<?php

declare(strict_types=1);

use App\Models\AuditLog;
use App\Models\PlatformUser;
use App\Models\Tenant;
use App\Support\Auth\PlatformCapabilities;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

it('lists platform auth access logs with success and failure statuses plus break-glass actions', function () {
    $tenant = Tenant::factory()->create([
        'external_id' => 'platform',
    ]);

    AuditLog::query()->create([
        'tenant_id' => (int) $tenant->getKey(),
        'workspace_id' => (int) $tenant->workspace_id,
        'action' => 'platform.auth.login',
        'status' => 'success',
        'metadata' => ['attempted_email' => 'operator@tenantpilot.io'],
        'recorded_at' => now(),
    ]);

    AuditLog::query()->create([
        'tenant_id' => (int) $tenant->getKey(),
        'workspace_id' => (int) $tenant->workspace_id,
        'action' => 'platform.auth.login',
        'status' => 'failure',
        'metadata' => ['attempted_email' => 'operator@tenantpilot.io'],
        'recorded_at' => now(),
    ]);

    AuditLog::query()->create([
        'tenant_id' => (int) $tenant->getKey(),
        'workspace_id' => (int) $tenant->workspace_id,
        'action' => 'platform.break_glass.enter',
        'status' => 'success',
        'metadata' => ['reason' => 'Recovery'],
        'recorded_at' => now(),
    ]);

    AuditLog::query()->create([
        'tenant_id' => (int) $tenant->getKey(),
        'workspace_id' => (int) $tenant->workspace_id,
        'action' => 'platform.unrelated.event',
        'status' => 'success',
        'metadata' => [],
        'recorded_at' => now(),
    ]);

    $platformUser = PlatformUser::factory()->create([
        'capabilities' => [
            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
            PlatformCapabilities::CONSOLE_VIEW,
        ],
        'is_active' => true,
    ]);

    $this->actingAs($platformUser, 'platform')
        ->get('/system/security/access-logs')
        ->assertSuccessful()
        ->assertSee('platform.auth.login')
        ->assertSee('success')
        ->assertSee('failure')
        ->assertSee('platform.break_glass.enter')
        ->assertDontSee('platform.unrelated.event');
});