<?php

declare(strict_types=1);

use App\Models\BaselineSnapshotItem;
use App\Services\Baselines\SnapshotRendering\Renderers\IntuneRoleDefinitionSnapshotTypeRenderer;

it('renders RBAC-specific enrichment on top of the shared item contract', function (): void {
    $renderer = new IntuneRoleDefinitionSnapshotTypeRenderer;

    $item = new BaselineSnapshotItem([
        'policy_type' => 'intuneRoleDefinition',
        'subject_key' => hash('sha256', 'intuneRoleDefinition|security-reader'),
        'subject_external_id' => hash('sha256', 'intuneRoleDefinition|security-reader'),
        'meta_jsonb' => [
            'display_name' => 'Security Reader',
            'platform' => 'all',
            'evidence' => [
                'fidelity' => 'content',
                'source' => 'policy_version',
                'observed_at' => '2026-03-09T12:00:00+00:00',
            ],
            'identity' => [
                'strategy' => 'external_id',
            ],
            'version_reference' => [
                'policy_version_id' => 42,
            ],
            'rbac' => [
                'is_built_in' => false,
                'role_permission_count' => 2,
            ],
        ],
    ]);

    $rendered = $renderer->render($item)->toArray();
    $attributes = collect($rendered['structuredAttributes'])->keyBy('label');

    expect($rendered['label'])->toBe('Security Reader')
        ->and($rendered['fidelity'])->toBe('full')
        ->and($attributes['Role source']['value'])->toBe('Custom')
        ->and($attributes['Permission blocks']['value'])->toBe('2')
        ->and($attributes['Identity']['value'])->toBe('Role definition ID')
        ->and($attributes['Policy version']['value'])->toBe('#42');
});
