<?php

declare(strict_types=1);

use App\Filament\Pages\TenantDashboard;
use App\Filament\Resources\BackupSetResource;
use App\Filament\Widgets\Dashboard\DashboardKpis;
use App\Filament\Widgets\Dashboard\NeedsAttention;
use App\Models\BackupItem;
use App\Models\BackupSet;
use App\Models\Finding;
use App\Models\InventoryItem;
use App\Models\OperationRun;
use App\Models\Tenant;
use App\Services\Auth\CapabilityResolver;
use App\Support\Auth\Capabilities;
use App\Support\Rbac\UiTooltips;
use Filament\Facades\Filament;
use Illuminate\Support\Facades\Gate;
use Livewire\Livewire;

use function Pest\Laravel\mock;

it('does not leak data across tenants on the dashboard', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');
    $otherTenant = Tenant::factory()->create();

    InventoryItem::factory()->create([
        'tenant_id' => $otherTenant->getKey(),
        'external_id' => 'other-tenant-finding',
        'display_name' => 'Other Tenant Policy',
    ]);

    Finding::factory()->create([
        'tenant_id' => $otherTenant->getKey(),
        'finding_type' => Finding::FINDING_TYPE_DRIFT,
        'subject_external_id' => 'other-tenant-finding',
    ]);

    OperationRun::factory()->create([
        'tenant_id' => $otherTenant->getKey(),
        'type' => 'inventory_sync',
        'status' => 'running',
        'outcome' => 'pending',
        'initiator_name' => 'System',
    ]);

    $this->actingAs($user);

    $this->get(TenantDashboard::getUrl(tenant: $tenant))
        ->assertOk()
        ->assertDontSee('Other Tenant Policy');
});

it('keeps backup summary truth visible on the dashboard while blocked backup drill-through routes still fail with 403', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner', ensureDefaultMicrosoftProviderConnection: false);
    $this->actingAs($user);

    $backupSet = BackupSet::factory()->for($tenant)->create([
        'name' => 'Stale scoped backup',
        'item_count' => 1,
        'completed_at' => now()->subDays(2),
    ]);

    BackupItem::factory()->for($tenant)->for($backupSet)->create([
        'payload' => ['id' => 'policy-stale'],
        'metadata' => [],
        'assignments' => [],
    ]);

    Gate::define(Capabilities::TENANT_VIEW, fn (): bool => false);

    mock(CapabilityResolver::class, function ($mock) use ($tenant): void {
        $mock->shouldReceive('isMember')
            ->andReturnUsing(static fn ($user, Tenant $resolvedTenant): bool => (int) $resolvedTenant->getKey() === (int) $tenant->getKey());

        $mock->shouldReceive('can')
            ->andReturnUsing(static function ($user, Tenant $resolvedTenant, string $capability) use ($tenant): bool {
                expect((int) $resolvedTenant->getKey())->toBe((int) $tenant->getKey());

                return match ($capability) {
                    Capabilities::TENANT_VIEW => false,
                    default => true,
                };
            });
    });

    Filament::setCurrentPanel(Filament::getPanel('tenant'));
    Filament::setTenant($tenant, true);

    Livewire::test(NeedsAttention::class)
        ->assertSee('Latest backup is stale')
        ->assertSee(UiTooltips::INSUFFICIENT_PERMISSION)
        ->assertSee('Open latest backup');

    Livewire::test(DashboardKpis::class)
        ->assertSee('Backup posture')
        ->assertSee('Stale');

    $this->get(TenantDashboard::getUrl(tenant: $tenant))
        ->assertOk();

    $this->get(BackupSetResource::getUrl('index', tenant: $tenant))
        ->assertForbidden();
});