<?php

use App\Models\LegacyInvoice;
use App\Models\User;
use Database\Seeders\RolesAndPermissionsSeeder;
use Tests\TestCase;

/**
 * Sicherheitsaudit 07.10.2026, S-01: Fremde Alt-Rechnungen nur mit
 * `billing:manage` — der Panel-Zugang der Rolle `editor` reicht nicht, auf
 * keiner der beiden Downloadrouten.
 */
beforeEach(function () {
    $this->seed(RolesAndPermissionsSeeder::class);
});

function legacyInvoiceFor(?User $owner, int $legacyId): LegacyInvoice
{
    return LegacyInvoice::query()->create([
        'legacy_portal' => 'presseecho',
        'legacy_id' => $legacyId,
        'user_id' => $owner?->id,
        'legacy_user_id' => 900 + $legacyId,
        'number' => 'PE-'.$legacyId,
        'amount_cents' => 9900,
        'total_cents' => 9900,
        'status' => 'paid',
        'invoice_date' => now()->subMonth(),
        'paid_at' => now()->subMonth()->addDays(2),
        'payment_method' => 'SPK_Berlin',
        'raw_snapshot' => [
            'number' => 'PE-'.$legacyId,
            'service_period_begin_date' => now()->subYear()->toDateString(),
            'service_period_end_date' => now()->toDateString(),
        ],
        'pdf_payload' => [
            'billing_address' => [
                'name' => 'Kunde GmbH',
                'address' => 'Kundenstrasse 1',
                'postal_code' => '10115',
                'city' => 'Berlin',
                'country_name' => 'Deutschland',
            ],
        ],
        'imported_at' => now(),
    ]);
}

function userWithRole(string $role): User
{
    $user = User::factory()->create(['is_active' => true]);
    $user->assignRole($role);

    return $user;
}

test('an editor cannot download a foreign legacy invoice on either route', function () {
    /** @var TestCase $this */
    $invoice = legacyInvoiceFor(userWithRole('customer'), 7001);

    $this->actingAs(userWithRole('editor'));

    $this->get(route('me.invoices.pdf', $invoice))->assertForbidden();
    $this->get(route('admin.legacy-invoices.pdf', $invoice))->assertForbidden();

    expect($invoice->fresh()->pdf_generated_at)->toBeNull();
});

test('a customer downloads only their own legacy invoice', function () {
    /** @var TestCase $this */
    $customer = userWithRole('customer');
    $own = legacyInvoiceFor($customer, 7002);
    $foreign = legacyInvoiceFor(userWithRole('customer'), 7003);

    $this->actingAs($customer);

    $this->get(route('me.invoices.pdf', $own))->assertSuccessful();
    $this->get(route('me.invoices.pdf', $foreign))->assertForbidden();
});

test('a billing admin downloads foreign legacy invoices on both routes', function () {
    /** @var TestCase $this */
    $invoice = legacyInvoiceFor(userWithRole('customer'), 7004);

    $this->actingAs(userWithRole('admin'));

    $this->get(route('me.invoices.pdf', $invoice))->assertSuccessful();
    $this->get(route('admin.legacy-invoices.pdf', $invoice))->assertSuccessful();
});