<?php

declare(strict_types=1);

use App\Models\ProviderConnection;
use App\Support\Auth\Capabilities;
use Illuminate\Support\Facades\Gate;

it('returns 403 for tenant members without PROVIDER_VIEW capability on list and detail', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'readonly');

    Gate::define(Capabilities::PROVIDER_VIEW, fn () => false);

    $connection = ProviderConnection::factory()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'tenant_id' => (int) $tenant->getKey(),
        'provider' => 'microsoft',
    ]);

    $this->actingAs($user)
        ->get('/admin/provider-connections')
        ->assertForbidden();

    $this->actingAs($user)
        ->get('/admin/provider-connections/'.$connection->getKey())
        ->assertForbidden();
});