<?php

declare(strict_types=1);

use App\Services\TenantConfiguration\ClaimGuard;
use App\Services\TenantConfiguration\ResourceTypeRegistry;
use App\Services\TenantConfiguration\SupportedScopeResolver;
use App\Support\TenantConfiguration\ClaimState;
use App\Support\TenantConfiguration\CoverageLevel;

it('Spec414 blocks unsafe customer-facing claims using persisted kernel definitions', function () {
    $resolver = new SupportedScopeResolver;
    $scope = $resolver->findActive('intune_tcm_core');
    $roleScopeTag = (new ResourceTypeRegistry)->findActive('roleScopeTag');
    $guard = new ClaimGuard;

    expect($scope)->not->toBeNull()
        ->and($roleScopeTag)->not->toBeNull();

    expect($guard->evaluate(
        scopeKey: $scope?->scope_key,
        requestedLevel: CoverageLevel::Certified,
        actualLevel: CoverageLevel::Certified,
        scopeComplete: true,
        customerFacing: true,
        sourceClass: $roleScopeTag?->source_class,
        restoreTier: $roleScopeTag?->restore_tier,
        allowsBetaClaims: (bool) $roleScopeTag?->allows_beta_claims,
        allowsCertifiedClaims: (bool) $roleScopeTag?->allows_certified_claims,
    ))->toBe(ClaimState::ClaimBlocked);

    expect($guard->evaluate(
        scopeKey: $scope?->scope_key,
        requestedLevel: CoverageLevel::ContentBacked,
        actualLevel: CoverageLevel::ContentBacked,
        scopeComplete: false,
        customerFacing: true,
        customerClaimsAllowed: (bool) $scope?->customer_claims_allowed,
    ))->toBe(ClaimState::ClaimBlocked);
});

it('Spec414 allows an exact persisted scope claim at the required level', function () {
    $resolver = new SupportedScopeResolver;
    $scope = $resolver->findActive('intune_tcm_core');
    $guard = new ClaimGuard;

    expect($scope)->not->toBeNull()
        ->and($resolver->meetsMinimum(CoverageLevel::ContentBacked, $scope))->toBeTrue();

    expect($guard->evaluate(
        scopeKey: $scope?->scope_key,
        requestedLevel: $scope?->minimum_coverage_level,
        actualLevel: CoverageLevel::Comparable,
        scopeComplete: true,
        customerFacing: true,
        customerClaimsAllowed: (bool) $scope?->customer_claims_allowed,
    ))->toBe(ClaimState::ClaimAllowed);
});