<?php

use App\Models\User;
use Facades\Tests\Setup\UserFactory;
use Tests\Feature\ApiTestCase;

/**
 * The seeded account config/demo.php protects by default.
 */
function apiDemoAccount(): User
{
    return User::where('username', 'admin')->firstOrFail();
}

/**
 * An actor who would be allowed to manage users if demo mode were off, so a
 * refusal here is demo mode's doing and not the permission middleware's.
 */
function apiUserManager(): User
{
    return UserFactory::withPermissions('users.manage')->create();
}

beforeEach(function () {
    config(['demo.enabled' => true]);
});

test('the API refuses a blocked write with a 403 and a message', function () {
    $this->actingAs(apiDemoAccount(), ApiTestCase::API_GUARD)
        ->putJson('api/me/2fa')
        ->assertForbidden()
        ->assertJson(['message' => 'This action is disabled in the demo.']);
});

test('the API will not let the demo account be deleted', function () {
    $admin = apiDemoAccount();

    $this->actingAs(apiUserManager(), ApiTestCase::API_GUARD)
        ->deleteJson('api/users/'.$admin->id)
        ->assertForbidden()
        ->assertJson(['message' => 'The demo account cannot be modified.']);

    $this->assertDatabaseHas('users', ['username' => 'admin']);
});

test('the API will not let the demo account change its own login details', function () {
    $this->actingAs(apiDemoAccount(), ApiTestCase::API_GUARD)
        ->patchJson('api/me/details/auth', ['email' => 'hijacked@example.com'])
        ->assertForbidden();

    $this->assertEquals('admin@example.com', apiDemoAccount()->email);
});

test('an ordinary API consumer is unaffected', function () {
    $user = User::factory()->create();

    $this->actingAs($user, ApiTestCase::API_GUARD)
        ->patchJson('api/me/details', ['first_name' => 'Jane'])
        ->assertSuccessful();

    $this->assertEquals('Jane', $user->fresh()->first_name);
});

test('the API is untouched while demo mode is off', function () {
    config(['demo.enabled' => false]);

    $admin = apiDemoAccount();

    $this->actingAs(apiUserManager(), ApiTestCase::API_GUARD)
        ->deleteJson('api/users/'.$admin->id)
        ->assertSuccessful();

    $this->assertDatabaseMissing('users', ['username' => 'admin']);
});