dyncoll-dev/backend/tests/Feature/UserControllerTest.php

<?php

namespace Tests\Feature;

use App\Models\Lists\UserRole;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Testing\TestResponse;
use Tests\TestCase;

class UserControllerTest extends TestCase
{
    use RefreshDatabase;

    /** @return list<int> id presenti in data della risposta. */
    private function idsFrom(TestResponse $response): array
    {
        return collect($response->json('data'))->pluck('id')->all();
    }

    // --- Gating ---------------------------------------------------------------

    public function test_index_requires_authentication(): void
    {
        $this->getJson('/api/users')->assertUnauthorized();
    }

    public function test_index_is_forbidden_for_non_admin(): void
    {
        $this->actingAs($this->operationalUser(), 'sanctum');

        $this->getJson('/api/users')->assertForbidden();
    }

    // --- Index ----------------------------------------------------------------

    public function test_index_returns_paginated_envelope(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');

        $this->getJson('/api/users')
            ->assertOk()
            ->assertJsonStructure([
                'message',
                'data',
                'meta' => ['current_page', 'last_page', 'per_page', 'total'],
            ]);
    }

    public function test_index_filters_by_search_term(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $match = $this->operationalUser(['name' => 'Zzz Unique Marker']);
        $other = $this->operationalUser(['name' => 'Someone Else']);

        $ids = $this->idsFrom($this->getJson('/api/users?search=Unique+Marker')->assertOk());

        $this->assertContains($match->id, $ids);
        $this->assertNotContains($other->id, $ids);
    }

    public function test_index_filters_by_role(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $role = UserRole::factory()->create();
        $inRole = $this->operationalUser(['role_id' => $role->id]);
        $outRole = $this->operationalUser();

        $ids = $this->idsFrom($this->getJson("/api/users?role_id={$role->id}")->assertOk());

        $this->assertContains($inRole->id, $ids);
        $this->assertNotContains($outRole->id, $ids);
    }

    public function test_index_excludes_trashed_by_default(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $trashed = $this->operationalUser();
        $trashed->delete();

        $ids = $this->idsFrom($this->getJson('/api/users')->assertOk());

        $this->assertNotContains($trashed->id, $ids);
    }

    public function test_index_can_include_trashed(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $active = $this->operationalUser();
        $trashed = $this->operationalUser();
        $trashed->delete();

        $ids = $this->idsFrom($this->getJson('/api/users?trashed=with')->assertOk());

        $this->assertContains($active->id, $ids);
        $this->assertContains($trashed->id, $ids);
    }

    public function test_index_can_return_only_trashed(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $active = $this->operationalUser();
        $trashed = $this->operationalUser();
        $trashed->delete();

        $ids = $this->idsFrom($this->getJson('/api/users?trashed=only')->assertOk());

        $this->assertContains($trashed->id, $ids);
        $this->assertNotContains($active->id, $ids);
    }

    public function test_index_respects_per_page(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');

        $this->getJson('/api/users?per_page=5')
            ->assertOk()
            ->assertJsonPath('meta.per_page', 5);
    }

    public function test_index_rejects_an_excessive_per_page(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');

        $this->getJson('/api/users?per_page=500')
            ->assertUnprocessable()
            ->assertJsonValidationErrors('per_page');
    }

    public function test_index_rejects_an_unknown_trashed_value(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');

        $this->getJson('/api/users?trashed=garbage')
            ->assertUnprocessable()
            ->assertJsonValidationErrors('trashed');
    }

    // --- Show -----------------------------------------------------------------

    public function test_show_returns_a_user_with_role(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $user = $this->operationalUser();

        $this->getJson("/api/users/{$user->id}")
            ->assertOk()
            ->assertJsonPath('data.id', $user->id)
            ->assertJsonPath('data.setup_status', 'complete');
    }

    public function test_show_can_load_a_trashed_user(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $user = $this->operationalUser();
        $user->delete();

        $this->getJson("/api/users/{$user->id}")
            ->assertOk()
            ->assertJsonPath('data.id', $user->id);
    }

    public function test_show_is_forbidden_for_non_admin(): void
    {
        $this->actingAs($this->operationalUser(), 'sanctum');
        $target = User::factory()->create();

        $this->getJson("/api/users/{$target->id}")->assertForbidden();
    }
}