<?php

declare(strict_types=1);

use App\Services\Auth\RoleCapabilityMap;
use App\Support\Auth\Capabilities;
use App\Support\TenantRole;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Gate;

uses(RefreshDatabase::class);

it('removes the acknowledged findings capability alias from shared RBAC truth', function (): void {
    expect(Capabilities::isKnown('tenant_findings.acknowledge'))->toBeFalse();
    expect(RoleCapabilityMap::rolesWithCapability('tenant_findings.acknowledge'))->toBe([]);
});

it('keeps the canonical findings triage capability available to operators', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'operator');

    expect(RoleCapabilityMap::hasCapability(TenantRole::Operator, Capabilities::TENANT_FINDINGS_TRIAGE))->toBeTrue();
    expect(Gate::forUser($user)->allows(Capabilities::TENANT_FINDINGS_TRIAGE, $tenant))->toBeTrue();
});