<?php

declare(strict_types=1);

use App\Filament\Pages\Onboarding\TenantOnboardingTaskBoard;
use App\Models\OnboardingEvidence;
use App\Models\OnboardingSession;
use App\Models\ProviderConnection;
use App\Support\Onboarding\OnboardingTaskType;
use Filament\Facades\Filament;
use Livewire\Livewire;

it('allows readonly users to view evidence history but blocks task runs', function () {
    [$readonly, $tenant] = createUserWithTenant(role: 'readonly');

    $connection = ProviderConnection::factory()
        ->for($tenant)
        ->create([
            'provider' => 'microsoft',
            'is_default' => true,
        ]);

    $session = OnboardingSession::factory()
        ->for($tenant)
        ->create([
            'status' => 'in_progress',
            'current_step' => 4,
            'provider_connection_id' => (int) $connection->getKey(),
            'assigned_to_user_id' => (int) $readonly->getKey(),
        ]);

    $evidence = OnboardingEvidence::factory()
        ->for($tenant)
        ->create([
            'onboarding_session_id' => (int) $session->getKey(),
            'provider_connection_id' => (int) $connection->getKey(),
            'task_type' => OnboardingTaskType::VerifyPermissions,
            'status' => 'error',
            'reason_code' => 'provider_auth_failed',
            'message' => 'Authentication failed. Please re-consent the app.',
        ]);

    $this->actingAs($readonly);
    Filament::setTenant($tenant, true);

    $this->get(TenantOnboardingTaskBoard::getUrl(tenant: $tenant))
        ->assertSuccessful()
        ->assertSee('Evidence history')
        ->assertSee($evidence->reason_code)
        ->assertSee($evidence->message);

    Livewire::test(TenantOnboardingTaskBoard::class)
        ->call('startTask', OnboardingTaskType::VerifyPermissions)
        ->assertStatus(403);
});