<?php

namespace Tests\Feature\Auth;

use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class AuthControllerTest extends TestCase
{
    use RefreshDatabase;

    public function test_me_returns_authenticated_user_with_setup_status(): void
    {
        $user = $this->operationalUser();
        $this->actingAs($user, 'sanctum');

        $response = $this->getJson('/api/user');

        $response->assertOk()
            ->assertJsonPath('id', $user->id)
            ->assertJsonPath('email', $user->email)
            ->assertJsonPath('setup_status', 'complete');

        // Gli attributi sensibili non devono mai essere serializzati.
        $this->assertArrayNotHasKey('password', $response->json());
        $this->assertArrayNotHasKey('two_factor_secret', $response->json());
        $this->assertArrayNotHasKey('two_factor_recovery_codes', $response->json());
    }

    public function test_me_is_reachable_during_setup(): void
    {
        // La rotta /user è nel tier "transitional": deve restare accessibile anche
        // a setup incompleto, così il frontend può leggere setup_status.
        $user = $this->setupIncompleteUser();
        $this->actingAs($user, 'sanctum');

        $this->getJson('/api/user')
            ->assertOk()
            ->assertJsonPath('setup_status', 'password_required');
    }

    public function test_me_requires_authentication(): void
    {
        $this->getJson('/api/user')->assertUnauthorized();
    }

    public function test_logout_succeeds_and_forgets_cookies(): void
    {
        $user = $this->operationalUser();
        $this->actingAs($user, 'sanctum');

        $response = $this->postJson('/api/logout');

        $response->assertOk()
            ->assertJsonPath('message', config('messages.auth.logout_success'))
            ->assertCookieExpired('XSRF-TOKEN');
    }

    public function test_destroy_account_soft_deletes_the_user(): void
    {
        $user = $this->operationalUser();
        $this->actingAs($user, 'sanctum');

        $this->deleteJson('/api/account')
            ->assertOk()
            ->assertJsonPath('message', config('messages.account.deleted'));

        $this->assertSoftDeleted('users', ['id' => $user->id]);
    }

    public function test_destroy_account_is_forbidden_for_the_system_user(): void
    {
        $user = $this->systemUser();
        $this->actingAs($user, 'sanctum');

        $this->deleteJson('/api/account')->assertForbidden();

        $this->assertDatabaseHas('users', ['id' => $user->id, 'deleted_at' => null]);
    }

    public function test_session_endpoints_require_authentication(): void
    {
        $this->postJson('/api/logout')->assertUnauthorized();
        $this->deleteJson('/api/account')->assertUnauthorized();
    }
}