<?php

namespace Tests\Feature\Auth;

use App\Models\User;
use App\Services\InsForge\InsForgeAuthService;
use Filament\Auth\Pages\Login;
use Illuminate\Support\Facades\Session;
use Livewire\Livewire;
use Tests\Support\InsForgeFake;
use Tests\TestCase;

class AuthenticationTest extends TestCase
{
    private function adminProfile(array $overrides = []): array
    {
        return array_merge([
            'id' => '11111111-1111-1111-1111-111111111111',
            'name' => 'Admin BerasPro',
            'email' => 'admin@beraspro.test',
            'password' => '$2y$04$hash',
            'role' => 'admin',
            'is_active' => true,
        ], $overrides);
    }

    public function test_login_page_renders_for_guest(): void
    {
        $this->get('/admin/login')->assertOk();
    }

    public function test_unauthenticated_user_is_redirected_to_login(): void
    {
        $this->get('/admin')->assertRedirect('/admin/login');
    }

    public function test_user_can_login_with_valid_credentials(): void
    {
        InsForgeFake::fakeLoginSuccess($this->adminProfile());

        Livewire::test(Login::class)
            ->fillForm(['email' => 'admin@beraspro.test', 'password' => 'secret'])
            ->call('authenticate')
            ->assertHasNoErrors();

        $this->assertAuthenticated();

        $this->assertSame(
            InsForgeFake::$accessToken,
            Session::get(InsForgeAuthService::SESSION_ACCESS_TOKEN),
        );

        $user = auth()->user();

        $this->assertInstanceOf(User::class, $user);
        $this->assertTrue($user->isAdmin());
    }

    public function test_mirror_profile_is_created_when_missing(): void
    {
        InsForgeFake::fakeLoginSuccess($this->adminProfile());
        unset(InsForgeFake::$profiles['admin@beraspro.test']);

        Livewire::test(Login::class)
            ->fillForm(['email' => 'admin@beraspro.test', 'password' => 'secret'])
            ->call('authenticate');

        $this->assertArrayHasKey('admin@beraspro.test', InsForgeFake::$profiles);
        $this->assertSame('operator', InsForgeFake::$profiles['admin@beraspro.test']['role']);
    }

    public function test_invalid_credentials_do_not_authenticate(): void
    {
        InsForgeFake::fakeLoginFailure();

        Livewire::test(Login::class)
            ->fillForm(['email' => 'admin@beraspro.test', 'password' => 'wrong'])
            ->call('authenticate')
            ->assertHasErrors();

        $this->assertGuest();
    }

    public function test_inactive_user_cannot_access_panel(): void
    {
        InsForgeFake::fakeLoginSuccess($this->adminProfile(['is_active' => false]));

        Livewire::test(Login::class)
            ->fillForm(['email' => 'admin@beraspro.test', 'password' => 'secret'])
            ->call('authenticate');

        $this->get('/admin')->assertRedirect('/admin/login');
        $this->assertGuest();
    }

    public function test_logout_clears_insforge_tokens(): void
    {
        InsForgeFake::fakeLoginSuccess($this->adminProfile());

        Livewire::test(Login::class)
            ->fillForm(['email' => 'admin@beraspro.test', 'password' => 'secret'])
            ->call('authenticate');

        $this->post('/admin/logout');

        $this->assertGuest();
        $this->assertNull(Session::get(InsForgeAuthService::SESSION_ACCESS_TOKEN));
    }
}