<?php

declare(strict_types=1);

use App\Models\PlatformUser;
use App\Models\User;
use App\Support\Auth\PlatformCapabilities;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

it('returns 404 when a tenant session accesses system panel routes', function (string $url) {
    $user = User::factory()->create();

    $this->actingAs($user)->get($url)->assertNotFound();
})->with([
    '/system/login',
    '/system',
    '/system/ops/runbooks',
    '/system/ops/runs',
]);

it('returns 403 when a platform user lacks the required capability on system pages', function (string $url) {
    $platformUser = PlatformUser::factory()->create([
        'capabilities' => [],
        'is_active' => true,
    ]);

    $this->actingAs($platformUser, 'platform')
        ->get($url)
        ->assertForbidden();
})->with([
    '/system',
    '/system/ops/runbooks',
    '/system/ops/runs',
]);

it('returns 200 when a platform user has the required capability', function () {
    $platformUser = PlatformUser::factory()->create([
        'capabilities' => [
            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
            PlatformCapabilities::CONSOLE_VIEW,
        ],
        'is_active' => true,
    ]);

    $this->actingAs($platformUser, 'platform')
        ->get('/system')
        ->assertSuccessful();
});