<?php

declare(strict_types=1);

use App\Models\OnboardingSession;
use App\Models\ProviderConnection;
use App\Models\ProviderCredential;

it('does not render tenant legacy app client secret in onboarding wizard or task board', function () {
    [$user, $tenant] = createUserWithTenant(role: 'owner');

    $tenant->forceFill([
        'app_client_id' => '00000000-0000-0000-0000-000000000000',
        'app_client_secret' => 'TENANT_SECRET_SHOULD_NEVER_RENDER',
    ])->save();

    $connection = ProviderConnection::factory()->for($tenant)->create([
        'provider' => 'microsoft',
        'is_default' => true,
    ]);

    ProviderCredential::factory()->for($connection, 'providerConnection')->create([
        'type' => 'client_secret',
        'payload' => [
            'client_id' => '11111111-1111-1111-1111-111111111111',
            'client_secret' => 'PROVIDER_SECRET_SHOULD_NEVER_RENDER',
        ],
    ]);

    OnboardingSession::query()->create([
        'tenant_id' => $tenant->getKey(),
        'provider_connection_id' => $connection->getKey(),
        'status' => 'in_progress',
        'current_step' => 4,
        'assigned_to_user_id' => $user->getKey(),
        'metadata' => [],
    ]);

    $this->actingAs($user);

    $wizardUrl = "/admin/t/{$tenant->external_id}/onboarding";
    $taskBoardUrl = "/admin/t/{$tenant->external_id}/onboarding/tasks";

    $this->get($wizardUrl)
        ->assertSuccessful()
        ->assertDontSee('TENANT_SECRET_SHOULD_NEVER_RENDER')
        ->assertDontSee('PROVIDER_SECRET_SHOULD_NEVER_RENDER');

    $this->get($taskBoardUrl)
        ->assertSuccessful()
        ->assertDontSee('TENANT_SECRET_SHOULD_NEVER_RENDER')
        ->assertDontSee('PROVIDER_SECRET_SHOULD_NEVER_RENDER');
});