<?php

declare(strict_types=1);

use App\Filament\Resources\BaselineProfileResource;
use App\Filament\Resources\BaselineSnapshotResource;
use App\Models\BaselineProfile;
use App\Models\BaselineSnapshot;
use App\Models\BaselineSnapshotItem;

it('renders the baseline snapshot detail page as summary-first with grouped policy browsing', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'readonly');

    $profile = BaselineProfile::factory()->active()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'name' => 'Security Baseline',
    ]);

    $snapshot = BaselineSnapshot::factory()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'baseline_profile_id' => (int) $profile->getKey(),
        'summary_jsonb' => [
            'total_items' => 3,
            'policy_type_counts' => [
                'intuneRoleDefinition' => 1,
                'deviceCompliancePolicy' => 1,
                'mysteryPolicyType' => 1,
            ],
            'fidelity_counts' => ['content' => 2, 'meta' => 1],
            'gaps' => ['count' => 1, 'by_reason' => ['meta_fallback' => 1]],
        ],
    ]);

    BaselineSnapshotItem::factory()->create([
        'baseline_snapshot_id' => (int) $snapshot->getKey(),
        'policy_type' => 'intuneRoleDefinition',
        'subject_key' => hash('sha256', 'intuneRoleDefinition|security-reader'),
        'subject_external_id' => hash('sha256', 'intuneRoleDefinition|security-reader'),
        'meta_jsonb' => [
            'display_name' => 'Security Reader',
            'evidence' => [
                'fidelity' => 'content',
                'source' => 'policy_version',
                'observed_at' => '2026-03-09T12:00:00+00:00',
            ],
            'identity' => ['strategy' => 'external_id'],
            'rbac' => [
                'is_built_in' => false,
                'role_permission_count' => 2,
            ],
            'version_reference' => ['policy_version_id' => 42],
        ],
    ]);

    BaselineSnapshotItem::factory()->create([
        'baseline_snapshot_id' => (int) $snapshot->getKey(),
        'policy_type' => 'deviceCompliancePolicy',
        'subject_key' => 'bitlocker require',
        'subject_external_id' => hash('sha256', 'deviceCompliancePolicy|bitlocker require'),
        'meta_jsonb' => [
            'display_name' => 'Bitlocker Require',
            'platform' => 'windows',
            'assignment_target_count' => 3,
            'evidence' => [
                'fidelity' => 'meta',
                'source' => 'inventory',
                'observed_at' => '2026-03-09T11:00:00+00:00',
            ],
        ],
    ]);

    BaselineSnapshotItem::factory()->create([
        'baseline_snapshot_id' => (int) $snapshot->getKey(),
        'policy_type' => 'mysteryPolicyType',
        'subject_key' => 'mystery policy',
        'subject_external_id' => hash('sha256', 'mysteryPolicyType|mystery policy'),
        'meta_jsonb' => [
            'display_name' => 'Mystery Policy',
            'platform' => 'windows',
            'evidence' => [
                'fidelity' => 'content',
                'source' => 'policy_version',
                'observed_at' => '2026-03-09T10:00:00+00:00',
            ],
        ],
    ]);

    $this->actingAs($user)
        ->get(BaselineSnapshotResource::getUrl('view', ['record' => $snapshot], panel: 'admin'))
        ->assertOk()
        ->assertSee('Related context')
        ->assertSee(BaselineProfileResource::getUrl('view', ['record' => $profile], panel: 'admin'), false)
        ->assertSeeInOrder(['Coverage summary', 'Captured policy types', 'Technical detail'])
        ->assertDontSee('No captured policy types are available in this snapshot.')
        ->assertDontSee('No snapshot items were captured for this baseline snapshot.')
        ->assertSee('Security Reader')
        ->assertSee('Bitlocker Require')
        ->assertSee('Mystery Policy')
        ->assertSee('Intune RBAC Role Definition')
        ->assertSee('Device Compliance')
        ->assertSee('Mystery Policy Type')
        ->assertDontSee('Intune RBAC Role Definition References');

    $this->actingAs($user)
        ->get(BaselineSnapshotResource::getUrl(panel: 'admin'))
        ->assertOk()
        ->assertSee('View baseline profile')
        ->assertSee(BaselineSnapshotResource::getUrl('view', ['record' => $snapshot], panel: 'admin'))
        ->assertDontSee('>View<', escape: false);
});