TenantAtlas/apps/platform/tests/Feature/Providers/UnsupportedProviderBoundaryPathTest.php

<?php

use App\Models\ProviderConnection;
use App\Models\Tenant;
use App\Services\Providers\MicrosoftGraphOptionsResolver;
use App\Services\Providers\ProviderConfigurationRequiredException;
use App\Services\Providers\ProviderGateway;
use App\Support\Providers\ProviderReasonCodes;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

it('fails explicitly when provider-owned graph option assembly cannot resolve identity', function (): void {
    $connection = ProviderConnection::factory()->dedicated()->consentGranted()->create([
        'entra_tenant_id' => 'entra-tenant-id',
    ]);

    $call = fn (): array => app(ProviderGateway::class)->graphOptions($connection);

    expect($call)->toThrow(RuntimeException::class, 'Provider credentials are missing.');
});

it('does not inherit Microsoft runtime behavior when a default provider connection is unsupported', function (): void {
    $tenant = Tenant::factory()->create();

    ProviderConnection::factory()->dedicated()->create([
        'tenant_id' => $tenant->getKey(),
        'workspace_id' => $tenant->workspace_id,
        'provider' => 'microsoft',
        'entra_tenant_id' => 'entra-tenant-id',
        'is_default' => true,
        'consent_status' => 'required',
    ]);

    $call = fn (): array => app(MicrosoftGraphOptionsResolver::class)->resolveForTenant($tenant);

    expect($call)->toThrow(ProviderConfigurationRequiredException::class);

    try {
        $call();
    } catch (ProviderConfigurationRequiredException $exception) {
        expect($exception->reasonCode)->toBe(ProviderReasonCodes::ProviderConsentMissing)
            ->and($exception->provider)->toBe('microsoft');
    }
});