<?php

declare(strict_types=1);

use App\Filament\Pages\TenantDashboard;
use App\Models\Tenant;
use App\Models\TenantMembership;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

it('does not allow a non-member user to access tenant-scoped admin routes', function () {
    $tenant = Tenant::factory()->create(['status' => 'active']);

    $member = User::factory()->create();
    $nonMember = User::factory()->create();

    TenantMembership::query()->create([
        'tenant_id' => $tenant->getKey(),
        'user_id' => $member->getKey(),
        'role' => 'owner',
        'source' => 'manual',
        'source_ref' => null,
        'created_by_user_id' => null,
    ]);

    $this->actingAs($nonMember);
    $this->get(TenantDashboard::getUrl(tenant: $tenant))->assertNotFound();

    $this->actingAs($member);
    $this->get(TenantDashboard::getUrl(tenant: $tenant))->assertSuccessful();

    $this->get('/system')->assertNotFound();
});