<?php

declare(strict_types=1);

use App\Filament\Pages\Operations\TenantlessOperationRunViewer;
use App\Models\BaselineProfile;
use App\Models\BaselineSnapshot;
use App\Models\ManagedEnvironment;
use App\Models\OperationRun;
use App\Models\User;
use App\Models\Workspace;
use App\Models\WorkspaceMembership;
use App\Support\Inventory\InventoryCoverage as InventoryCoveragePayload;
use App\Support\Navigation\CanonicalNavigationContext;
use App\Support\OperationRunLinks;
use App\Support\OperationRunOutcome;
use App\Support\OperationRunStatus;
use App\Support\OpsUx\RunDetailPolling;
use App\Support\TenantRole;
use App\Support\Workspaces\WorkspaceContext;
use Filament\Facades\Filament;
use Illuminate\Support\Facades\Http;
use Livewire\Livewire;

beforeEach(function (): void {
    Http::preventStrayRequests();
});

it('allows viewing an operation run without a selected workspace when the user is a member of the run workspace', function (): void {
    $workspace = Workspace::factory()->create();
    $user = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'owner',
    ]);

    session()->forget(WorkspaceContext::SESSION_KEY);

    $run = OperationRun::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'managed_environment_id' => null,
        'type' => 'provider.connection.check',
        'status' => OperationRunStatus::Queued->value,
        'outcome' => OperationRunOutcome::Pending->value,
    ]);

    $this->actingAs($user)
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful();

    expect(session()->get(WorkspaceContext::SESSION_KEY))->toBe((int) $workspace->getKey());
});

it('returns 404 for non-members when viewing an operation run without a selected workspace', function (): void {
    $workspace = Workspace::factory()->create();
    $user = User::factory()->create();

    session()->forget(WorkspaceContext::SESSION_KEY);

    $run = OperationRun::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'managed_environment_id' => null,
        'type' => 'provider.connection.check',
        'status' => OperationRunStatus::Queued->value,
        'outcome' => OperationRunOutcome::Pending->value,
    ]);

    $this->actingAs($user)
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertNotFound();
});

it('serves hashed Livewire update requests for canonical run pages without a selected workspace', function (): void {
    $workspace = Workspace::factory()->create();
    $user = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'readonly',
    ]);

    session()->forget(WorkspaceContext::SESSION_KEY);

    $run = OperationRun::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'managed_environment_id' => null,
        'type' => 'provider.connection.check',
        'status' => OperationRunStatus::Queued->value,
        'outcome' => OperationRunOutcome::Pending->value,
    ]);

    $response = $this->actingAs($user)
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()));

    $response->assertSuccessful();

    preg_match_all('/wire:snapshot="([^"]+)"/', (string) $response->getContent(), $snapshotMatches);

    expect($snapshotMatches[1] ?? [])->not->toBeEmpty('No Livewire snapshots found in canonical run viewer HTML');

    $updateUri = '/'.collect(app('router')->getRoutes()->getRoutes())
        ->first(fn ($route): bool => str_contains((string) $route->getName(), 'livewire.update'))
        ?->uri();

    expect($updateUri)->toBeString();

    $failures = [];

    foreach ($snapshotMatches[1] as $encodedSnapshot) {
        $snapshot = htmlspecialchars_decode($encodedSnapshot);
        $decodedSnapshot = json_decode($snapshot, true);
        $componentName = data_get($decodedSnapshot, 'memo.name', 'unknown');

        $updateResponse = $this->actingAs($user)
            ->withHeaders([
                'X-Livewire' => 'true',
                'referer' => OperationRunLinks::tenantlessView((int) $run->getKey()),
            ])
            ->postJson($updateUri, [
                'components' => [[
                    'snapshot' => $snapshot,
                    'updates' => new stdClass,
                    'calls' => [],
                ]],
            ]);

        if (! $updateResponse->isSuccessful()) {
            $failures[] = [
                'component' => $componentName,
                'status' => $updateResponse->getStatusCode(),
            ];
        }
    }

    expect($failures)->toBe([]);
});

it('returns 403 for members missing the required capability for the operation type', function (): void {
    $workspace = Workspace::factory()->create();
    $tenant = ManagedEnvironment::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
    ]);

    $user = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'readonly',
    ]);

    $tenant->users()->attach((int) $user->getKey(), [
        'role' => TenantRole::Readonly->value,
        'source' => 'manual',
        'source_ref' => null,
        'created_by_user_id' => null,
    ]);

    session()->forget(WorkspaceContext::SESSION_KEY);

    $run = OperationRun::factory()->create([
        'managed_environment_id' => (int) $tenant->getKey(),
        'workspace_id' => (int) $workspace->getKey(),
        'type' => 'inventory_sync',
        'status' => OperationRunStatus::Queued->value,
        'outcome' => OperationRunOutcome::Pending->value,
    ]);

    $this->actingAs($user)
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertForbidden();
});

it('shows blocked execution guidance in the canonical tenantless viewer', function (): void {
    $tenant = ManagedEnvironment::factory()->create();
    [$user, $tenant] = createUserWithTenant(tenant: $tenant, role: 'owner');

    $run = OperationRun::factory()->create([
        'managed_environment_id' => (int) $tenant->getKey(),
        'workspace_id' => (int) $tenant->workspace_id,
        'user_id' => (int) $user->getKey(),
        'type' => 'inventory_sync',
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::Blocked->value,
        'context' => [
            'reason_code' => 'missing_capability',
            'blocked_by' => 'queued_execution_legitimacy',
            'execution_legitimacy' => [
                'reason_code' => 'missing_capability',
            ],
        ],
        'failure_summary' => [[
            'code' => 'operation.blocked',
            'reason_code' => 'missing_capability',
            'message' => 'Operation blocked because the initiating actor no longer has the required capability.',
        ]],
    ]);

    Filament::setTenant($tenant, true);

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee('Blocked by prerequisite')
        ->assertSee('Blocked reason')
        ->assertSee('Blocked detail')
        ->assertSee('Execution legitimacy revalidation')
        ->assertSee('Permission required')
        ->assertSee('missing_capability')
        ->assertSee('capability required for this queued run')
        ->assertSee('Review workspace or tenant access before retrying.');
});

it('keeps reconciled lifecycle runs viewable for entitled members', function (): void {
    $tenant = ManagedEnvironment::factory()->create();
    [$user, $tenant] = createUserWithTenant(tenant: $tenant, role: 'owner');

    $run = OperationRun::factory()->create([
        'managed_environment_id' => (int) $tenant->getKey(),
        'workspace_id' => (int) $tenant->workspace_id,
        'user_id' => (int) $user->getKey(),
        'type' => 'restore.execute',
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::Failed->value,
        'context' => [
            'reason_code' => 'run.infrastructure_timeout_or_abandonment',
            'reconciliation' => [
                'reconciled_at' => now('UTC')->toIso8601String(),
                'reason' => 'Infrastructure ended the run before completion.',
                'reason_code' => 'run.infrastructure_timeout_or_abandonment',
                'reason_message' => 'Infrastructure ended the run before completion.',
                'source' => 'failed_callback',
                'evidence' => [
                    'exception_class' => 'TimeoutExceededException',
                ],
            ],
        ],
        'failure_summary' => [[
            'code' => 'operation.failed',
            'reason_code' => 'run.infrastructure_timeout_or_abandonment',
            'message' => 'Infrastructure ended the run before completion.',
        ]],
    ]);

    Filament::setTenant(null, true);

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee('Automatically reconciled')
        ->assertSee('Infrastructure ended the run')
        ->assertSee('Review worker health and logs before retrying this operation.');

    $response = $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful();

    $pageText = trim((string) preg_replace('/\s+/', ' ', strip_tags((string) $response->getContent())));

    expect(mb_substr_count($pageText, 'Automatically reconciled'))->toBe(1);
});

it('keeps a canonical run viewer accessible when the remembered environment differs from the run tenant', function (): void {
    $workspace = Workspace::factory()->create();
    $tenantA = ManagedEnvironment::factory()->for($workspace)->create();
    $tenantB = ManagedEnvironment::factory()->for($workspace)->create();
    $user = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'owner',
    ]);

    foreach ([$tenantA, $tenantB] as $tenant) {
        $tenant->users()->attach((int) $user->getKey(), [
            'role' => TenantRole::Owner->value,
            'source' => 'manual',
            'source_ref' => null,
            'created_by_user_id' => null,
        ]);
    }

    $run = OperationRun::factory()->create([
        'managed_environment_id' => (int) $tenantA->getKey(),
        'workspace_id' => (int) $workspace->getKey(),
        'type' => 'inventory_sync',
        'status' => OperationRunStatus::Queued->value,
        'outcome' => OperationRunOutcome::Pending->value,
    ]);

    Filament::setTenant($tenantB, true);

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $workspace->getKey(),
            WorkspaceContext::LAST_ENVIRONMENT_IDS_SESSION_KEY => [
                (string) $workspace->getKey() => (int) $tenantB->getKey(),
            ],
        ])
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee(OperationRunLinks::identifier($run))
        ->assertSee('Back to Operations');
});

it('keeps tenantless run viewing accessible while another tenant is selected', function (): void {
    $selectedTenant = ManagedEnvironment::factory()->create();
    [$user, $selectedTenant] = createUserWithTenant(tenant: $selectedTenant, role: 'owner');

    $run = OperationRun::factory()->create([
        'workspace_id' => (int) $selectedTenant->workspace_id,
        'managed_environment_id' => null,
        'type' => 'provider.connection.check',
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::Succeeded->value,
    ]);

    Filament::setTenant($selectedTenant, true);

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $selectedTenant->workspace_id,
            WorkspaceContext::LAST_ENVIRONMENT_IDS_SESSION_KEY => [
                (string) $selectedTenant->workspace_id => (int) $selectedTenant->getKey(),
            ],
        ])
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee('Workspace-level operation')
        ->assertSee('This canonical workspace view is not tied to the current environment context');
});

it('keeps a canonical run viewer accessible when remembered environment context is cleared as stale', function (): void {
    $runTenant = ManagedEnvironment::factory()->active()->create([
        'name' => 'Viewer Run ManagedEnvironment',
    ]);
    [$user, $runTenant] = createUserWithTenant(tenant: $runTenant, role: 'owner');

    $rememberedEnvironment = ManagedEnvironment::factory()->onboarding()->create([
        'workspace_id' => (int) $runTenant->workspace_id,
        'name' => 'Viewer Onboarding ManagedEnvironment',
    ]);

    createUserWithTenant(
        tenant: $rememberedEnvironment,
        user: $user,
        role: 'owner',
        workspaceRole: 'owner',
        ensureDefaultMicrosoftProviderConnection: false,
    );

    $run = OperationRun::factory()->create([
        'managed_environment_id' => (int) $runTenant->getKey(),
        'workspace_id' => (int) $runTenant->workspace_id,
        'type' => 'inventory_sync',
        'status' => OperationRunStatus::Queued->value,
        'outcome' => OperationRunOutcome::Pending->value,
    ]);

    Filament::setTenant(null, true);

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $runTenant->workspace_id,
            WorkspaceContext::LAST_ENVIRONMENT_IDS_SESSION_KEY => [
                (string) $runTenant->workspace_id => (int) $rememberedEnvironment->getKey(),
            ],
        ])
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee(__('localization.shell.all_environments'))
        ->assertSee('Canonical workspace view')
        ->assertSee('No environment context is currently selected.');
});

it('keeps a canonical run viewer accessible when the run tenant is selector-ineligible but the remembered context is valid', function (): void {
    $rememberedEnvironment = ManagedEnvironment::factory()->active()->create([
        'name' => 'Viewer Active ManagedEnvironment',
    ]);
    [$user, $rememberedEnvironment] = createUserWithTenant(tenant: $rememberedEnvironment, role: 'owner');

    $runTenant = ManagedEnvironment::factory()->onboarding()->create([
        'workspace_id' => (int) $rememberedEnvironment->workspace_id,
        'name' => 'Viewer Onboarding ManagedEnvironment',
    ]);

    createUserWithTenant(
        tenant: $runTenant,
        user: $user,
        role: 'owner',
        workspaceRole: 'owner',
        ensureDefaultMicrosoftProviderConnection: false,
    );

    $run = OperationRun::factory()->create([
        'managed_environment_id' => (int) $runTenant->getKey(),
        'workspace_id' => (int) $rememberedEnvironment->workspace_id,
        'type' => 'inventory_sync',
        'status' => OperationRunStatus::Queued->value,
        'outcome' => OperationRunOutcome::Pending->value,
    ]);

    Filament::setTenant(null, true);

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $rememberedEnvironment->workspace_id,
            WorkspaceContext::LAST_ENVIRONMENT_IDS_SESSION_KEY => [
                (string) $rememberedEnvironment->workspace_id => (int) $rememberedEnvironment->getKey(),
            ],
        ])
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee('Current environment context differs from this operation')
        ->assertSee('Operation environment: '.$runTenant->name.'.')
        ->assertSee('Back to Operations');
});

it('renders stored target scope and failure details for a completed run', function (): void {
    $workspace = Workspace::factory()->create();
    $user = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'owner',
    ]);

    session()->forget(WorkspaceContext::SESSION_KEY);

    $entraTenantId = '11111111-1111-1111-1111-111111111111';
    $failureMessage = 'Missing required Graph permissions.';

    $run = OperationRun::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'managed_environment_id' => null,
        'type' => 'provider.connection.check',
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::Failed->value,
        'context' => [
            'target_scope' => [
                'entra_tenant_id' => $entraTenantId,
                'entra_tenant_name' => 'Contoso',
            ],
        ],
        'failure_summary' => [
            [
                'code' => 'provider.connection.check.failed',
                'reason_code' => 'permission_denied',
                'message' => $failureMessage,
            ],
        ],
    ]);

    $this->actingAs($user)
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee($entraTenantId)
        ->assertSee('permission_denied')
        ->assertSee($failureMessage);
});

it('renders explicit back-link lineage when opened from a canonical source context', function (): void {
    $workspace = Workspace::factory()->create();
    $tenant = ManagedEnvironment::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
    ]);
    $user = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'owner',
    ]);

    $tenant->users()->attach((int) $user->getKey(), [
        'role' => TenantRole::Owner->value,
        'source' => 'manual',
        'source_ref' => null,
        'created_by_user_id' => null,
    ]);

    $run = OperationRun::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'managed_environment_id' => (int) $tenant->getKey(),
        'type' => 'backup_set.update',
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::Succeeded->value,
    ]);

    $context = new CanonicalNavigationContext(
        sourceSurface: 'backup_set.detail_section',
        canonicalRouteName: 'admin.operations.view',
        tenantId: (int) $tenant->getKey(),
        backLinkLabel: 'Back to backup set',
        backLinkUrl: '/admin/tenant/backup-sets/1',
    );

    $this->actingAs($user)
        ->withSession([WorkspaceContext::SESSION_KEY => (int) $workspace->getKey()])
        ->get(OperationRunLinks::tenantlessView($run, $context))
        ->assertSuccessful()
        ->assertSee('Back to backup set')
        ->assertSee('/admin/tenant/backup-sets/1', false);
});

it('keeps the explicit back-link action after Livewire hydration', function (): void {
    $workspace = Workspace::factory()->create();
    $tenant = ManagedEnvironment::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
    ]);
    $user = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'owner',
    ]);

    $tenant->users()->attach((int) $user->getKey(), [
        'role' => TenantRole::Owner->value,
        'source' => 'manual',
        'source_ref' => null,
        'created_by_user_id' => null,
    ]);

    $run = OperationRun::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'managed_environment_id' => (int) $tenant->getKey(),
        'type' => 'baseline_compare',
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::Succeeded->value,
    ]);

    $this->withSession([WorkspaceContext::SESSION_KEY => (int) $workspace->getKey()]);
    session([WorkspaceContext::SESSION_KEY => (int) $workspace->getKey()]);

    Livewire::withQueryParams([
        'nav' => [
            'source_surface' => 'finding.detail_section',
            'canonical_route_name' => 'admin.operations.view',
            'managed_environment_id' => (int) $tenant->getKey(),
            'back_label' => 'Back to finding',
            'back_url' => '/admin/findings/42?tenant='.$tenant->external_id,
        ],
    ])
        ->actingAs($user)
        ->test(\App\Filament\Pages\Operations\TenantlessOperationRunViewer::class, ['run' => $run])
        ->assertActionVisible('operate_hub_back_to_origin_run_detail');
});

it('renders the canonical tenantless viewer as a layered monitoring detail surface', function (): void {
    $workspace = Workspace::factory()->create();
    $user = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'owner',
    ]);

    session()->forget(WorkspaceContext::SESSION_KEY);

    $run = OperationRun::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'managed_environment_id' => null,
        'type' => 'provider.connection.check',
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::Succeeded->value,
    ]);

    $this->actingAs($user)
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee('Monitoring detail')
        ->assertSee('Navigation lane')
        ->assertSee('Utility lane')
        ->assertSee('Related drilldown')
        ->assertSee('Follow-up lane')
        ->assertSee('Refresh keeps the current run state accurate without changing scope.')
        ->assertSee('No run-specific follow-up is currently available.')
        ->assertDontSee('Resume capture');
});

it('surfaces resumable follow-up separately from navigation and drilldown lanes', function (): void {
    $tenant = ManagedEnvironment::factory()->create();
    [$user, $tenant] = createUserWithTenant(tenant: $tenant, role: 'owner');

    $run = OperationRun::factory()->create([
        'managed_environment_id' => (int) $tenant->getKey(),
        'workspace_id' => (int) $tenant->workspace_id,
        'type' => 'baseline_compare',
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::PartiallySucceeded->value,
        'context' => [
            'baseline_compare' => [
                'resume_token' => 'resume-spec-193',
            ],
        ],
    ]);

    Filament::setTenant(null, true);

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee('Monitoring detail')
        ->assertSee('Follow-up lane')
        ->assertSee('Resume capture')
        ->assertSee('Resume capture only appears when this run supports additional evidence collection.')
        ->assertSee('Related drilldown');
});

it('keeps operations-list navigation out of the related drilldown lane', function (): void {
    $tenant = ManagedEnvironment::factory()->create();
    [$user, $tenant] = createUserWithTenant(tenant: $tenant, role: 'owner');

    $profile = BaselineProfile::factory()->active()->create([
        'workspace_id' => (int) $tenant->workspace_id,
    ]);

    $snapshot = BaselineSnapshot::factory()->complete()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'baseline_profile_id' => (int) $profile->getKey(),
    ]);

    $run = OperationRun::factory()->create([
        'managed_environment_id' => (int) $tenant->getKey(),
        'workspace_id' => (int) $tenant->workspace_id,
        'type' => 'baseline_compare',
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::Succeeded->value,
        'context' => [
            'baseline_profile_id' => (int) $profile->getKey(),
            'baseline_snapshot_id' => (int) $snapshot->getKey(),
        ],
    ]);

    Filament::setTenant($tenant, true);
    session()->put(WorkspaceContext::SESSION_KEY, (int) $tenant->workspace_id);

    $this->actingAs($user);

    Livewire::test(TenantlessOperationRunViewer::class, ['run' => $run])
        ->assertActionVisible('view_baseline_profile')
        ->assertActionVisible('view_snapshot')
        ->assertActionDoesNotExist('operations')
        ->assertActionDoesNotExist('open_operations');

    $this
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee('Monitoring detail')
        ->assertSee('Open keeps secondary drilldowns grouped under one control: View baseline profile, View snapshot.');
});

it('renders shared polling markup for active tenantless runs', function (string $status, int $ageSeconds): void {
    $workspace = Workspace::factory()->create();
    $user = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'owner',
    ]);

    session()->forget(WorkspaceContext::SESSION_KEY);

    $run = OperationRun::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'managed_environment_id' => null,
        'type' => 'provider.connection.check',
        'status' => $status,
        'outcome' => OperationRunOutcome::Pending->value,
        'created_at' => now()->subSeconds($ageSeconds),
    ]);

    $expectedInterval = RunDetailPolling::interval($run);

    expect($expectedInterval)->not->toBeNull();

    $this->actingAs($user)
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee("wire:poll.{$expectedInterval}", escape: false);
})->with([
    'queued runs poll every second at startup' => [
        OperationRunStatus::Queued->value,
        5,
    ],
    'running runs slow to five seconds after startup' => [
        OperationRunStatus::Running->value,
        30,
    ],
]);

it('does not render visibility sync Livewire updates for tenantless runs', function (): void {
    $workspace = Workspace::factory()->create();
    $user = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'owner',
    ]);

    session()->forget(WorkspaceContext::SESSION_KEY);

    $run = OperationRun::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'managed_environment_id' => null,
        'type' => 'provider.connection.check',
        'status' => OperationRunStatus::Queued->value,
        'outcome' => OperationRunOutcome::Pending->value,
        'created_at' => now()->subSeconds(5),
    ]);

    $this->actingAs($user)
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertDontSee("opsUxIsTabHidden', document.hidden", escape: false)
        ->assertDontSee('visibilitychange.window', escape: false)
        ->assertSee('wire:poll.1s', escape: false);
});

it('does not render polling markup for terminal tenantless runs', function (string $outcome): void {
    $workspace = Workspace::factory()->create();
    $user = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'owner',
    ]);

    session()->forget(WorkspaceContext::SESSION_KEY);

    $run = OperationRun::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'managed_environment_id' => null,
        'type' => 'provider.connection.check',
        'status' => OperationRunStatus::Completed->value,
        'outcome' => $outcome,
        'created_at' => now()->subMinutes(2),
    ]);

    $this->actingAs($user)
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertDontSee('wire:poll.1s', escape: false)
        ->assertDontSee('wire:poll.5s', escape: false)
        ->assertDontSee('wire:poll.10s', escape: false);
})->with([
    'succeeded runs stay stable' => OperationRunOutcome::Succeeded->value,
    'failed runs stay stable' => OperationRunOutcome::Failed->value,
]);

it('renders human-readable per-type inventory coverage in the canonical tenantless viewer', function (): void {
    $tenant = ManagedEnvironment::factory()->create();
    [$user, $tenant] = createUserWithTenant(tenant: $tenant, role: 'owner');

    $run = OperationRun::factory()->create([
        'managed_environment_id' => (int) $tenant->getKey(),
        'workspace_id' => (int) $tenant->workspace_id,
        'type' => 'inventory_sync',
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::PartiallySucceeded->value,
        'context' => [
            'inventory' => [
                'coverage' => InventoryCoveragePayload::buildPayload([
                    'conditionalAccessPolicy' => [
                        'status' => InventoryCoveragePayload::StatusSucceeded,
                        'item_count' => 1,
                    ],
                    'deviceConfiguration' => [
                        'status' => InventoryCoveragePayload::StatusFailed,
                        'item_count' => 0,
                        'error_code' => 'graph_forbidden',
                    ],
                ], []),
            ],
        ],
        'completed_at' => now(),
    ]);

    Filament::setTenant(null, true);

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get(OperationRunLinks::tenantlessView((int) $run->getKey()))
        ->assertSuccessful()
        ->assertSee('Inventory sync coverage')
        ->assertSee('Execution outcome stays separate from the per-type results below.')
        ->assertSee('deviceConfiguration')
        ->assertSee('Review provider consent or permissions, then rerun inventory sync.');
});
