<?php

use App\Services\Intune\PolicyNormalizer;
use Tests\TestCase;

uses(TestCase::class);

test('app protection normalizer formats blocked/required booleans and durations', function () {
    $normalizer = app(PolicyNormalizer::class);

    $snapshot = [
        '@odata.type' => '#microsoft.graph.androidManagedAppProtection',
        'displayName' => 'Teams',
        'dataBackupBlocked' => false,
        'pinRequired' => true,
        'periodOnlineBeforeAccessCheck' => 'PT30M',
        'periodOfflineBeforeWipeIsEnforced' => 'P90D',
        'allowedDataIngestionLocations' => ['oneDriveForBusiness', 'sharePoint'],
    ];

    $normalized = $normalizer->normalize($snapshot, 'appProtectionPolicy', 'mobile');

    $blocks = collect($normalized['settings'] ?? []);

    $basics = $blocks->firstWhere('title', 'Basics');
    expect($basics)->not->toBeNull();
    expect($basics['rows'][0]['label'] ?? null)->toBe('Platform');
    expect($basics['rows'][0]['value'] ?? null)->toBe('Android');

    $dataProtection = $blocks->firstWhere('title', 'Data Protection');
    expect($dataProtection)->not->toBeNull();
    expect(collect($dataProtection['rows'] ?? [])->firstWhere('path', 'dataBackupBlocked')['value'] ?? null)->toBe('Allowed');
    expect(collect($dataProtection['rows'] ?? [])->firstWhere('path', 'allowedDataIngestionLocations')['value'] ?? null)
        ->toBe('One Drive For Business, Share Point');

    $access = $blocks->firstWhere('title', 'Access Requirements');
    expect($access)->not->toBeNull();
    expect(collect($access['rows'] ?? [])->firstWhere('path', 'pinRequired')['value'] ?? null)->toBe('Required');
    expect(collect($access['rows'] ?? [])->firstWhere('path', 'periodOnlineBeforeAccessCheck')['value'] ?? null)->toBe('30 minutes');

    $conditional = $blocks->firstWhere('title', 'Conditional Launch');
    expect($conditional)->not->toBeNull();
    expect(collect($conditional['rows'] ?? [])->firstWhere('path', 'periodOfflineBeforeWipeIsEnforced')['value'] ?? null)->toBe('90 days');
});