dyncoll-dev/backend/tests/Feature/InstitutionLinkControllerTest.php

<?php

namespace Tests\Feature;

use App\Enums\InstitutionLinkType;
use App\Models\Institution;
use App\Models\InstitutionLink;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class InstitutionLinkControllerTest extends TestCase
{
    use RefreshDatabase;

    /**
     * @param  array<string, mixed>  $overrides
     * @return array<string, mixed>
     */
    private function validPayload(array $overrides = []): array
    {
        return array_merge([
            'url' => 'https://example.org',
            'type' => InstitutionLinkType::Official->value,
            'label' => 'Official site',
            'sort_order' => 1,
        ], $overrides);
    }

    // --- Lettura (tier.app) --------------------------------------------------

    public function test_index_lists_links_of_an_institution_ordered(): void
    {
        $this->actingAs($this->operationalUser(), 'sanctum');
        $institution = Institution::factory()->create();
        $second = InstitutionLink::factory()->create(['institution_id' => $institution->id, 'sort_order' => 2]);
        $first = InstitutionLink::factory()->create(['institution_id' => $institution->id, 'sort_order' => 1]);

        $this->getJson("/api/institutions/{$institution->uuid}/links")
            ->assertOk()
            ->assertJsonCount(2, 'data')
            ->assertJsonPath('data.0.id', $first->id)
            ->assertJsonPath('data.1.id', $second->id);
    }

    public function test_show_returns_a_single_link(): void
    {
        $this->actingAs($this->operationalUser(), 'sanctum');
        $institution = Institution::factory()->create();
        $link = InstitutionLink::factory()->create(['institution_id' => $institution->id]);

        $this->getJson("/api/institutions/{$institution->uuid}/links/{$link->id}")
            ->assertOk()
            ->assertJsonPath('data.id', $link->id);
    }

    public function test_show_returns_not_found_when_the_link_belongs_to_another_institution(): void
    {
        $this->actingAs($this->operationalUser(), 'sanctum');
        $institution = Institution::factory()->create();
        $otherInstitution = Institution::factory()->create();
        $link = InstitutionLink::factory()->create(['institution_id' => $otherInstitution->id]);

        $this->getJson("/api/institutions/{$institution->uuid}/links/{$link->id}")->assertNotFound();
    }

    // --- Scrittura (tier.admin) ---------------------------------------------

    public function test_admin_can_add_a_link_to_an_institution(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $institution = Institution::factory()->create();

        $this->postJson("/api/institutions/{$institution->uuid}/links", $this->validPayload())
            ->assertCreated()
            ->assertJsonPath('data.url', 'https://example.org')
            ->assertJsonPath('data.institution_id', $institution->id);

        $this->assertDatabaseHas('institution_links', [
            'institution_id' => $institution->id,
            'url' => 'https://example.org',
        ]);
    }

    public function test_store_defaults_sort_order_to_zero_when_missing(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $institution = Institution::factory()->create();
        $payload = $this->validPayload();
        unset($payload['sort_order']);

        $this->postJson("/api/institutions/{$institution->uuid}/links", $payload)
            ->assertCreated()
            ->assertJsonPath('data.sort_order', 0);
    }

    public function test_store_validates_required_fields(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $institution = Institution::factory()->create();

        $this->postJson("/api/institutions/{$institution->uuid}/links", [])
            ->assertStatus(422)
            ->assertJsonValidationErrors(['url', 'type']);
    }

    public function test_admin_can_update_a_link(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $institution = Institution::factory()->create();
        $link = InstitutionLink::factory()->create(['institution_id' => $institution->id]);

        $this->putJson(
            "/api/institutions/{$institution->uuid}/links/{$link->id}",
            $this->validPayload(['url' => 'https://updated.example.org'])
        )
            ->assertOk()
            ->assertJsonPath('data.url', 'https://updated.example.org');

        $this->assertSame('https://updated.example.org', $link->fresh()->url);
    }

    public function test_admin_can_delete_a_link(): void
    {
        $this->actingAs($this->adminUser(), 'sanctum');
        $institution = Institution::factory()->create();
        $link = InstitutionLink::factory()->create(['institution_id' => $institution->id]);

        $this->deleteJson("/api/institutions/{$institution->uuid}/links/{$link->id}")->assertOk();

        $this->assertDatabaseMissing('institution_links', ['id' => $link->id]);
    }

    // --- Autorizzazione ------------------------------------------------------

    public function test_a_non_admin_cannot_write(): void
    {
        $this->actingAs($this->operationalUser(), 'sanctum');
        $institution = Institution::factory()->create();

        $this->postJson("/api/institutions/{$institution->uuid}/links", $this->validPayload())->assertForbidden();
    }

    public function test_guests_cannot_access_links(): void
    {
        $institution = Institution::factory()->create();

        $this->getJson("/api/institutions/{$institution->uuid}/links")->assertUnauthorized();
    }
}