<?php
/**
 * Final regression sweep across account categories NOT specifically
 * targeted by the two prior verification scripts, for both endpoints
 * touched this session (api/account/state.php, api/trades/validate.php).
 * Read-only where possible; the validate.php POST for personal accounts
 * uses a trivially small risk_per_position so it can't trip the
 * capital-depletion auto-close branch.
 */
require_once __DIR__ . '/../config/config.php';

$base = 'http://localhost:8080/traderalign';
$cookieJar = tempnam(sys_get_temp_dir(), 'zzcookie3');

function loginAs(string $base, string $uid, string $cookieJar): void {
    $ch = curl_init("{$base}/public/_zz_test_autologin.php?uid=" . urlencode($uid));
    curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_COOKIEJAR => $cookieJar, CURLOPT_COOKIEFILE => $cookieJar]);
    curl_exec($ch);
    curl_close($ch);
}
function getJson(string $url, string $cookieJar): array {
    $ch = curl_init($url);
    curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_COOKIEJAR => $cookieJar, CURLOPT_COOKIEFILE => $cookieJar]);
    $resp = curl_exec($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    return [$code, $resp];
}
function postJson(string $url, array $payload, string $cookieJar): array {
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true, CURLOPT_COOKIEJAR => $cookieJar, CURLOPT_COOKIEFILE => $cookieJar,
        CURLOPT_POST => true, CURLOPT_POSTFIELDS => json_encode($payload),
        CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    ]);
    $resp = curl_exec($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    return [$code, $resp];
}

$cases = [
    'personal' => ['account' => '0781d281-fd6b-451a-aed7-f2e2b1c2fb86', 'user' => '99d8c913-3fa5-4479-bbab-631122fcd859'],
    'funded'   => ['account' => '03f94727-2811-48a2-bb79-3325c4d3de2a', 'user' => '278d5983-d646-494f-a130-b22f7c321867'],
    'breached' => ['account' => '006811b4-d262-4d8d-84b1-decd0468e2b6', 'user' => '278d5983-d646-494f-a130-b22f7c321867'],
    'instant'  => ['account' => '0997a457-05ef-4f17-a760-63d143454f68', 'user' => '278d5983-d646-494f-a130-b22f7c321867'],
];

$anyError = false;

foreach ($cases as $label => $c) {
    loginAs($base, $c['user'], $cookieJar);

    echo "=== {$label} ({$c['account']}) — GET /api/account/state ===\n";
    [$code, $resp] = getJson("{$base}/api/account/state?account_id=" . urlencode($c['account']), $cookieJar);
    echo "HTTP {$code}: {$resp}\n";
    if ($code !== 200 || stripos($resp, 'Warning') !== false || stripos($resp, 'Fatal error') !== false || json_decode($resp) === null) {
        $anyError = true;
        echo "!!! PROBLEM DETECTED\n";
    }

    echo "=== {$label} ({$c['account']}) — POST /api/trades/validate (risk=1) ===\n";
    [$code2, $resp2] = postJson("{$base}/api/trades/validate", ['account_id' => $c['account'], 'risk_per_position' => 1], $cookieJar);
    echo "HTTP {$code2}: {$resp2}\n\n";
    if ($code2 !== 200 || stripos($resp2, 'Warning') !== false || stripos($resp2, 'Fatal error') !== false || json_decode($resp2) === null) {
        $anyError = true;
        echo "!!! PROBLEM DETECTED\n";
    }
}

@unlink($cookieJar);
echo $anyError ? "\n=== SWEEP RESULT: PROBLEMS FOUND, SEE ABOVE ===\n" : "\n=== SWEEP RESULT: ALL CLEAN ===\n";
