<?php

namespace Database\Factories;

use App\Models\Finding;
use App\Models\Tenant;
use Illuminate\Database\Eloquent\Factories\Factory;

/**
 * @extends \Illuminate\Database\Eloquent\Factories\Factory<\App\Models\Finding>
 */
class FindingFactory extends Factory
{
    /**
     * Define the model's default state.
     *
     * @return array<string, mixed>
     */
    public function definition(): array
    {
        return [
            'tenant_id' => Tenant::factory(),
            'finding_type' => Finding::FINDING_TYPE_DRIFT,
            'scope_key' => hash('sha256', fake()->uuid()),
            'baseline_operation_run_id' => null,
            'current_operation_run_id' => null,
            'fingerprint' => hash('sha256', fake()->uuid()),
            'subject_type' => 'assignment',
            'subject_external_id' => fake()->uuid(),
            'severity' => Finding::SEVERITY_MEDIUM,
            'status' => Finding::STATUS_NEW,
            'acknowledged_at' => null,
            'acknowledged_by_user_id' => null,
            'evidence_jsonb' => [],
        ];
    }

    /**
     * State for permission posture findings.
     */
    public function permissionPosture(): static
    {
        return $this->state(fn (array $attributes): array => [
            'finding_type' => Finding::FINDING_TYPE_PERMISSION_POSTURE,
            'source' => 'permission_check',
            'subject_type' => 'permission',
            'subject_external_id' => 'DeviceManagementConfiguration.ReadWrite.All',
            'severity' => Finding::SEVERITY_MEDIUM,
            'evidence_jsonb' => [
                'permission_key' => 'DeviceManagementConfiguration.ReadWrite.All',
                'permission_type' => 'application',
                'expected_status' => 'granted',
                'actual_status' => 'missing',
                'blocked_features' => ['policy-sync', 'backup'],
                'checked_at' => now()->toIso8601String(),
            ],
        ]);
    }

    /**
     * State for resolved findings.
     */
    public function resolved(): static
    {
        return $this->state(fn (array $attributes): array => [
            'status' => Finding::STATUS_RESOLVED,
            'resolved_at' => now(),
            'resolved_reason' => 'permission_granted',
        ]);
    }

    /**
     * State for Entra admin roles findings.
     */
    public function entraAdminRoles(): static
    {
        return $this->state(fn (array $attributes): array => [
            'finding_type' => Finding::FINDING_TYPE_ENTRA_ADMIN_ROLES,
            'source' => 'entra.admin_roles',
            'severity' => Finding::SEVERITY_CRITICAL,
            'subject_type' => 'role_assignment',
            'evidence_jsonb' => [
                'role_display_name' => 'Global Administrator',
                'principal_display_name' => 'Admin User',
                'principal_type' => 'user',
                'principal_id' => fake()->uuid(),
                'role_definition_id' => fake()->uuid(),
                'role_template_id' => '62e90394-69f5-4237-9190-012177145e10',
                'directory_scope_id' => '/',
                'is_built_in' => true,
                'measured_at' => now()->toIso8601String(),
            ],
        ]);
    }
}