<?php

use App\Models\Finding;
use App\Models\InventorySyncRun;
use App\Models\Policy;
use App\Models\PolicyVersion;
use App\Services\Drift\DriftFindingGenerator;

test('drift generation is tenant isolated', function () {
    [$userA, $tenantA] = createUserWithTenant(role: 'manager');
    [$userB, $tenantB] = createUserWithTenant(role: 'manager');

    $scopeKey = hash('sha256', 'scope-tenant');

    $baselineA = InventorySyncRun::factory()->for($tenantA)->create([
        'selection_hash' => $scopeKey,
        'selection_payload' => ['policy_types' => ['settingsCatalogPolicy']],
        'status' => InventorySyncRun::STATUS_SUCCESS,
        'finished_at' => now()->subDays(2),
    ]);

    $currentA = InventorySyncRun::factory()->for($tenantA)->create([
        'selection_hash' => $scopeKey,
        'selection_payload' => ['policy_types' => ['settingsCatalogPolicy']],
        'status' => InventorySyncRun::STATUS_SUCCESS,
        'finished_at' => now()->subDay(),
    ]);

    $policyA = Policy::factory()->for($tenantA)->create([
        'policy_type' => 'settingsCatalogPolicy',
    ]);

    $baselineAssignments = [['target' => ['groupId' => 'group-a'], '@odata.type' => '#microsoft.graph.groupAssignmentTarget']];
    $currentAssignments = [['target' => ['groupId' => 'group-b'], '@odata.type' => '#microsoft.graph.groupAssignmentTarget']];

    PolicyVersion::factory()->for($tenantA)->for($policyA)->create([
        'version_number' => 1,
        'policy_type' => $policyA->policy_type,
        'captured_at' => $baselineA->finished_at->copy()->subMinute(),
        'assignments' => $baselineAssignments,
        'assignments_hash' => hash('sha256', json_encode($baselineAssignments)),
    ]);

    PolicyVersion::factory()->for($tenantA)->for($policyA)->create([
        'version_number' => 2,
        'policy_type' => $policyA->policy_type,
        'captured_at' => $currentA->finished_at->copy()->subMinute(),
        'assignments' => $currentAssignments,
        'assignments_hash' => hash('sha256', json_encode($currentAssignments)),
    ]);

    $policyB = Policy::factory()->for($tenantB)->create([
        'policy_type' => 'settingsCatalogPolicy',
    ]);

    $baselineAssignmentsB = [['target' => ['groupId' => 'group-x'], '@odata.type' => '#microsoft.graph.groupAssignmentTarget']];
    $currentAssignmentsB = [['target' => ['groupId' => 'group-y'], '@odata.type' => '#microsoft.graph.groupAssignmentTarget']];

    PolicyVersion::factory()->for($tenantB)->for($policyB)->create([
        'version_number' => 1,
        'policy_type' => $policyB->policy_type,
        'captured_at' => now()->subDays(2)->subMinute(),
        'assignments' => $baselineAssignmentsB,
        'assignments_hash' => hash('sha256', json_encode($baselineAssignmentsB)),
    ]);

    PolicyVersion::factory()->for($tenantB)->for($policyB)->create([
        'version_number' => 2,
        'policy_type' => $policyB->policy_type,
        'captured_at' => now()->subDay()->subMinute(),
        'assignments' => $currentAssignmentsB,
        'assignments_hash' => hash('sha256', json_encode($currentAssignmentsB)),
    ]);

    $generator = app(DriftFindingGenerator::class);
    $generator->generate($tenantA, $baselineA, $currentA, $scopeKey);

    expect(Finding::query()->where('tenant_id', $tenantA->getKey())->count())->toBe(1);
    expect(Finding::query()->where('tenant_id', $tenantB->getKey())->count())->toBe(0);
});