(string)$manifest['user_uuid'];
    $roleUuid=(string)$manifest['role_uuid'];
    if (!preg_match('/^[a-fA-F0-9-]{36}$/',$userUuid)
        || !preg_match('/^[a-fA-F0-9-]{36}$/',$roleUuid)) {
        throw new RuntimeException('Manifest identity invalid');
    }
    $cmdline=(string)file_get_contents('/proc/'.$pid.'/cmdline');
    if (strpos($cmdline,'127.0.0.1:18080')===false
        || strpos($cmdline,
            '/tmp/zhct-dm-poc-20260928.fcpiiN/store/public')===false) {
        throw new RuntimeException('Wrong isolated runtime');
    }
    $env=array_fill_keys(['POC_HOST','POC_PORT','POC_SCHEMA',
        'POC_USER','POC_PASSWORD'],'');
    foreach (explode("\0",(string)file_get_contents('/proc/'.$pid.'/environ')) as $entry) {
        $pair=explode('=',$entry,2);
        if (count($pair)===2 && array_key_exists($pair[0],$env)) {
            $env[$pair[0]]=$pair[1];
        }
    }
    if ($env['POC_HOST']!=='127.0.0.1' || $env['POC_PORT']!=='5237'
        || strtoupper($env['POC_SCHEMA'])!=='ZHCT_APP'
        || strtoupper($env['POC_USER'])!=='ZHCT_APP'
        || $env['POC_PASSWORD']==='') {
        throw new RuntimeException('Wrong C database boundary');
    }
    $db=new PDO('dm:host=127.0.0.1;port=5237;schema=ZHCT_APP',
        $env['POC_USER'],$env['POC_PASSWORD'],[
            PDO::ATTR_ERRMODE=>PDO::ERRMODE_EXCEPTION,
            PDO::ATTR_DEFAULT_FETCH_MODE=>PDO::FETCH_ASSOC,
        ]);
    if (strtoupper((string)$db->query(
        "SELECT SYS_CONTEXT('USERENV','CURRENT_SCHEMA') FROM DUAL")
        ->fetchColumn())!=='ZHCT_APP') {
        throw new RuntimeException('Wrong current schema');
    }
    $checks=[
        'user_account'=>['SELECT COUNT(*) FROM YDY_USER WHERE ACCOUNT=?',[$marker]],
        'user_uuid'=>['SELECT COUNT(*) FROM YDY_USER WHERE UUID=?',[$userUuid]],
        'role_name'=>['SELECT COUNT(*) FROM YDY_ROLE WHERE NAME=?',[$marker]],
        'role_uuid'=>['SELECT COUNT(*) FROM YDY_ROLE WHERE UUID=?',[$roleUuid]],
        'user_role_uuid'=>['SELECT COUNT(*) FROM YDY_USER_ROLE WHERE USER_UUID=?',[$userUuid]],
        'role_menu_uuid'=>['SELECT COUNT(*) FROM YDY_ROLE_MENU WHERE ROLE_UUID=?',[$roleUuid]],
        'user_data_uuid'=>['SELECT COUNT(*) FROM YDY_USER_DATA WHERE USER_UUID=?',[$userUuid]],
        'user_role_marker'=>['SELECT COUNT(*) FROM YDY_USER_ROLE WHERE CREATE_BY=?',[$marker]],
        'role_menu_marker'=>['SELECT COUNT(*) FROM YDY_ROLE_MENU WHERE CREATE_BY=?',[$marker]],
    ];
    $counts=[];
    foreach ($checks as $name=>[$sql,$args]) {
        $stmt=$db->prepare($sql);
        $stmt->execute($args);
        $counts[$name]=(int)$stmt->fetchColumn();
    }
    echo json_encode(['marker'=>$marker,'manifest_cleaned'=>true,
        'counts'=>$counts,'all_zero'=>array_sum($counts)===0],
        JSON_UNESCAPED_SLASHES).PHP_EOL;
    if (array_sum($counts)!==0) exit(1);
} catch (Throwable $error) {
    echo json_encode(['status'=>'blocked','class'=>get_class($error),
        'code'=>(string)$error->getCode()]).PHP_EOL;
    exit(1);
}