<?php

declare(strict_types=1);

it('prevents platform consent and runtime builders from reading legacy tenant credential fields', function (): void {
    $root = base_path();

    $files = [
        'app/Filament/Resources/ManagedEnvironmentResource.php',
        'app/Support/Links/RequiredPermissionsLinks.php',
        'app/Services/Providers/AdminConsentUrlFactory.php',
        'app/Services/Providers/ProviderGateway.php',
        'app/Services/Providers/MicrosoftGraphOptionsResolver.php',
    ];

    $patterns = [
        '/->app_client_id\b/',
        '/->app_client_secret\b/',
    ];

    $hits = [];

    foreach ($files as $relativePath) {
        $absolutePath = $root.'/'.$relativePath;

        if (! is_file($absolutePath)) {
            continue;
        }

        $contents = file_get_contents($absolutePath);

        if (! is_string($contents) || $contents === '') {
            continue;
        }

        if ($relativePath === 'app/Filament/Resources/ManagedEnvironmentResource.php') {
            preg_match('/public static function adminConsentUrl\(ManagedEnvironment \$tenant\): \?string\s*\{(?P<body>.*?)^    \}/ms', $contents, $matches);
            $contents = is_string($matches['body'] ?? null) ? (string) $matches['body'] : '';
        }

        $lines = preg_split('/\R/', $contents) ?: [];

        foreach ($patterns as $pattern) {
            foreach ($lines as $index => $line) {
                if (preg_match($pattern, $line) === 1) {
                    $hits[] = $relativePath.':'.($index + 1).' -> '.trim($line);
                }
            }
        }
    }

    expect($hits)->toBeEmpty("Legacy tenant credential reads detected in platform builders:\n".implode("\n", $hits));
});

it('prevents platform consent and runtime builders from reading provider credential payloads directly', function (): void {
    $root = base_path();

    $files = [
        'app/Filament/Resources/ManagedEnvironmentResource.php',
        'app/Support/Links/RequiredPermissionsLinks.php',
        'app/Services/Providers/AdminConsentUrlFactory.php',
        'app/Services/Providers/ProviderConnectionResolver.php',
        'app/Services/Providers/ProviderGateway.php',
        'app/Services/Providers/MicrosoftGraphOptionsResolver.php',
    ];

    $patterns = [
        '/->credential\b/',
        '/->payload\b/',
    ];

    $hits = [];

    foreach ($files as $relativePath) {
        $absolutePath = $root.'/'.$relativePath;

        if (! is_file($absolutePath)) {
            continue;
        }

        $contents = file_get_contents($absolutePath);

        if (! is_string($contents) || $contents === '') {
            continue;
        }

        if ($relativePath === 'app/Filament/Resources/ManagedEnvironmentResource.php') {
            preg_match('/public static function adminConsentUrl\(ManagedEnvironment \$tenant\): \?string\s*\{(?P<body>.*?)^    \}/ms', $contents, $matches);
            $contents = is_string($matches['body'] ?? null) ? (string) $matches['body'] : '';
        }

        $lines = preg_split('/\R/', $contents) ?: [];

        foreach ($patterns as $pattern) {
            foreach ($lines as $index => $line) {
                if (preg_match($pattern, $line) === 1) {
                    $hits[] = $relativePath.':'.($index + 1).' -> '.trim($line);
                }
            }
        }
    }

    expect($hits)->toBeEmpty("Provider credential payload fallback detected in platform builders:\n".implode("\n", $hits));
});
