<?php

namespace Tests\Feature\Api;

use App\Models\User;
use App\Modules\Identity\Domain\Enums\AccountStatus;
use App\Modules\Identity\Domain\Enums\UserRole;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class AuthTest extends TestCase
{
    use RefreshDatabase;

    public function test_active_user_can_login_and_read_identity(): void
    {
        $user = User::factory()->create([
            'email' => 'designer@example.test',
            'password' => 'correct-password',
            'role' => UserRole::CourseDesigner,
        ]);

        $login = $this->postJson('/api/v1/auth/login', [
            'email' => 'designer@example.test',
            'password' => 'correct-password',
            'device_name' => 'test-suite',
        ]);

        $login->assertOk()
            ->assertJsonPath('data.user.id', $user->getKey())
            ->assertJsonPath('data.user.role', UserRole::CourseDesigner->value)
            ->assertJsonPath('data.user.locale', 'fa')
            ->assertJsonPath('data.user.deployment.mode', 'saas')
            ->assertJsonFragment(['courses.author'])
            ->assertJsonStructure(['data' => ['token', 'user']]);

        $this->withToken($login->json('data.token'))
            ->getJson('/api/v1/auth/me')
            ->assertOk()
            ->assertJsonPath('data.organization.id', $user->organization_id);
    }

    public function test_every_seeded_workspace_role_can_login_with_the_review_credentials(): void
    {
        $this->seed();

        $accounts = [
            'admin@microlearn.test' => UserRole::SuperAdmin,
            'designer@microlearn.test' => UserRole::CourseDesigner,
            'manager@microlearn.test' => UserRole::Manager,
            'maryam@microlearn.test' => UserRole::Learner,
        ];

        foreach ($accounts as $email => $role) {
            $this->flushHeaders();
            $login = $this->postJson('/api/v1/auth/login', [
                'email' => $email,
                'password' => 'password',
                'device_name' => 'four-role-login-test',
            ]);

            $login->assertOk()
                ->assertJsonPath('data.user.email', $email)
                ->assertJsonPath('data.user.role', $role->value)
                ->assertJsonStructure(['data' => ['token', 'user' => ['permissions', 'deployment']]]);

            $this->app['auth']->forgetGuards();
            $this->withToken($login->json('data.token'))
                ->getJson('/api/v1/auth/me')
                ->assertOk()
                ->assertJsonPath('data.role', $role->value);
        }
        $this->flushHeaders();
    }

    public function test_disabled_user_cannot_login(): void
    {
        User::factory()->create([
            'email' => 'disabled@example.test',
            'password' => 'correct-password',
            'status' => AccountStatus::Disabled,
        ]);

        $this->postJson('/api/v1/auth/login', [
            'email' => 'disabled@example.test',
            'password' => 'correct-password',
        ])->assertForbidden()->assertJsonPath('error.code', 'account_disabled');
    }

    public function test_invalid_credentials_return_validation_error(): void
    {
        $this->postJson('/api/v1/auth/login', [
            'email' => 'missing@example.test',
            'password' => 'incorrect',
        ])->assertUnprocessable()->assertJsonValidationErrors('email');
    }

    public function test_user_from_disabled_organization_cannot_login(): void
    {
        $user = User::factory()->create(['email' => 'inactive-org@example.test', 'password' => 'correct-password']);
        $user->organization->update(['status' => 'disabled']);

        $this->postJson('/api/v1/auth/login', ['email' => 'inactive-org@example.test', 'password' => 'correct-password'])
            ->assertForbidden()->assertJsonPath('error.code', 'organization_unavailable');
    }
}