<?php

use App\Models\Company;
use App\Models\PressRelease;
use App\Models\User;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Support\Facades\Gate;
use Tests\TestCase;

test('active admin and editor users can access admin area', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $admin = User::factory()->create(['is_active' => true]);
    $admin->assignRole('admin');

    $editor = User::factory()->create(['is_active' => true]);
    $editor->assignRole('editor');

    expect($admin->canAccessAdmin())->toBeTrue();
    expect($editor->canAccessAdmin())->toBeTrue();
});

test('inactive users cannot access admin area', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $admin = User::factory()->create(['is_active' => false]);
    $admin->assignRole('admin');

    expect($admin->canAccessAdmin())->toBeFalse();
});

test('super admin can access admin area without role', function () {
    $user = User::factory()->create([
        'is_active' => true,
        'is_super_admin' => true,
    ]);

    expect($user->canAccessAdmin())->toBeTrue();
});

test('active customer and staff users can access customer area', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $customer = User::factory()->create(['is_active' => true]);
    $customer->assignRole('customer');

    $admin = User::factory()->create(['is_active' => true]);
    $admin->assignRole('admin');

    expect($customer->canAccessCustomer())->toBeTrue();
    expect($admin->canAccessCustomer())->toBeTrue();
});

test('api-only and inactive users cannot access customer area', function () {
    /** @var TestCase $this */
    $this->seed(RolesAndPermissionsSeeder::class);

    $apiOnly = User::factory()->create(['is_active' => true]);
    $apiOnly->assignRole('api-only');

    $inactiveCustomer = User::factory()->create(['is_active' => false]);
    $inactiveCustomer->assignRole('customer');

    expect($apiOnly->canAccessCustomer())->toBeFalse();
    expect($inactiveCustomer->canAccessCustomer())->toBeFalse();
});

test('a deactivated super admin is locked out of both panels despite the gate shortcut (Audit F09)', function () {
    /** @var TestCase $this */
    $user = User::factory()->create([
        'is_active' => false,
        'is_super_admin' => true,
    ]);

    expect($user->canAccessAdmin())->toBeFalse();
    expect(Gate::forUser($user)->allows('access-admin'))->toBeFalse();
    expect(Gate::forUser($user)->allows('access-customer'))->toBeFalse();

    $this->actingAs($user)->get(route('dashboard'))->assertForbidden();
    $this->actingAs($user)->get(route('me.dashboard'))->assertForbidden();
});

test('a deactivated super admin is not whitelisted by the policy shortcuts either (Audit 7.2)', function () {
    $user = User::factory()->create([
        'is_active' => false,
        'is_super_admin' => true,
    ]);
    $pressRelease = PressRelease::factory()->create();
    $company = Company::factory()->create();

    expect(Gate::forUser($user)->allows('update', $pressRelease))->toBeFalse()
        ->and(Gate::forUser($user)->allows('view', $pressRelease))->toBeFalse()
        ->and(Gate::forUser($user)->allows('update', $company))->toBeFalse()
        ->and(Gate::forUser($user)->allows('view', $company))->toBeFalse();

    $user->forceFill(['is_active' => true])->save();

    expect(Gate::forUser($user->fresh())->allows('update', $pressRelease))->toBeTrue();
});