<?php

declare(strict_types=1);

use App\Services\TenantConfiguration\CoverageSecondaryKeyBuilder;

it('Spec417 builds secondary keys as redacted diagnostic metadata only', function (): void {
    $keys = app(CoverageSecondaryKeyBuilder::class)->build([
        'display_fields' => ['displayName'],
        'secondary_fields' => ['platform', 'client_secret', 'source_metadata.authorization', 'source_metadata.source_contract_key'],
    ], [
        'displayName' => 'Corporate devices',
        'platform' => 'windows10AndLater',
        'client_secret' => 'secret-value',
    ], [
        'authorization' => 'Bearer top-secret',
        'source_contract_key' => 'assignmentFilter',
    ]);

    expect($keys)->toMatchArray([
        'displayName' => 'Corporate devices',
        'platform' => 'windows10AndLater',
        'client_secret' => '[redacted]',
        'source_metadata.authorization' => '[redacted]',
        'source_metadata.source_contract_key' => 'assignmentFilter',
    ]);
});