<?php

declare(strict_types=1);

use App\Filament\Pages\Onboarding\TenantOnboardingWizard;
use App\Jobs\Onboarding\OnboardingVerifyPermissionsJob;
use App\Models\OnboardingEvidence;
use App\Models\OnboardingSession;
use App\Models\OperationRun;
use App\Models\ProviderConnection;
use App\Support\Onboarding\OnboardingTaskType;
use Filament\Facades\Filament;
use Illuminate\Support\Facades\Queue;
use Livewire\Livewire;

it('starts verify-permissions with OperationRun dedupe and writes evidence', function () {
    Queue::fake();

    [$user, $tenant] = createUserWithTenant(role: 'owner');

    $requiredKeys = collect(config('intune_permissions.permissions', []))
        ->pluck('key')
        ->filter()
        ->values()
        ->all();

    config()->set('intune_permissions.granted_stub', $requiredKeys);

    $connection = ProviderConnection::factory()
        ->for($tenant)
        ->create([
            'provider' => 'microsoft',
            'is_default' => true,
        ]);

    $this->actingAs($user);
    Filament::setTenant($tenant, true);

    Livewire::test(TenantOnboardingWizard::class)
        ->set('selectedProviderConnectionId', (int) $connection->getKey())
        ->call('startVerifyPermissions')
        ->assertSuccessful();

    $session = OnboardingSession::query()
        ->where('tenant_id', $tenant->getKey())
        ->first();

    expect($session)->not->toBeNull();

    $run = OperationRun::query()
        ->where('tenant_id', $tenant->getKey())
        ->where('type', OnboardingTaskType::VerifyPermissions)
        ->first();

    expect($run)->not->toBeNull();

    Queue::assertPushed(OnboardingVerifyPermissionsJob::class);

    // Calling start again while the run is still active should dedupe.
    Livewire::test(TenantOnboardingWizard::class)
        ->call('startVerifyPermissions')
        ->assertSuccessful();

    expect(OperationRun::query()
        ->where('tenant_id', $tenant->getKey())
        ->where('type', OnboardingTaskType::VerifyPermissions)
        ->count()
    )->toBe(1);

    expect(Queue::pushed(OnboardingVerifyPermissionsJob::class))->toHaveCount(1);

    // Execute the job inline to assert evidence write behavior.
    $job = new OnboardingVerifyPermissionsJob(
        tenantId: (int) $tenant->getKey(),
        userId: (int) $user->getKey(),
        providerConnectionId: (int) $connection->getKey(),
        onboardingSessionId: (int) $session->getKey(),
        operationRun: $run,
    );

    $job->handle(
        permissions: app(\App\Services\Intune\TenantPermissionService::class),
        evidence: app(\App\Services\Onboarding\OnboardingEvidenceWriter::class),
        runs: app(\App\Services\OperationRunService::class),
    );

    expect(OnboardingEvidence::query()
        ->where('tenant_id', $tenant->getKey())
        ->where('onboarding_session_id', $session->getKey())
        ->where('task_type', OnboardingTaskType::VerifyPermissions)
        ->exists()
    )->toBeTrue();

    $evidence = OnboardingEvidence::query()
        ->where('tenant_id', $tenant->getKey())
        ->where('onboarding_session_id', $session->getKey())
        ->where('task_type', OnboardingTaskType::VerifyPermissions)
        ->orderByDesc('id')
        ->first();

    expect($evidence?->status)->toBe('ok');
});