<?php

declare(strict_types=1);

use App\Support\Providers\Boundary\ProviderBoundaryCatalog;

it('pins the spec 288 platform-core provider boundary inventory to the documented seams', function (): void {
    $catalog = app(ProviderBoundaryCatalog::class);

    $expectedPlatformCoreSeams = [
        'provider.identity_resolution' => [
            'paths' => [
                'app/Services/Providers/ProviderIdentityResolution.php',
                'app/Services/Providers/ProviderIdentityResolver.php',
                'app/Services/Providers/PlatformProviderIdentityResolver.php',
            ],
            'neutral_terms' => [
                'provider connection',
                'target scope',
                'credential source',
                'effective client identity',
                'provider context',
            ],
        ],
        'provider.operation_registry' => [
            'paths' => [
                'app/Services/Providers/ProviderOperationRegistry.php',
            ],
            'neutral_terms' => [
                'operation type',
                'operation module',
                'required capability',
                'provider binding',
                'unsupported binding',
            ],
        ],
        'provider.operation_start_gate' => [
            'paths' => [
                'app/Services/Providers/ProviderOperationStartGate.php',
            ],
            'neutral_terms' => [
                'operation',
                'provider binding',
                'target scope',
                'execution authority',
                'required capability',
            ],
        ],
    ];

    foreach ($expectedPlatformCoreSeams as $seamKey => $expectations) {
        $seam = $catalog->get($seamKey);

        expect($seam->isPlatformCore())->toBeTrue("Expected [{$seamKey}] to remain platform-core.")
            ->and($seam->implementationPaths)->toEqualCanonicalizing($expectations['paths'])
            ->and($seam->neutralTerms)->toEqualCanonicalizing($expectations['neutral_terms'])
            ->and($seam->followUpAction)->toBe('document-in-feature');
    }
});

it('keeps managed-environment scope persistence narrowing-only in the role-authority seam', function (): void {
    $tenantMembershipManager = base_path('app/Services/Auth/ManagedEnvironmentMembershipManager.php');

    expect(is_file($tenantMembershipManager))->toBeTrue('Expected ManagedEnvironmentMembershipManager.php to exist for the narrowing-only role-authority guard.');

    $contents = (string) file_get_contents($tenantMembershipManager);

    expect($contents)
        ->toContain("private const string SCOPE_PLACEHOLDER_ROLE = 'readonly';")
        ->toContain("'role' => self::SCOPE_PLACEHOLDER_ROLE,")
        ->toContain("Managed-environment access scopes do not manage roles. Change the workspace role instead.")
        ->not->toContain("'role' => \$memberWorkspaceRole")
        ->not->toContain("'role' => \$newRole");
});