<?php

declare(strict_types=1);

use App\Filament\Resources\BackupScheduleResource;
use App\Models\BackupSchedule;
use App\Models\Tenant;
use App\Support\Workspaces\WorkspaceContext;
use Filament\Facades\Filament;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

it('returns not found for admin backup-schedule edit outside the canonical tenant scope', function (): void {
    $tenantA = Tenant::factory()->create();
    [$user, $tenantA] = createUserWithTenant(tenant: $tenantA, role: 'owner');
    $tenantB = Tenant::factory()->create(['workspace_id' => (int) $tenantA->workspace_id]);
    createUserWithTenant(tenant: $tenantB, user: $user, role: 'owner');

    $allowed = BackupSchedule::create([
        'tenant_id' => $tenantA->id,
        'name' => 'Allowed schedule',
        'is_enabled' => true,
        'timezone' => 'UTC',
        'frequency' => 'daily',
        'time_of_day' => '10:00:00',
        'days_of_week' => null,
        'policy_types' => ['deviceConfiguration'],
        'include_foundations' => true,
        'retention_keep_last' => 30,
        'next_run_at' => now()->addHour(),
    ]);

    $blocked = BackupSchedule::create([
        'tenant_id' => $tenantB->id,
        'name' => 'Blocked schedule',
        'is_enabled' => true,
        'timezone' => 'UTC',
        'frequency' => 'daily',
        'time_of_day' => '11:00:00',
        'days_of_week' => null,
        'policy_types' => ['deviceConfiguration'],
        'include_foundations' => true,
        'retention_keep_last' => 30,
        'next_run_at' => now()->addHour(),
    ]);

    $this->actingAs($user);
    Filament::setTenant(null, true);

    $session = [
        WorkspaceContext::SESSION_KEY => (int) $tenantA->workspace_id,
        WorkspaceContext::LAST_TENANT_IDS_SESSION_KEY => [
            (string) $tenantA->workspace_id => (int) $tenantA->getKey(),
        ],
    ];

    $this->withSession($session)
        ->get(BackupScheduleResource::getUrl('edit', ['record' => $allowed], panel: 'admin'))
        ->assertOk();

    $this->withSession($session)
        ->get(BackupScheduleResource::getUrl('edit', ['record' => $blocked], panel: 'admin'))
        ->assertNotFound();
});