<?php

namespace Tests\Feature;

use App\Models\Admin;
use App\Models\User;
use Illuminate\Foundation\Testing\DatabaseTransactions;
use Illuminate\Support\Facades\DB;
use Tests\TestCase;

/**
 * Stats exposes platform-wide financial data, so entry must be blocked for
 * anyone without an Admin/Bank profile carrying the stats permission.
 */
class StatsAccessTest extends TestCase
{
    use DatabaseTransactions;

    /** A user that clears the verified / registration-complete middleware. */
    private function makeUser(string $name): User
    {
        $id = DB::table('users')->insertGetId([
            'name'                      => $name,
            'full_name'                 => $name,
            'email'                     => $name . '@example.test',
            'password'                  => bcrypt('secret'),
            'email_verified_at'         => now(),
            'principles_terms_accepted' => true,
            'created_at'                => now(),
            'updated_at'                => now(),
        ]);

        return User::find($id);
    }

    public function test_guest_is_redirected_to_login(): void
    {
        $this->get(route('stats'))->assertRedirect();
        $this->get(route('stats.pdf'))->assertRedirect();
    }

    public function test_plain_user_profile_cannot_reach_stats(): void
    {
        $user = $this->makeUser('stats_plain_user');

        $this->actingAs($user, 'web');
        session(['activeProfileType' => User::class, 'activeProfileId' => $user->id]);

        $this->assertNotSame(200, $this->get(route('stats'))->getStatusCode());
        $this->assertNotSame(200, $this->get(route('stats.pdf'))->getStatusCode());
    }

    public function test_admin_profile_without_the_permission_cannot_reach_stats(): void
    {
        $user = $this->makeUser('stats_unprivileged_admin');

        $adminId = DB::table('admins')->insertGetId([
            'name'              => 'stats_admin_profile',
            'full_name'         => 'Stats Admin Profile',
            'email'             => 'stats_admin_profile@example.test',
            'password'          => bcrypt('secret'),
            'email_verified_at' => now(),
            'created_at'        => now(),
            'updated_at'        => now(),
        ]);

        $admin = Admin::find($adminId);
        $admin->users()->attach($user->id);

        // Authenticated on both guards, but holding no stats permission at all.
        $this->actingAs($user, 'web');
        session(['activeProfileType' => Admin::class, 'activeProfileId' => $admin->id]);

        $this->assertNotSame(200, $this->get(route('stats'))->getStatusCode());
        $this->assertNotSame(200, $this->get(route('stats.pdf'))->getStatusCode());
    }
}