<?php
if (PHP_SAPI !== 'cli') { http_response_code(404); exit; }
require_once __DIR__ . '/../classes/Base.php';
$dsn = getenv('HCR_TEST_DSN');
if (!$dsn) throw new RuntimeException('Set HCR_TEST_DSN to an isolated test server.');
$db = new PDO($dsn, getenv('HCR_TEST_USER') ?: 'root', getenv('HCR_TEST_PASSWORD') ?: '', [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$action = $argv[1] ?? '';
$name = $argv[2] ?? ('hcr_http_test_' . bin2hex(random_bytes(6)));
if (!preg_match('/\Ahcr_http_test_[a-f0-9]{12}\z/', $name)) throw new RuntimeException('Only generated test databases may be used.');
if ($action === 'drop') { $db->exec("DROP DATABASE `{$name}`"); exit; }
if ($action === 'create') {
    $db->exec("CREATE DATABASE `{$name}` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci");
    $db->exec("USE `{$name}`");
    require __DIR__ . '/../tables/users.php'; $db->exec($SQL);
    // The CLI migration must also support being run against a fresh users table.
    putenv('HCR_DB_NAME=' . $name);
    require __DIR__ . '/../bin/migrate-auth.php';
    // Idempotent migration is verified separately by the HTTP test runner.
    echo json_encode(['database' => $name]);
    exit;
}
$db->exec("USE `{$name}`");
if ($action === 'revoke') {
    $db->exec("UPDATE users SET user_auth_version = user_auth_version + 1 WHERE user_name = 'httpuser'");
    exit;
}
if ($action === 'token') {
    $id = $db->query("SELECT user_serial FROM users WHERE user_name = 'httpuser'")->fetchColumn();
    $token = bin2hex(random_bytes(32));
    $stmt = $db->prepare('INSERT INTO password_resets (token_hash, user_serial, expires_at) VALUES (?, ?, DATE_ADD(UTC_TIMESTAMP(), INTERVAL 30 MINUTE))');
    $stmt->execute([hash('sha256', $token), $id]);
    echo json_encode(['token' => $token]);
}