<?php

declare(strict_types=1);

use App\Models\OperationRun;
use App\Services\OperationRunService;
use Filament\Facades\Filament;

it('keeps safe configuration phrases readable in terminal notifications while redacting true secrets', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');
    $this->actingAs($user);

    Filament::setTenant($tenant, true);

    $run = OperationRun::factory()->create([
        'tenant_id' => (int) $tenant->getKey(),
        'user_id' => (int) $user->getKey(),
        'initiator_name' => $user->name,
        'type' => 'inventory_sync',
        'status' => 'running',
        'outcome' => 'pending',
    ]);

    app(OperationRunService::class)->updateRun(
        $run,
        status: 'completed',
        outcome: 'failed',
        failures: [[
            'code' => 'provider.failure',
            'message' => 'passwordMinimumLength remains visible while client_secret=super-secret must be hidden.',
        ]],
    );

    $notification = $user->notifications()->latest('id')->first();

    expect($notification)->not->toBeNull();
    expect((string) ($notification->data['body'] ?? ''))->toContain('passwordMinimumLength');
    expect((string) ($notification->data['body'] ?? ''))->not->toContain('super-secret');
});