<?php

use App\Enums\PurchasingRole;
use App\Models\Tenant;
use App\Models\User;
use App\Services\OrganizationAccess;
use App\Services\OrganizationActivationPreview;
use App\Services\OrganizationConfiguration;
use App\Services\WorkContext;
use Illuminate\Support\Facades\DB;
use Inertia\Testing\AssertableInertia as Assert;

require_once __DIR__.'/../Support/ReceiptFixture.php';

function activationPreviewProfile(int $tenant, string $name, array $permissions, array $contexts = []): int
{
    return DB::table('organization_profiles')->insertGetId(['tenant_id' => $tenant, 'name' => $name, 'permissions' => json_encode($permissions, JSON_THROW_ON_ERROR),
        'work_contexts' => json_encode($contexts, JSON_THROW_ON_ERROR), 'version' => 1, 'created_at' => now(), 'updated_at' => now()]);
}

function activationPreviewMember(int $tenant, int $user, int $profile, array $extra = []): void
{
    DB::table('organization_memberships')->insert(['tenant_id' => $tenant, 'user_id' => $user, 'profile_id' => $profile, 'maintenance' => false, 'created_at' => now(), 'updated_at' => now(), ...$extra]);
}

beforeEach(function () {
    $this->f = receiptFixture();
    $this->admin = $this->f['issuer'];
    $this->admin->forceFill(['purchasing_role' => PurchasingRole::Admin])->save();
    $this->second = User::factory()->create(['tenant_id' => $this->admin->tenant_id, 'purchasing_role' => PurchasingRole::Requester]);
    $this->profile = activationPreviewProfile($this->admin->tenant_id, 'Administração sintética', ['admin']);
    foreach ([$this->admin, $this->second] as $user) {
        activationPreviewMember($user->tenant_id, $user->id, $this->profile);
    }
    DB::table('organization_access')->insert(['tenant_id' => $this->admin->tenant_id, 'active' => false, 'version' => 1, 'created_at' => now(), 'updated_at' => now()]);
    $this->actingAs($this->admin);
    $this->path = '/administracao/parametrizacao';
});

test('activation preview exposes access losses implicit request preparation and profile tasks without writing configuration', function () {
    $before = [];
    foreach (['organization_access', 'organization_profiles', 'organization_memberships', 'users', 'tenants', 'audit_logs', 'requisitions', 'purchase_orders'] as $table) {
        $before[$table] = DB::table($table)->get()->toArray();
    }
    $this->get($this->path)->assertOk()->assertHeader('Cache-Control', 'max-age=0, no-store, private')
        ->assertInertia(fn (Assert $page) => $page->where('activationPreview.active', false)->where('activationPreview.version', 1)
            ->where('activationPreview.permanent_administrators', 2)->where('activationPreview.losing_access', 2)
            ->where('activationPreview.provisional_rules', true)->where('activationPreview.can_activate', false)
            ->where('workflowTasks.procurement.1.key', 'procurement.prepare'));
    $rows = collect(app(OrganizationActivationPreview::class)->build($this->admin)['users'])->keyBy('id');
    expect($rows[$this->second->id]['current_permissions'])->toBe(['requester'])
        ->and($rows[$this->second->id]['configured_permissions'])->toBe(['admin'])
        ->and($rows[$this->second->id]['current_can_request'])->toBeTrue()->and($rows[$this->second->id]['configured_can_request'])->toBeFalse()
        ->and($rows[$this->f['receiver']->id]['loses_access'])->toBeTrue();
    foreach ($before as $table => $snapshot) {
        expect(DB::table($table)->get()->toArray())->toEqual($snapshot);
    }
});

test('activation preview agrees with the effective authority after explicit activation and preserves existing processes', function () {
    DB::table('tenants')->where('id', $this->admin->tenant_id)->update(['rules_provisional' => false]);
    $before = $this->f['r']->fresh()->toArray();
    $preview = app(OrganizationActivationPreview::class)->build($this->admin);
    expect($preview['can_activate'])->toBeTrue();
    $this->post($this->path.'/activate', ['version' => $preview['version'], 'confirm' => true, 'reason' => 'Activação explícita apenas no ensaio sintético.'])->assertSessionHasNoErrors()->assertRedirect();
    foreach ($preview['users'] as $person) {
        $user = User::query()->findOrFail($person['id']);
        expect(app(OrganizationAccess::class)->permissions($user))->toBe($person['configured_permissions'])
            ->and(app(OrganizationAccess::class)->canRequest($user))->toBe($person['configured_can_request']);
    }
    $this->get($this->path)->assertInertia(fn (Assert $page) => $page->where('activationPreview.active', true)->where('activationPreview.version', 2));
    expect($this->f['r']->fresh()->toArray())->toBe($before)->and(DB::table('audit_logs')->where('action', 'organization.activate')->count())->toBe(1);
});

test('activation preview counts only permanent independent administrators and honours expiry and maintenance', function () {
    DB::table('tenants')->where('id', $this->admin->tenant_id)->update(['rules_provisional' => false]);
    DB::table('organization_memberships')->where('user_id', $this->second->id)->update(['expires_at' => now()->addHour()]);
    $maintenance = activationPreviewProfile($this->admin->tenant_id, 'Consulta temporária sintética', ['warehouse']);
    activationPreviewMember($this->admin->tenant_id, $this->f['receiver']->id, $maintenance, ['maintenance' => true, 'expires_at' => now()->addHour()]);
    $preview = app(OrganizationActivationPreview::class)->build($this->admin);
    $rows = collect($preview['users'])->keyBy('id');
    expect($preview['permanent_administrators'])->toBe(1)->and($preview['can_activate'])->toBeFalse()
        ->and($rows[$this->f['receiver']->id]['configured_maintenance_only'])->toBeTrue();
    $this->postJson($this->path.'/activate', ['version' => 1, 'confirm' => true, 'reason' => 'Não activar com administração permanente insuficiente.'])->assertUnprocessable()->assertJsonValidationErrors('administrators');
    $this->travel(2)->hours();
    $rows = collect(app(OrganizationActivationPreview::class)->build($this->admin)['users'])->keyBy('id');
    expect($rows[$this->second->id]['configured_permissions'])->toBe([])
        ->and($rows[$this->f['receiver']->id]['configured_permissions'])->toBe([])
        ->and($rows[$this->f['receiver']->id]['configured_maintenance_only'])->toBeFalse()
        ->and(app(OrganizationAccess::class)->active($this->admin->tenant_id))->toBeFalse();
});

test('activation preview uses the same company licence context and functional intersection as runtime', function () {
    DB::table('tenants')->where('id', $this->admin->tenant_id)->update(['rules_provisional' => false, 'work_context_policy' => json_encode(['revision' => 1, 'enabled' => ['procurement.internal', 'people.internal']], JSON_THROW_ON_ERROR)]);
    config(['work_context.entitlements.'.$this->admin->tenant_id => ['procurement.internal']]);
    $profile = activationPreviewProfile($this->admin->tenant_id, 'Preparação nas áreas autorizadas', ['requester', 'people_service_prepare'], ['procurement.internal', 'people.internal']);
    activationPreviewMember($this->admin->tenant_id, $this->f['receiver']->id, $profile);
    $preview = app(OrganizationActivationPreview::class)->build($this->admin);
    $rows = collect($preview['users'])->keyBy('id');
    expect($rows[$this->f['receiver']->id]['configured_contexts'])->toBe(['procurement.internal']);
    $this->post($this->path.'/activate', ['version' => 1, 'confirm' => true, 'reason' => 'Activação sintética respeitando os contextos contratados.'])->assertSessionHasNoErrors();
    expect(app(WorkContext::class)->available($this->f['receiver']))->toBe($rows[$this->f['receiver']->id]['configured_contexts']);
    $this->actingAs($this->f['receiver'])->post('/contexto', ['area' => 'people', 'option' => 'people.internal'])->assertForbidden();
});

test('activation preview cannot be read by warehouse users or expose another company configuration', function () {
    $this->actingAs($this->f['receiver'])->get($this->path)->assertForbidden();
    $tenant = Tenant::query()->create(['name' => 'Outra organização sintética']);
    $foreign = User::factory()->create(['tenant_id' => $tenant->id, 'purchasing_role' => PurchasingRole::Admin]);
    $this->actingAs($foreign)->get($this->path)->assertInertia(fn (Assert $page) => $page->has('activationPreview.users', 1)
        ->where('activationPreview.users.0.id', $foreign->id)->where('activationPreview.permanent_administrators', 0));
});

test('activation preview is informational and cannot replace confirmation or an up to date version', function () {
    DB::table('tenants')->where('id', $this->admin->tenant_id)->update(['rules_provisional' => false]);
    $preview = app(OrganizationActivationPreview::class)->build($this->admin);
    $this->postJson($this->path.'/activate', ['version' => 1, 'reason' => 'Não activar pela mera leitura do diagnóstico.'])->assertUnprocessable()->assertJsonValidationErrors('confirm');
    app(OrganizationConfiguration::class)->execute($this->admin, 'profile', ['version' => 1, 'name' => 'Consulta sintética', 'permissions' => ['warehouse_request_read']]);
    $this->postJson($this->path.'/activate', ['version' => $preview['version'], 'confirm' => true, 'reason' => 'Uma versão anterior não confirma alterações posteriores.'])->assertUnprocessable()->assertJsonValidationErrors('version');
    expect(app(OrganizationAccess::class)->active($this->admin->tenant_id))->toBeFalse();
    $this->get($this->path)->assertInertia(fn (Assert $page) => $page->where('activationPreview.version', 2));
});