<?php

declare(strict_types=1);

use App\Models\Tenant;
use App\Models\Workspace;
use App\Support\Ai\AiDataClassification;
use App\Support\Ai\AiDecisionAuditMetadataFactory;
use App\Support\Ai\AiDecisionReasonCode;
use App\Support\Ai\AiExecutionDecision;
use App\Support\Ai\AiExecutionRequest;
use App\Support\Ai\AiProviderClass;
use App\Support\Audit\AuditActionId;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

it('builds bounded decision metadata without raw prompt, source, provider, or output payloads', function (): void {
    $workspace = Workspace::factory()->create();
    $tenant = Tenant::factory()->create(['workspace_id' => (int) $workspace->getKey()]);

    $request = new AiExecutionRequest(
        workspace: $workspace,
        tenant: $tenant,
        actor: null,
        useCaseKey: 'support_diagnostics.summary_draft',
        requestedProviderClass: AiProviderClass::LocalPrivate->value,
        dataClassifications: [AiDataClassification::RedactedSupportSummary->value],
        sourceFamily: 'support_diagnostics',
        callerSurface: 'support_diagnostics',
        contextFingerprint: 'support_diagnostics:summary:v1',
    );

    $decision = new AiExecutionDecision(
        outcome: 'blocked',
        reasonCode: AiDecisionReasonCode::DataClassificationBlocked,
        workspaceAiPolicyMode: 'private_only',
        matchedOperationalControlScope: null,
        useCaseKey: 'support_diagnostics.summary_draft',
        requestedProviderClass: AiProviderClass::LocalPrivate->value,
        dataClassifications: [AiDataClassification::RedactedSupportSummary->value],
        sourceFamily: 'support_diagnostics',
        auditAction: AuditActionId::AiExecutionDecisionEvaluated,
        auditMetadata: [],
    );

    $metadata = app(AiDecisionAuditMetadataFactory::class)->make($request, $decision);

    expect($metadata)->toMatchArray([
        'use_case_key' => 'support_diagnostics.summary_draft',
        'decision_outcome' => 'blocked',
        'decision_reason' => AiDecisionReasonCode::DataClassificationBlocked->value,
        'workspace_ai_policy_mode' => 'private_only',
        'requested_provider_class' => 'local_private',
        'data_classifications' => ['redacted_support_summary'],
        'source_family' => 'support_diagnostics',
        'workspace_id' => (int) $workspace->getKey(),
        'tenant_id' => (int) $tenant->getKey(),
        'context_fingerprint' => 'support_diagnostics:summary:v1',
    ])
        ->and($metadata)->not->toHaveKeys([
            'prompt_text',
            'source_payload',
            'provider_payload',
            'output_text',
        ]);
});