<?php

use App\Models\User;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Auth\Events\Verified;
use Illuminate\Support\Facades\Event;
use Illuminate\Support\Facades\URL;
use Tests\TestCase;

test('the verification notice can be rendered for an unverified user', function () {
    /** @var TestCase $this */
    $user = User::factory()->unverified()->create(['is_active' => false]);

    $this->actingAs($user)
        ->get('/verify-email')
        ->assertStatus(200)
        // Abmelden läuft über ein echtes POST-Formular auf die Logout-Route,
        // nicht über eine Livewire-Action (verhindert den 419 beim Session-Invalidate).
        ->assertSee('action="'.route('logout').'"', false)
        ->assertSee('method="POST"', false);
});

test('an unverified user is redirected away from the panel to the notice', function () {
    /** @var TestCase $this */
    $user = User::factory()->unverified()->create(['is_active' => false]);

    $this->actingAs($user)
        ->get(route('me.dashboard'))
        ->assertRedirect(route('verification.notice'));
});

test('confirming the signed link verifies, activates and grants the customer role', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $user = User::factory()->unverified()->create(['is_active' => false]);

    $verificationUrl = URL::temporarySignedRoute(
        'verification.verify',
        now()->addMinutes(60),
        ['id' => $user->id, 'hash' => sha1($user->email)]
    );

    $this->actingAs($user)
        ->get($verificationUrl)
        ->assertRedirect(route('me.dashboard', absolute: false).'?verified=1');

    $user->refresh();

    expect($user->hasVerifiedEmail())->toBeTrue();
    expect($user->is_active)->toBeTrue();
    expect($user->hasRole('customer'))->toBeTrue();
});

test('verification dispatches the Verified event', function () {
    /** @var TestCase $this */
    Event::fake();

    $user = User::factory()->unverified()->create(['is_active' => false]);

    $verificationUrl = URL::temporarySignedRoute(
        'verification.verify',
        now()->addMinutes(60),
        ['id' => $user->id, 'hash' => sha1($user->email)]
    );

    $this->actingAs($user)->get($verificationUrl);

    Event::assertDispatched(Verified::class);
});

test('the email is not verified with an invalid hash', function () {
    /** @var TestCase $this */
    $user = User::factory()->unverified()->create(['is_active' => false]);

    $verificationUrl = URL::temporarySignedRoute(
        'verification.verify',
        now()->addMinutes(60),
        ['id' => $user->id, 'hash' => sha1('wrong-email')]
    );

    $this->actingAs($user)->get($verificationUrl)->assertForbidden();

    expect($user->fresh()->hasVerifiedEmail())->toBeFalse();
});