<?php

use App\Models\Agent;
use App\Models\Booking;
use App\Models\Customer;
use App\Models\User;
use Database\Seeders\PermissionSeeder;
use Database\Seeders\RoleSeeder;
use Illuminate\Foundation\Testing\LazilyRefreshDatabase;

uses(LazilyRefreshDatabase::class);

beforeEach(function () {
    $this->withHeaders([
        'Origin' => 'http://localhost:3000',
        'Referer' => 'http://localhost:3000/',
    ]);
});

it('keeps login public', function () {
    $this->postJson('/api/login', [])
        ->assertUnprocessable();
});

it('requires authentication for the current user endpoint', function () {
    $this->getJson('/api/me')
        ->assertUnauthorized();
});

it('requires authentication for customer routes', function () {
    $this->getJson('/api/customers')
        ->assertUnauthorized();
});

it('requires an admin role for user management routes', function () {
    $this->seed([
        PermissionSeeder::class,
        RoleSeeder::class,
    ]);

    $manager = User::factory()->manager()->create();

    $this->actingAs($manager)
        ->getJson('/api/users')
        ->assertForbidden();
});

it('allows admins to access user management routes', function () {
    $this->seed([
        PermissionSeeder::class,
        RoleSeeder::class,
    ]);

    $admin = User::factory()->admin()->create();

    $this->actingAs($admin)
        ->getJson('/api/users')
        ->assertSuccessful();
});

it('allows managers to view customers', function () {
    $this->seed([
        PermissionSeeder::class,
        RoleSeeder::class,
    ]);

    $manager = User::factory()->manager()->create();

    $this->actingAs($manager)
        ->getJson('/api/customers')
        ->assertSuccessful();
});

it('forbids managers from deleting customers', function () {
    $this->seed([
        PermissionSeeder::class,
        RoleSeeder::class,
    ]);

    $manager = User::factory()->manager()->create();
    $customer = Customer::factory()->for($manager, 'creator')->create();

    $this->actingAs($manager)
        ->deleteJson("/api/customers/{$customer->id}")
        ->assertForbidden();
});

it('requires authentication for agent routes', function () {
    $this->getJson('/api/agents')
        ->assertUnauthorized();
});

it('allows managers to view agents', function () {
    $this->seed([
        PermissionSeeder::class,
        RoleSeeder::class,
    ]);

    $manager = User::factory()->manager()->create();

    $this->actingAs($manager)
        ->getJson('/api/agents')
        ->assertSuccessful();
});

it('forbids managers from deleting agents', function () {
    $this->seed([
        PermissionSeeder::class,
        RoleSeeder::class,
    ]);

    $manager = User::factory()->manager()->create();
    $agent = Agent::factory()->for($manager, 'creator')->create();

    $this->actingAs($manager)
        ->deleteJson("/api/agents/{$agent->id}")
        ->assertForbidden();
});

it('requires authentication for unit routes', function () {
    $this->getJson('/api/units')
        ->assertUnauthorized();
});

it('allows managers to view units', function () {
    $this->seed([
        PermissionSeeder::class,
        RoleSeeder::class,
    ]);

    $manager = User::factory()->manager()->create();

    $this->actingAs($manager)
        ->getJson('/api/units')
        ->assertSuccessful();
});

it('forbids managers from creating units', function () {
    $this->seed([
        PermissionSeeder::class,
        RoleSeeder::class,
    ]);

    $manager = User::factory()->manager()->create();

    $this->actingAs($manager)
        ->postJson('/api/units', [
            'name' => 'Shop',
        ])
        ->assertForbidden();
});

it('forbids managers from cancelling bookings', function () {
    $this->seed([
        PermissionSeeder::class,
        RoleSeeder::class,
    ]);

    $manager = User::factory()->manager()->create();
    $booking = Booking::factory()->for($manager, 'creator')->create();

    $this->actingAs($manager)
        ->deleteJson("/api/bookings/{$booking->id}")
        ->assertForbidden();
});
