<?php

declare(strict_types=1);

namespace App\Services\TenantConfiguration;

use App\Models\TenantConfigurationResource;
use App\Models\TenantConfigurationResourceEvidence;
use App\Support\TenantConfiguration\ClaimState;
use App\Support\TenantConfiguration\CoverageLevel;
use App\Support\TenantConfiguration\EvidenceState;
use InvalidArgumentException;

final class ExchangePowerShellContentOnlyEvidenceGuard
{
    public function maximumCoverageLevel(): CoverageLevel
    {
        return CoverageLevel::ContentBacked;
    }

    public function assertContentOnly(
        TenantConfigurationResourceEvidence $evidence,
        TenantConfigurationResource $resource,
    ): void {
        if ($evidence->coverage_level !== CoverageLevel::ContentBacked) {
            throw new InvalidArgumentException('Exchange PowerShell evidence exceeded the content-backed maximum.');
        }

        if ($evidence->evidence_state !== EvidenceState::ContentBacked) {
            throw new InvalidArgumentException('Exchange PowerShell evidence state must remain content-backed.');
        }

        if ($resource->latest_claim_state !== ClaimState::InternalOnly) {
            throw new InvalidArgumentException('Exchange PowerShell evidence must remain internal-only for this slice.');
        }
    }
}