<?php

declare(strict_types=1);

use App\Models\ManagedEnvironment;
use App\Models\User;
use App\Models\Workspace;
use App\Models\WorkspaceMembership;
use App\Support\Links\RequiredPermissionsLinks;
use App\Support\Workspaces\WorkspaceContext;

it('returns 200 for tenant-entitled readonly members on the canonical required permissions route', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'readonly');

    $this->actingAs($user)
    ->get(RequiredPermissionsLinks::requiredPermissions($tenant))
        ->assertOk();
});

it('returns 404 for workspace members without tenant entitlement on the canonical route', function (): void {
    $user = User::factory()->create();
    $workspace = Workspace::factory()->create();
    $tenant = ManagedEnvironment::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
    ]);
    $allowedTenant = ManagedEnvironment::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
    ]);

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'owner',
    ]);
    $user->tenants()->syncWithoutDetaching([
        $allowedTenant->getKey() => ['role' => 'owner'],
    ]);
    app(\App\Services\Auth\CapabilityResolver::class)->clearCache();

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $workspace->getKey(),
        ])
        ->get(RequiredPermissionsLinks::requiredPermissions($tenant))
        ->assertNotFound();
});

it('returns 404 for non-workspace-members with stale session', function (): void {
    $user = User::factory()->create();
    $workspace = Workspace::factory()->create();
    $tenant = ManagedEnvironment::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
    ]);

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $workspace->getKey(),
        ])
        ->get(RequiredPermissionsLinks::requiredPermissions($tenant))
        ->assertNotFound();
});

it('returns 404 when the route tenant is invalid instead of falling back to the current tenant context', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'readonly');

    ManagedEnvironment::query()->whereKey((int) $tenant->getKey())->update(['is_current' => true]);

    $this->actingAs($user)
        ->get(sprintf(
            '/admin/workspaces/%s/environments/invalid-tenant-id/required-permissions',
            $tenant->workspace->slug,
        ))
        ->assertNotFound();
});
