<?php
declare(strict_types=1);
/**
 * Synthetic report-handoff regression example. PHP 8.0+, no dependencies.
 * Run: php report-handoff-regression.php.txt
 * Does not connect to LDAP, a database, HTTP, or any private application.
 * Does not create real tokens. Not an authentication library or production fix.
 * Permission to copy, modify and redistribute this example is granted.
 */
if (PHP_SAPI !== 'cli') {
    http_response_code(404);
    exit;
}

// These are illustrative labels, not real hosts or request parameters.
function loginFixture(array $grants, string $target): array
{
    return ['identity' => ['grants' => $grants, 'loginTarget' => $target], 'target' => $target];
}

// Models an older request handler changing the target but retaining login grants.
function changeTargetFixture(array &$session, string $target): void
{
    $session['target'] = $target;
}

// Deliberately preserves the supplied fix's two-environment classification.
// Unknown targets ALSO map to production; this is NOT target validation.
function environmentFixture(string $target): string
{
    return $target === 'development-db' ? 'development' : 'production';
}

function handoffFixture(array $session, string $report, bool $deprecated, string $revision): array
{
    if (!in_array($revision, ['original', 'grant-check', 'environment-check'], true)) {
        throw new InvalidArgumentException('Unknown fixture revision');
    }
    // Authentication and request parsing are preconditions in the real example.
    if (!isset($session['identity'], $session['target'])) {
        return ['status' => 403, 'issued' => []];
    }
    $identity = $session['identity'];
    if ($deprecated) {
        return ['status' => 403, 'issued' => []];
    }
    if ($revision !== 'original' && !in_array(strtolower($report), array_map('strtolower', $identity['grants']), true)) {
        return ['status' => 403, 'issued' => []];
    }
    if ($revision === 'environment-check'
        && environmentFixture($session['target']) !== environmentFixture($identity['loginTarget'])) {
        return ['status' => 403, 'issued' => []];
    }
    // A spy records intended issuance. No signing key or token implementation.
    return ['status' => 200, 'issued' => [[
        'report' => $report,
        'environment' => environmentFixture($session['target']),
        'target' => $session['target'],
    ]]];
}

$tests = 0;
$failures = 0;
function expectFixture(string $name, mixed $actual, mixed $expected): void
{
    global $tests, $failures;
    ++$tests;
    if ($actual !== $expected) {
        ++$failures;
        fwrite(STDERR, "FAIL $name\n  expected: " . json_encode($expected) . "\n  actual: " . json_encode($actual) . "\n");
        return;
    }
    echo "PASS $name\n";
}

$ungranted = loginFixture([], 'production-db');
$original = handoffFixture($ungranted, 'sales-summary', false, 'original');
expectFixture('original issues without report grant (reproduces finding 1)', count($original['issued']), 1);
foreach (['grant-check', 'environment-check'] as $revision) {
    expectFixture("$revision denies missing grant and issues nothing", handoffFixture($ungranted, 'sales-summary', false, $revision), ['status' => 403, 'issued' => []]);
}

$session = loginFixture(['sales-summary'], 'development-db');
$grantsBefore = $session['identity'];
changeTargetFixture($session, 'production-db');
expectFixture('target change retains the login identity and grants', $session['identity'], $grantsBefore);
$partial = handoffFixture($session, 'sales-summary', false, 'grant-check');
expectFixture('grant-only fix still issues for production (reproduces finding 2)', $partial['issued'][0]['environment'] ?? null, 'production');
expectFixture('environment fix denies switched target and issues nothing', handoffFixture($session, 'sales-summary', false, 'environment-check'), ['status' => 403, 'issued' => []]);

foreach (['development-db', 'production-db'] as $target) {
    $allowed = loginFixture(['SALES-SUMMARY'], $target);
    $result = handoffFixture($allowed, 'sales-summary', false, 'environment-check');
    expectFixture("$target allows granted report", $result['status'], 200);
    expectFixture("$target issues exactly once for the selected target", $result['issued'], [['report' => 'sales-summary', 'environment' => environmentFixture($target), 'target' => $target]]);
    expectFixture("$target still denies deprecated report", handoffFixture($allowed, 'sales-summary', true, 'environment-check'), ['status' => 403, 'issued' => []]);
    expectFixture("$target denies a different report", handoffFixture($allowed, 'other-report', false, 'environment-check'), ['status' => 403, 'issued' => []]);
}
expectFixture('missing identity is denied by fixture precondition', handoffFixture([], 'sales-summary', false, 'environment-check'), ['status' => 403, 'issued' => []]);
$reverse = loginFixture(['sales-summary'], 'production-db');
changeTargetFixture($reverse, 'development-db');
expectFixture('production-to-development change is also denied', handoffFixture($reverse, 'sales-summary', false, 'environment-check'), ['status' => 403, 'issued' => []]);

// Characterization tests document limitations, NOT behavior to copy into a new system.
$unknown = loginFixture(['sales-summary'], 'production-db');
changeTargetFixture($unknown, 'unknown-db');
expectFixture('LIMITATION: unknown target is classified as production', handoffFixture($unknown, 'sales-summary', false, 'environment-check')['status'], 200);
$another = loginFixture(['sales-summary'], 'production-db');
changeTargetFixture($another, 'another-production-db');
expectFixture('LIMITATION: distinct production targets are not distinguished', handoffFixture($another, 'sales-summary', false, 'environment-check')['status'], 200);

echo "\n$tests checks, $failures failures. Synthetic model only; no private application tested.\n";
exit($failures === 0 ? 0 : 1);