<?php

declare(strict_types=1);

use App\Services\TenantConfiguration\IdentityConflictDiagnosticsBuilder;
use App\Support\TenantConfiguration\CanonicalKeyKind;
use App\Support\TenantConfiguration\IdentityState;

it('Spec417 builds bounded redacted identity diagnostics', function (): void {
    $diagnostics = app(IdentityConflictDiagnosticsBuilder::class)->build(
        reasonCode: 'same_scope_derived_identity_collision',
        identityState: IdentityState::IdentityConflict,
        keyKind: CanonicalKeyKind::DerivedComposite,
        missingFields: ['id', 'sourceId', 'id'],
        metadata: [
            'candidate_count' => 2,
            'authorization' => 'Bearer secret',
            'candidate_values' => range(1, 20),
        ],
    );

    expect($diagnostics['reason_code'])->toBe('same_scope_derived_identity_collision')
        ->and($diagnostics['identity_state'])->toBe('identity_conflict')
        ->and($diagnostics['key_kind'])->toBe('derived_composite')
        ->and($diagnostics['missing_fields'])->toBe(['id', 'sourceId'])
        ->and($diagnostics['authorization'])->toBe('[redacted]')
        ->and($diagnostics['candidate_values'])->toHaveCount(16);
});