<?php
declare(strict_types=1);
require dirname(__DIR__) . '/app/bootstrap.php';
$root=dirname(__DIR__);
$v=json_decode((string)file_get_contents($root.'/DDB_VERSION.json'),true);
$config=(array)require $root.'/config/access_control.php';
$core=(string)file_get_contents($root.'/app/Core/AccessControl.php');
$repo=(string)file_get_contents($root.'/app/Repositories/AccessControlRepository.php');
$router=(string)file_get_contents($root.'/public/index.php');
$layout=(string)file_get_contents($root.'/app/Views/layouts/main.php');
$view=(string)file_get_contents($root.'/app/Views/access_control/index.php');
$installer=(string)file_get_contents($root.'/tools/access-control-r45-p14-install.php');
$runtime=$core."\n".$repo."\n".$router."\n".$view."\n".$installer;
$checks=[
 'version'=>($v['version']??'')==='11.0.14.0','phase'=>($v['phase']??'')==='H11.0-P14.0',
 'site_admin_policy'=>($config['protected_roles']['SITE_ADMIN']['policy_mode']??'')==='ALL',
 'site_admin_auto'=>($config['protected_roles']['SITE_ADMIN']['auto_include_new']??false)===true,
 'site_admin_immutable'=>($config['protected_roles']['SITE_ADMIN']['is_editable']??true)===false,
 'gm_policy'=>($config['protected_roles']['GENERAL_MANAGER']['policy_mode']??'')==='ALL_BUSINESS',
 'gm_auto'=>($config['protected_roles']['GENERAL_MANAGER']['auto_include_new']??false)===true,
 'gm_editable'=>($config['protected_roles']['GENERAL_MANAGER']['is_editable']??false)===true,
 'settings_category'=>($config['permissions']['daily_revenue_settings.manage']['category']??'')==='settings',
 'security_category'=>($config['permissions']['security.access_control.manage']['category']??'')==='security',
 'route_guard'=>strpos($router,'AccessControl::permissionForRoute')!==false && strpos($router,'AccessControl::forbidden')!==false,
 'sidebar_guard'=>strpos($layout,"AccessControl::allows('overview.view')")!==false && strpos($layout,'access-control')!==false,
 'independent_page_visibility'=>strpos($layout,"AccessControl::allows('daily_inpatient_revenue.view')")!==false && strpos($layout,"AccessControl::allows('specialty_finance.view')")!==false,
 'action_routes_guarded'=>strpos($router,"case 'action-review-dashboard'")!==false && strpos($router,"case 'action-governance-update'")!==false && strpos($router,"case 'leadership-huddle'")!==false,
 'branch_guard'=>strpos($core,'allowsBranch')!==false && strpos($layout,'AccessControl::allowedHospitals')!==false,
 'last_admin_guard'=>strpos($repo,'AT_LEAST_ONE_SITE_ADMIN_REQUIRED')!==false,
 'site_admin_override_block'=>strpos($repo,'SITE_ADMIN_POLICY_IS_IMMUTABLE')!==false,
 'audit_table'=>strpos($installer,'DASH_ACL_AUDIT')!==false && strpos($repo,'DASH_ACL_AUDIT_SEQ.NEXTVAL')!==false,
 'idempotent_ddl'=>substr_count($installer,'SQLCODE != -955')>=6,
 'hybrid_fallback'=>strpos($core,'LEGACY_FALLBACK')!==false,
 'gm_matrix'=>strpos($view,'gm_permission[')!==false,
 'user_assignment'=>strpos($view,'save_user_access')!==false,
 'jckh_not_assignable'=>strpos($repo,"['njch', 'mnh']")!==false,
 'php7_match_absent'=>preg_match('/\bmatch\s*\(/',$runtime)!==1,
 'php7_nullsafe_absent'=>strpos($runtime,'?->')===false,
 'oracle_install_only'=>($v['r45_p14_0']['oracle_writes']??'')==='SECURITY_SCHEMA_INSTALL_ONLY',
];$failed=[];foreach($checks as $k=>$ok){if(!$ok)$failed[]=$k;}
echo json_encode(['schema'=>'R45_P14_0_STATIC_QA','checks'=>$checks,'passed'=>count($checks)-count($failed),'failed'=>$failed],JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES),PHP_EOL;exit($failed===[]?0:1);
