<?php

declare(strict_types=1);

use App\Filament\Pages\Onboarding\TenantOnboardingTaskBoard;
use App\Models\OnboardingSession;
use App\Models\ProviderConnection;
use App\Services\Onboarding\OnboardingEvidenceWriter;
use App\Support\Onboarding\OnboardingTaskType;
use Filament\Facades\Filament;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

it('shows sanitized failure reason and fix hints for a failing task', function () {
    [$user, $tenant] = createUserWithTenant(role: 'owner');

    $connection = ProviderConnection::factory()
        ->for($tenant)
        ->create([
            'provider' => 'microsoft',
            'is_default' => true,
        ]);

    $session = OnboardingSession::factory()
        ->for($tenant)
        ->create([
            'status' => 'in_progress',
            'current_step' => 4,
            'provider_connection_id' => (int) $connection->getKey(),
        ]);

    /** @var OnboardingEvidenceWriter $writer */
    $writer = app(OnboardingEvidenceWriter::class);

    $writer->record(
        tenant: $tenant,
        taskType: OnboardingTaskType::VerifyPermissions,
        status: 'error',
        reasonCode: 'permissions.missing',
        message: 'Authorization: Bearer abc client_secret=supersecret user@example.com',
        payload: ['client_secret' => 'supersecret'],
        session: $session,
        providerConnection: $connection,
        operationRun: null,
        recordedBy: $user,
    );

    $this->actingAs($user);
    Filament::setTenant($tenant, true);

    $this->get(TenantOnboardingTaskBoard::getUrl(tenant: $tenant))
        ->assertSuccessful()
        ->assertSee('Fix hints')
        ->assertDontSee('supersecret')
        ->assertDontSee('user@example.com')
        ->assertDontSee('Bearer abc');
});