<?php

use App\Enums\ActivityType;
use App\Models\ActivityEvent;
use App\Models\User;
use Livewire\Volt\Volt;
use PragmaRX\Google2FA\Google2FA;

/**
 * Gescheiterte Anmeldungen im Aktivitäts-Verlauf (Monitoring-Plan 1.7, M9):
 * mit Grund und User-Bezug, ohne Passwort und ohne Klartext-IP.
 */
function failedLoginEvents(ActivityType $type)
{
    return ActivityEvent::query()->where('type', $type->value)->orderBy('id')->get();
}

test('a wrong password is recorded with the account and the reason', function () {
    $user = User::factory()->create(['email' => 'kunde@example.com']);

    Volt::test('auth.login')
        ->set('email', 'kunde@example.com')
        ->set('password', 'falsches-passwort')
        ->call('login')
        ->assertHasErrors('email');

    $event = failedLoginEvents(ActivityType::LoginFailed)->sole();

    expect($event->user_id)->toBe($user->id)
        ->and($event->meta['reason'])->toBe('wrong_password')
        ->and($event->meta['ip_hash'])->toHaveLength(12)
        ->and($event->description)->toContain('falsches Passwort')
        ->and(json_encode($event->toArray()))->not->toContain('falsches-passwort')
        ->and(json_encode($event->toArray()))->not->toContain('127.0.0.1');
});

test('an account without password is told apart from an unknown address', function () {
    User::factory()->create(['email' => 'legacy@example.com', 'password' => null]);

    foreach (['legacy@example.com', 'niemand@example.com'] as $email) {
        Volt::test('auth.login')->set('email', $email)->set('password', 'irgendwas')->call('login');
    }

    $events = failedLoginEvents(ActivityType::LoginFailed);

    expect($events->pluck('meta.reason')->all())->toBe(['no_password', 'unknown_account'])
        ->and($events[1]->user_id)->toBeNull()
        ->and($events[1]->description)->not->toContain('niemand@example.com');
});

test('a lockout is recorded for the targeted account', function () {
    $user = User::factory()->create(['email' => 'kunde@example.com']);

    foreach (range(1, 6) as $attempt) {
        Volt::test('auth.login')->set('email', 'kunde@example.com')->set('password', 'falsch')->call('login');
    }

    $lockout = failedLoginEvents(ActivityType::LoginLockout)->sole();

    expect($lockout->user_id)->toBe($user->id)
        ->and($lockout->description)->toContain('gesperrt')
        ->and(failedLoginEvents(ActivityType::LoginFailed))->toHaveCount(5);
});

test('a wrong two-factor code is recorded', function () {
    $user = User::factory()->create(['is_active' => true]);
    $user->forceFill([
        'two_factor_secret' => encrypt(app(Google2FA::class)->generateSecretKey()),
        'two_factor_confirmed_at' => now(),
    ])->save();

    $this->withSession(['login.id' => $user->id, 'login.remember' => false])
        ->post('/two-factor-challenge', ['code' => '000000']);

    expect(failedLoginEvents(ActivityType::TwoFactorFailed)->sole()->user_id)->toBe($user->id);
});