<?php

declare(strict_types=1);

namespace App\Tests\Module\Commercial\Api;

use App\Module\Commercial\Domain\Entity\Supplier;

/**
 * Mode strict PATCH multi-groupes fournisseur (M2, RG-2.16) — preuve fonctionnelle
 * HTTP, SANS dependre d'un role metier : un user portant
 * `commercial.suppliers.manage` mais PAS `commercial.suppliers.accounting.manage`
 * qui envoie un PATCH melant un champ principal (companyName) et un champ
 * comptable (siren) recoit 403 sur TOUT le payload — aucun champ applique (pas de
 * filtrage silencieux). Jumeau de ClientPatchStrictTest (M1).
 *
 * @internal
 */
final class SupplierPatchStrictTest extends AbstractSupplierApiTestCase
{
    public function testMixedGroupsPatchWithoutAccountingPermissionIsForbidden(): void
    {
        $seed        = $this->seedSupplier('Strict Mix');
        $credentials = $this->createUserWithPermission('commercial.suppliers.manage');
        $client      = $this->authenticatedClient($credentials['username'], $credentials['password']);

        $client->request('PATCH', '/api/suppliers/'.$seed->getId(), [
            'headers' => ['Content-Type' => self::MERGE],
            'json'    => [
                'companyName' => 'Renamed Strict',
                'siren'       => '123456789',
            ],
        ]);

        // RG-2.16 : 403 strict (le champ comptable siren exige accounting.manage).
        self::assertResponseStatusCodeSame(403);

        // Aucun champ applique : le companyName d'origine est intact.
        $em = $this->getEm();
        $em->clear();
        $reloaded = $em->getRepository(Supplier::class)->find($seed->getId());
        self::assertNotNull($reloaded);
        self::assertSame('STRICT MIX', $reloaded->getCompanyName());
    }
}
