<?php

declare(strict_types=1);

use App\Models\ProviderConnection;
use App\Support\Auth\Capabilities;
use Illuminate\Support\Facades\Gate;

it('routes tenant members without PROVIDER_VIEW capability to clear no-access copy on list and detail', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'readonly');

    Gate::define(Capabilities::PROVIDER_VIEW, fn () => false);

    $connection = ProviderConnection::factory()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'managed_environment_id' => (int) $tenant->getKey(),
        'provider' => 'microsoft',
    ]);

    $this->actingAs($user)
        ->get('/admin/provider-connections')
        ->assertRedirect('/admin/no-access?surface=provider-connections&reason=permission');

    $this->actingAs($user)
        ->get('/admin/provider-connections/'.$connection->getKey())
        ->assertRedirect('/admin/no-access?surface=provider-connections&reason=permission');

    $this->actingAs($user)
        ->get('/admin/no-access?surface=provider-connections&reason=permission')
        ->assertOk()
        ->assertSee('You do not have access to provider connections.')
        ->assertSee('You are signed in, but your current workspace or environment role does not include provider connection access.')
        ->assertDontSee('You do not have access to a workspace yet.')
        ->assertDontSee('then sign in again');
});