<?php

declare(strict_types=1);

use App\Models\EntraGroup;
use App\Support\References\ReferenceClass;
use App\Support\References\ReferenceDescriptor;
use App\Support\References\ReferenceResolutionState;
use App\Support\References\Resolvers\EntraGroupReferenceResolver;
use Filament\Facades\Filament;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

it('returns linkable group references for in-scope tenant members', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');
    $this->actingAs($user);
    Filament::setTenant($tenant, true);

    $group = EntraGroup::factory()->for($tenant)->create([
        'entra_id' => '11111111-1111-1111-1111-111111111111',
        'display_name' => 'Policy Operators',
    ]);

    $resolved = app(EntraGroupReferenceResolver::class)->resolve(new ReferenceDescriptor(
        referenceClass: ReferenceClass::Group,
        rawIdentifier: (string) $group->entra_id,
        tenantId: (int) $tenant->getKey(),
    ));

    expect($resolved->state)->toBe(ReferenceResolutionState::Resolved)
        ->and($resolved->isLinkable())->toBeTrue()
        ->and($resolved->linkTarget?->actionLabel)->toBe('View group');
});

it('suppresses group links when the actor is outside the tenant scope', function (): void {
    [$owner, $tenant] = createUserWithTenant(role: 'owner');
    $group = EntraGroup::factory()->for($tenant)->create([
        'entra_id' => '22222222-2222-2222-2222-222222222222',
        'display_name' => 'Device Targets',
    ]);

    $outsider = \App\Models\User::factory()->create();
    $this->actingAs($outsider);
    Filament::setTenant($tenant, true);

    $resolved = app(EntraGroupReferenceResolver::class)->resolve(new ReferenceDescriptor(
        referenceClass: ReferenceClass::Group,
        rawIdentifier: (string) $group->entra_id,
        tenantId: (int) $tenant->getKey(),
    ));

    expect($resolved->state)->toBe(ReferenceResolutionState::Inaccessible)
        ->and($resolved->linkTarget)->toBeNull();
});