<?php

namespace Tests\Feature\Auth;

use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

/**
 * Verifica la scala di accesso (tier.app / tier.admin) attraverso rotte reali:
 * - tier.app  → user-roles index (auth + verified + setup.complete)
 * - tier.admin→ users index      (+ admin)
 * Copre i rami di EnsureSetupComplete, del middleware `verified` e di IsAdmin.
 */
class AccessTierTest extends TestCase
{
    use RefreshDatabase;

    private const APP_ROUTE = '/api/user-roles';

    private const ADMIN_ROUTE = '/api/users';

    public function test_tier_app_allows_a_fully_operational_user(): void
    {
        $this->actingAs($this->operationalUser(), 'sanctum');

        $this->getJson(self::APP_ROUTE)->assertOk();
    }

    public function test_tier_app_requires_authentication(): void
    {
        $this->getJson(self::APP_ROUTE)->assertUnauthorized();
    }

    public function test_tier_app_blocks_user_who_must_change_password(): void
    {
        $this->actingAs($this->setupIncompleteUser(), 'sanctum');

        $this->getJson(self::APP_ROUTE)
            ->assertForbidden()
            ->assertJsonPath('setup_status', 'password_required');
    }

    public function test_tier_app_blocks_user_without_two_factor_setup(): void
    {
        $user = $this->operationalUser(['two_factor_setup_completed_at' => null]);
        $this->actingAs($user, 'sanctum');

        $this->getJson(self::APP_ROUTE)
            ->assertForbidden()
            ->assertJsonPath('setup_status', '2fa_setup_required');
    }

    public function test_tier_app_blocks_unverified_user(): void
    {
        $this->actingAs($this->unverifiedUser(), 'sanctum');

        $this->getJson(self::APP_ROUTE)->assertForbidden();
    }

    public function test_tier_admin_allows_admin(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');

        $this->getJson(self::ADMIN_ROUTE)->assertOk();
    }

    public function test_tier_admin_forbids_non_admin(): void
    {
        $this->actingAs($this->operationalUser(), 'sanctum');

        $this->getJson(self::ADMIN_ROUTE)->assertForbidden();
    }
}