<?php
/**
 * CLI-only security smoke checks. Run: php run-acc-security-verify.php
 */
declare(strict_types=1);

if ( PHP_SAPI !== 'cli' && PHP_SAPI !== 'phpdbg' ) {
	http_response_code( 403 );
	exit( 'CLI only' );
}

require __DIR__ . '/standalone/config.php';

$checks = [];
$checks['auth_mode_not_mock_by_default'] = ACC_AUTH_MODE !== 'mock' || getenv( 'ACC_ENABLE_MOCK_AUTH' ) === '1';
$checks['jwt_secret_rotated'] = ACC_JWT_SECRET !== '6f9a2b8c4d1e7f3a5b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f'
	&& ACC_JWT_SECRET !== 'CHANGE_THIS_SECRET_KEY'
	&& strlen( ACC_JWT_SECRET ) >= 32;
$checks['demo_endpoints_off'] = ! ACC_ENABLE_DEMO_ENDPOINTS;

$token = acc_issue_opaque_token( 'rw_', 42, 60 );
$checks['opaque_resolve_ok'] = acc_resolve_opaque_token( 'rw_', $token ) === 42;
$checks['opaque_reject_base64_id'] = acc_resolve_opaque_token( 'rw_', 'rw_' . base64_encode( '42' ) ) === 0;

$fail = 0;
foreach ( $checks as $name => $ok ) {
	echo ( $ok ? '[OK] ' : '[FAIL] ' ) . $name . PHP_EOL;
	if ( ! $ok ) {
		$fail++;
	}
}
echo 'AUTH_MODE=' . ACC_AUTH_MODE . PHP_EOL;
exit( $fail > 0 ? 1 : 0 );
