<?php

use App\Filament\Resources\OperationRunResource;
use App\Models\Tenant;
use App\Models\User;
use App\Services\OperationRunService;
use Illuminate\Notifications\DatabaseNotification;

it('sanitizes persisted run failures and terminal notifications', function () {
    $tenant = Tenant::factory()->create();
    $user = User::factory()->create();
    $tenant->users()->attach($user, ['role' => 'owner']);

    /** @var OperationRunService $runs */
    $runs = app(OperationRunService::class);

    $run = $runs->ensureRun(
        tenant: $tenant,
        type: 'test.sanitize',
        inputs: [],
        initiator: $user,
    );

    $rawBearer = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.'.str_repeat('A', 90);

    $runs->updateRun(
        $run,
        status: 'completed',
        outcome: 'failed',
        failures: [[
            'code' => 'graph_forbidden',
            'message' => "Authorization: {$rawBearer} client_secret=supersecret user=test.user@example.com",
        ]],
    );

    $run->refresh();

    $failureSummaryJson = json_encode($run->failure_summary, JSON_THROW_ON_ERROR);

    expect($failureSummaryJson)->not->toContain('client_secret=supersecret');
    expect($failureSummaryJson)->not->toContain($rawBearer);
    expect($failureSummaryJson)->not->toContain('test.user@example.com');

    expect($run->failure_summary[0]['reason_code'] ?? null)->toBe('permission_denied');

    $notification = DatabaseNotification::query()
        ->where('notifiable_id', $user->getKey())
        ->latest('id')
        ->first();

    expect($notification)->not->toBeNull();

    $notificationJson = json_encode($notification?->data, JSON_THROW_ON_ERROR);

    expect($notificationJson)->not->toContain('client_secret=supersecret');
    expect($notificationJson)->not->toContain($rawBearer);
    expect($notificationJson)->not->toContain('test.user@example.com');

    $this->actingAs($user)
        ->get(OperationRunResource::getUrl('view', ['record' => $run], tenant: $tenant))
        ->assertSuccessful();
});