<?php

namespace Tests\Feature\Tenancy;

use App\Models\User;
use App\Modules\Identity\Domain\Enums\UserRole;
use App\Modules\Organizations\Domain\Organization;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Laravel\Sanctum\Sanctum;
use Tests\TestCase;

class TenantContextTest extends TestCase
{
    use RefreshDatabase;

    public function test_organization_context_comes_from_authenticated_user_not_client_input(): void
    {
        $organization = Organization::factory()->create();
        $otherOrganization = Organization::factory()->create();
        $user = User::factory()->for($organization)->create(['role' => UserRole::CourseDesigner]);
        Sanctum::actingAs($user);

        $this->getJson('/api/v1/organization-context?organization_id='.$otherOrganization->getKey())
            ->assertOk()
            ->assertJsonPath('data.id', $organization->getKey())
            ->assertJsonMissing(['id' => $otherOrganization->getKey()]);
    }

    public function test_platform_super_admin_cannot_enter_tenant_route_implicitly(): void
    {
        $superAdmin = User::factory()->create([
            'organization_id' => null,
            'role' => UserRole::SuperAdmin,
        ]);
        Sanctum::actingAs($superAdmin);

        $this->getJson('/api/v1/organization-context')
            ->assertForbidden()
            ->assertJsonPath('error.code', 'tenant_context_not_applicable');

        $this->getJson('/api/v1/notifications')
            ->assertForbidden()
            ->assertJsonPath('error.code', 'tenant_context_not_applicable');
    }

    public function test_inactive_organization_is_rejected(): void
    {
        $organization = Organization::factory()->create(['status' => 'suspended']);
        $user = User::factory()->for($organization)->create();
        Sanctum::actingAs($user);

        $this->getJson('/api/v1/organization-context')
            ->assertForbidden()
            ->assertJsonPath('error.code', 'organization_unavailable');
    }
}