<?php

declare(strict_types=1);

use App\Models\TenantConfigurationResourceType;
use App\Services\TenantConfiguration\ClaimGuard;
use App\Services\TenantConfiguration\ResourceTypeRegistry;
use App\Support\TenantConfiguration\ClaimState;
use App\Support\TenantConfiguration\CoverageLevel;
use App\Support\TenantConfiguration\IdentityState;
use App\Support\TenantConfiguration\RestoreTier;

it('Spec427 keeps Exchange and Teams source-contract states out of customer and restore claims', function (): void {
    app(ResourceTypeRegistry::class)->syncDefaults();

    $rows = TenantConfigurationResourceType::query()
        ->whereIn('canonical_type', ['transportRule', 'acceptedDomain', 'appPermissionPolicy', 'meetingPolicy'])
        ->get();

    expect($rows)->toHaveCount(4);

    foreach ($rows as $row) {
        expect($row->default_claim_state)->toBe(ClaimState::InternalOnly)
            ->and($row->restore_tier)->not->toBe(RestoreTier::Restorable)
            ->and((bool) data_get($row->metadata, 'customer_claims_allowed'))->toBeFalse()
            ->and(app(ClaimGuard::class)->evaluate(
                scopeKey: 'spec427_exchange_teams_internal',
                requestedLevel: CoverageLevel::Renderable,
                actualLevel: CoverageLevel::Detected,
                scopeComplete: true,
                customerFacing: true,
                customerClaimsAllowed: false,
                sourceClass: $row->source_class,
                restoreTier: $row->restore_tier,
                identityState: IdentityState::Stable,
            ))->toBe(ClaimState::ClaimBlocked)
            ->and(app(ClaimGuard::class)->evaluate(
                scopeKey: 'spec427_exchange_teams_internal',
                requestedLevel: CoverageLevel::Renderable,
                actualLevel: CoverageLevel::Detected,
                scopeComplete: true,
                sourceClass: $row->source_class,
                restoreTier: $row->restore_tier,
                identityState: IdentityState::Stable,
                restoreClaim: true,
            ))->toBe(ClaimState::ClaimBlocked);
    }

    expect(app(ClaimGuard::class)->evaluateStatement('Microsoft 365 customer-ready Exchange Teams evidence', internalOperatorOnly: true))
        ->toBe(ClaimState::ClaimBlocked);
});