<?php

declare(strict_types=1);

use App\Filament\System\Pages\Auth\Login;
use App\Filament\System\Widgets\ControlTowerHealthIndicator;
use App\Models\OperationRun;
use App\Models\PlatformUser;
use App\Models\User;
use App\Models\Workspace;
use App\Models\WorkspaceMembership;
use App\Support\Auth\PlatformCapabilities;
use App\Support\Auth\WorkspaceRole;
use App\Support\OperationRunOutcome;
use App\Support\OperationRunStatus;
use Filament\Facades\Filament;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Route;
use Livewire\Livewire;

uses(RefreshDatabase::class);

beforeEach(function (): void {
    Filament::setCurrentPanel('system');
    Filament::bootCurrentPanel();
});

it('Spec396 serves a productized system login page without scaffold branding', function (): void {
    $this->get('/system/login')
        ->assertSuccessful()
        ->assertSee('TenantPilot System')
        ->assertDontSee('System dashboard')
        ->assertDontSee('Laravel');

    Livewire::test(Login::class)
        ->assertSee('TenantPilot System');
});

it('Spec396 renders the system dashboard with TenantPilot system branding and canonical health copy', function (): void {
    $user = PlatformUser::factory()->create([
        'capabilities' => [
            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
            PlatformCapabilities::CONSOLE_VIEW,
            PlatformCapabilities::OPERATIONS_VIEW,
        ],
        'is_active' => true,
    ]);

    $this->actingAs($user, 'platform')
        ->get('/system')
        ->assertSuccessful()
        ->assertSee('TenantPilot System')
        ->assertSee('Ready')
        ->assertDontSee('System dashboard')
        ->assertDontSee('All systems healthy')
        ->assertDontSee('Healthy (has owner)');
});

it('Spec396 renders the system dashboard attention state with canonical health copy', function (): void {
    OperationRun::factory()->create([
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::Failed->value,
        'created_at' => now()->subMinutes(10),
    ]);

    Livewire::test(ControlTowerHealthIndicator::class)
        ->assertSee('Needs attention')
        ->assertDontSee('All systems healthy')
        ->assertDontSee('Warning');
});

it('Spec396 renders the repair owner stats with canonical readiness copy', function (): void {
    $workspace = Workspace::factory()->create(['name' => 'Spec396 Ready Workspace']);
    $owner = User::factory()->create();

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'user_id' => (int) $owner->getKey(),
        'role' => WorkspaceRole::Owner->value,
    ]);

    $user = PlatformUser::factory()->create([
        'capabilities' => [
            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
            PlatformCapabilities::USE_BREAK_GLASS,
        ],
        'is_active' => true,
    ]);

    $this->actingAs($user, 'platform')
        ->get('/system/repair-workspace-owners')
        ->assertSuccessful()
        ->assertSee('Ready (has owner)')
        ->assertDontSee('Healthy (has owner)');
});

it('Spec396 keeps tenant web users out of the platform-guarded system panel', function (): void {
    $tenantUser = User::factory()->create();

    $this->actingAs($tenantUser, 'web')
        ->get('/system')
        ->assertNotFound();
});

it('Spec396 still denies platform users without the system panel capability', function (): void {
    $user = PlatformUser::factory()->create([
        'capabilities' => [],
        'is_active' => true,
    ]);

    $this->actingAs($user, 'platform')
        ->get('/system')
        ->assertForbidden();
});

it('Spec396 reuses platform guard smoke proof without adding a system smoke helper route', function (): void {
    expect(Route::has('system.local.smoke-login'))->toBeFalse();
});