<?php

use App\Models\User;
use Database\Seeders\RolesAndPermissionsSeeder;
use Livewire\Volt\Volt as LivewireVolt;
use Tests\TestCase;

/**
 * Regression zu Befund K1/M8 (Audit 14.07.2026):
 * Die Rolle `editor` hat Admin-Panel-Zugriff (`access-admin`), aber bewusst
 * NICHT `users:manage`/`roles:manage`. Die Benutzer-/Rollenverwaltung darf
 * daher für sie gesperrt sein, und `is_super_admin` darf nur ein Super-Admin
 * vergeben.
 */
beforeEach(function () {
    $this->seed(RolesAndPermissionsSeeder::class);
});

test('editor cannot open user or role management pages', function () {
    /** @var TestCase $this */
    $editor = User::factory()->create();
    $editor->assignRole('editor');

    $target = User::factory()->create();
    $target->assignRole('customer');

    $this->actingAs($editor);

    foreach ([
        'https://pressekonto.test/admin/users',
        'https://pressekonto.test/admin/users/create',
        "https://pressekonto.test/admin/users/{$target->id}",
        "https://pressekonto.test/admin/users/{$target->id}/edit",
        'https://pressekonto.test/admin/roles',
        'https://pressekonto.test/admin/roles/create',
    ] as $url) {
        $this->get($url)->assertForbidden();
    }
});

test('admin can open user and role management pages', function () {
    /** @var TestCase $this */
    $admin = User::factory()->create();
    $admin->assignRole('admin');

    $this->actingAs($admin);

    $this->get('https://pressekonto.test/admin/users')->assertSuccessful();
    $this->get('https://pressekonto.test/admin/roles')->assertSuccessful();
});

test('editor cannot mutate roles via the roles component', function () {
    /** @var TestCase $this */
    $editor = User::factory()->create();
    $editor->assignRole('editor');

    $this->actingAs($editor);

    LivewireVolt::test('admin.roles.create')->assertForbidden();
});

test('non super admin cannot elevate a user to super admin', function () {
    /** @var TestCase $this */
    $admin = User::factory()->create();
    $admin->assignRole('admin'); // hat users:manage, ist aber kein Super-Admin

    $target = User::factory()->create(['email' => 'target@example.com']);
    $target->assignRole('customer');

    $this->actingAs($admin);

    LivewireVolt::test('admin.users.edit', ['id' => $target->id])
        ->set('name', 'Ziel Benutzer')
        ->set('email', 'target@example.com')
        ->set('selectedRoles', ['customer'])
        ->set('isSuperAdmin', true)
        ->call('save')
        ->assertHasNoErrors();

    expect($target->fresh()->is_super_admin)->toBeFalse();
});

test('super admin can elevate a user to super admin', function () {
    /** @var TestCase $this */
    $superAdmin = User::factory()->superAdmin()->create();

    $target = User::factory()->create(['email' => 'target@example.com']);
    $target->assignRole('customer');

    $this->actingAs($superAdmin);

    LivewireVolt::test('admin.users.edit', ['id' => $target->id])
        ->set('name', 'Ziel Benutzer')
        ->set('email', 'target@example.com')
        ->set('selectedRoles', ['customer'])
        ->set('isSuperAdmin', true)
        ->call('save')
        ->assertHasNoErrors();

    expect($target->fresh()->is_super_admin)->toBeTrue();
});

test('non super admin cannot open the edit page of a super admin', function () {
    /** @var TestCase $this */
    $admin = User::factory()->create();
    $admin->assignRole('admin'); // users:manage, aber kein Super-Admin

    $superAdmin = User::factory()->superAdmin()->create();

    $this->actingAs($admin);

    $this->get("https://pressekonto.test/admin/users/{$superAdmin->id}/edit")->assertForbidden();
});

test('super admin can still edit another super admin', function () {
    /** @var TestCase $this */
    $superAdmin = User::factory()->superAdmin()->create();
    $target = User::factory()->superAdmin()->create(['email' => 'peer@example.com']);

    $this->actingAs($superAdmin);

    $this->get("https://pressekonto.test/admin/users/{$target->id}/edit")->assertSuccessful();
});

test('is_super_admin is not mass assignable', function () {
    /** @var TestCase $this */
    $user = User::query()->create([
        'name' => 'Massenzuweisung',
        'email' => 'mass@example.com',
        'is_super_admin' => true,
    ]);

    expect($user->fresh()->is_super_admin)->toBeFalse();
});