<?php

use App\Http\Controllers\Api\Legacy\LegacyPressReleaseController;
use App\Models\AppSetting;
use App\Models\Company;
use App\Models\Contact;
use App\Models\User;
use Database\Seeders\RolesAndPermissionsSeeder;
use Livewire\Volt\Volt as LivewireVolt;
use Tests\TestCase;

/**
 * Regression zu Befund H2 (Audit 14.07.2026): Die Rolle `editor` behält ihre
 * Content-Rechte (PMs), darf aber keine destruktiven CRM-/Billing-/Compliance-/
 * Struktur-Aktionen ausführen. Gekoppelt an die neuen Seeder-Permissions
 * companies:write / categories:manage / footer-codes:manage / billing:manage /
 * compliance:manage.
 */
beforeEach(function () {
    $this->seed(RolesAndPermissionsSeeder::class);
});

function editorActor(): User
{
    $editor = User::factory()->create();
    $editor->assignRole('editor');

    return $editor;
}

test('editor is blocked from admin-only management pages', function () {
    /** @var TestCase $this */
    $this->actingAs(editorActor());

    foreach ([
        'admin/categories',
        'admin/categories/create',
        'admin/footer-codes',
        'admin/footer-codes/create',
        'admin/payments',
        'admin/coupons',
        'admin/invoices',
        'admin/legal-requests',
        'admin/contact-messages',
    ] as $path) {
        $this->get("https://pressekonto.test/{$path}")->assertForbidden();
    }
});

test('editor keeps access to content and read-only CRM pages', function () {
    /** @var TestCase $this */
    $this->actingAs(editorActor());

    $this->get('https://pressekonto.test/admin/press-releases')->assertSuccessful();
    $this->get('https://pressekonto.test/admin/companies')->assertSuccessful();
    $this->get('https://pressekonto.test/admin/contacts')->assertSuccessful();
});

test('editor cannot open company write forms', function () {
    /** @var TestCase $this */
    $company = Company::factory()->presseecho()->create();
    $this->actingAs(editorActor());

    $this->get('https://pressekonto.test/admin/companies/create')->assertForbidden();
    $this->get("https://pressekonto.test/admin/companies/{$company->id}/edit")->assertForbidden();
});

test('editor cannot delete a contact from the index', function () {
    /** @var TestCase $this */
    $company = Company::factory()->presseecho()->create();
    $contact = Contact::factory()->for($company)->create();

    $this->actingAs(editorActor());

    LivewireVolt::test('admin.contacts.index')
        ->call('deleteContactFromIndex', $contact->id)
        ->assertForbidden();

    expect(Contact::query()->whereKey($contact->id)->exists())->toBeTrue();
});

test('editor cannot invoke admin-only livewire actions directly', function () {
    /** @var TestCase $this */
    $this->actingAs(editorActor());

    LivewireVolt::test('admin.categories.create')
        ->call('save')
        ->assertForbidden();

    LivewireVolt::test('admin.footer-codes.create')
        ->call('save')
        ->assertForbidden();

    LivewireVolt::test('admin.payments.index')
        ->call('cancelBundle', 999_999)
        ->assertForbidden();

    LivewireVolt::test('admin.legal-requests.index')
        ->call('resolveWithdrawal', 999_999)
        ->assertForbidden();

    LivewireVolt::test('admin.press-releases.index')
        ->set('legacyApiAiReview', true)
        ->assertForbidden();

    expect(AppSetting::getBool(LegacyPressReleaseController::SETTING_AI_REVIEW))->toBeFalse();
});

test('admin retains access to all restricted management pages', function () {
    /** @var TestCase $this */
    $admin = User::factory()->create();
    $admin->assignRole('admin');
    $this->actingAs($admin);

    foreach ([
        'admin/categories',
        'admin/footer-codes',
        'admin/invoices',
        'admin/legal-requests',
        'admin/contact-messages',
    ] as $path) {
        $this->get("https://pressekonto.test/{$path}")->assertSuccessful();
    }
});