<?php

use App\Livewire\Admin\Datacenters;
use App\Livewire\Admin\Provisioning;
use App\Models\Datacenter;
use App\Models\User;
use Illuminate\Auth\Access\AuthorizationException;
use Livewire\Livewire;

function operator(string $role): User
{
    return User::factory()->operator($role)->create();
}

it('grants console access to every operator role but not to customers', function () {
    foreach (['Owner', 'Admin', 'Support', 'Billing', 'Read-only'] as $role) {
        $this->actingAs(operator($role))->get(route('admin.overview'))->assertOk();
    }
    $customer = User::factory()->create(); // no role
    $this->actingAs($customer)->get(route('admin.overview'))->assertForbidden();
});

it('denies console access to a role-less account even if is_admin is set', function () {
    // RBAC is the boundary — the bare legacy flag must never grant access, so a
    // revoked operator (roles removed) cannot reach the console.
    $noRole = User::factory()->create(['is_admin' => true]);
    $noRole->syncRoles([]);

    $this->actingAs($noRole)->get(route('admin.overview'))->assertForbidden();
});

it('denies datacenter management to roles without the capability', function () {
    foreach (['Support', 'Billing', 'Read-only'] as $role) {
        Livewire::actingAs(operator($role))->test(Datacenters::class)
            ->set('code', 'xy')->set('name', 'X')->call('save')->assertForbidden();
    }
    expect(Datacenter::query()->where('code', 'xy')->exists())->toBeFalse();

    // Admin has the capability.
    Livewire::actingAs(operator('Admin'))->test(Datacenters::class)
        ->set('code', 'nbg2')->set('name', 'Nürnberg')->call('save')->assertHasNoErrors();
    expect(Datacenter::query()->where('code', 'nbg2')->exists())->toBeTrue();
});

it('lets Support retry provisioning but not manage datacenters', function () {
    // Support can retry (capability present) — the action runs (no-op on a missing run).
    Livewire::actingAs(operator('Support'))->test(Provisioning::class)->call('retry', 'nonexistent-uuid')->assertOk();

    // ...but cannot manage datacenters.
    Livewire::actingAs(operator('Support'))->test(Datacenters::class)->call('toggle', 'x')->assertForbidden();
});