<?php

declare(strict_types=1);

require dirname(__DIR__) . '/vendor/autoload.php';

use app\adminapi\controller\tcm\DiagnosisController;
use app\adminapi\logic\tcm\DiagnosisLogic;
use app\adminapi\validate\tcm\DiagnosisValidate;

function callSignatureExpect(bool $condition, string $message): void
{
    if (!$condition) {
        throw new RuntimeException($message);
    }
}

function callSignatureMethodSource(ReflectionMethod $method): string
{
    $lines = file($method->getFileName());
    if (!is_array($lines)) {
        throw new RuntimeException('call signature source is readable');
    }

    return implode('', array_slice(
        $lines,
        $method->getStartLine() - 1,
        $method->getEndLine() - $method->getStartLine() + 1
    ));
}

$logicMethod = (new ReflectionClass(DiagnosisLogic::class))->getMethod('getCallSignature');
$logicSource = callSignatureMethodSource($logicMethod);
$controllerSource = callSignatureMethodSource(
    (new ReflectionClass(DiagnosisController::class))->getMethod('getCallSignature')
);
$validatorSource = callSignatureMethodSource(
    (new ReflectionClass(DiagnosisValidate::class))->getMethod('sceneCallIdentity')
);

callSignatureExpect(
    $logicMethod->getNumberOfParameters() === 2,
    'call signature accepts request params and authenticated admin context'
);
callSignatureExpect(
    str_contains($logicSource, 'canManageDiagnosis($diagnosisId, $adminId, $adminInfo)')
        && strpos($logicSource, 'canManageDiagnosis($diagnosisId, $adminId, $adminInfo)')
            < strpos($logicSource, "Diagnosis::where('id', \$diagnosisId)")
        && strpos($logicSource, "Diagnosis::where('id', \$diagnosisId)")
            < strpos($logicSource, 'self::getTrtcConfig()'),
    'row authorization and the exact diagnosis/patient pair are checked before TRTC work'
);
callSignatureExpect(
    str_contains($logicSource, "->where('patient_id', \$patientId)")
        && str_contains($logicSource, "'diagnosis_id' => \$diagnosisId")
        && str_contains($logicSource, "'patient_id' => \$patientId")
        && !str_contains($logicSource, "Diagnosis::where('id', \$patientId)"),
    'diagnosis id and source patient id stay distinct throughout the signature contract'
);
callSignatureExpect(
    str_contains($controllerSource, "goCheck('callIdentity')")
        && str_contains(
            $controllerSource,
            'DiagnosisLogic::getCallSignature($params, $this->adminInfo)'
        ),
    'controller validates both ids and forwards the authenticated row-scope context'
);
callSignatureExpect(
    str_contains($validatorSource, "only(['diagnosis_id', 'patient_id', 'appointment_id'])")
        && str_contains($validatorSource, "append('patient_id', 'require|integer|gt:0')"),
    'call identity validation requires positive diagnosis and patient ids'
);

$root = dirname(__DIR__, 2);
foreach (
    [
        $root . '/admin/src/views/tcm/appointment/list.vue',
        $root . '/admin/src/views/tcm/appointment/list_h5.vue',
        $root . '/admin/src/views/patient/reception/index.vue',
    ] as $callerPath
) {
    $caller = (string) file_get_contents($callerPath);
    callSignatureExpect(
        str_contains($caller, 'patient_id: sourcePatientId')
            && str_contains($caller, 'patientId: sourcePatientId')
            && str_contains($caller, 'diagnosis_id: diagnosisId'),
        basename($callerPath) . ' keeps appointment, diagnosis and source patient ids separate'
    );
}

echo "Call signature identity contract: OK\n";