<?php

use App\Models\User;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Support\Facades\DB;
use Tests\TestCase;

/**
 * Berechtigungsnachweis BN-02: `audit:admins` listet jedes Konto mit Rechten
 * über den Kundenbereich hinaus als Markdown, standardmäßig ohne vollständige
 * E-Mail-Adresse, und ändert dabei nichts.
 */
beforeEach(function () {
    $this->seed(RolesAndPermissionsSeeder::class);
});

test('the audit lists admins, editors, super admins and locked or deleted privileged accounts', function () {
    /** @var TestCase $this */
    $admin = User::factory()->create(['email' => 'betrieb@pressekonto.test', 'last_login_at' => now()]);
    $admin->assignRole('admin');
    DB::table('passkeys')->insert([
        'user_id' => $admin->id,
        'name' => 'Laptop',
        'credential_id' => 'cred-1',
        'credential' => '{}',
        'created_at' => now(),
        'updated_at' => now(),
    ]);

    $editor = User::factory()->create(['email' => 'redaktion@example.test']);
    $editor->assignRole('editor');

    $superAdmin = User::factory()->superAdmin()->create(['email' => 'alt@me.test']);
    $superAdmin->assignRole('customer');
    $superAdmin->createToken('Legacy-API-Key (importiert)');

    $locked = User::factory()->create(['email' => 'gesperrt@example.test', 'is_active' => false]);
    $locked->assignRole('admin');

    $deleted = User::factory()->create(['email' => 'geloescht@example.test']);
    $deleted->assignRole('admin');
    $deleted->delete();

    $customer = User::factory()->create(['email' => 'kunde@example.test']);
    $customer->assignRole('customer');

    $this->artisan('audit:admins')
        ->expectsOutputToContain('3 Konten mit Zugang zum Admin-Bereich, davon 1 mit zweitem Faktor (TOTP oder Passkey), 1 Super-Admin, 1 Editor-Konto. Gelistet sind 5 Konten')
        ->expectsOutputToContain('| '.$admin->id.' | …@pressekonto.test | admin | nein | ja | nein | ja | nein | 1 |')
        ->expectsOutputToContain('| '.$superAdmin->id.' | …@me.test | customer | ja | ja | nein | ja |')
        ->expectsOutputToContain('| '.$locked->id.' | …@example.test | admin | nein | gesperrt | nein | nein |')
        ->expectsOutputToContain('| '.$deleted->id.' | …@example.test | admin | nein | ja | '.now()->format('d.m.Y').' | nein |')
        ->doesntExpectOutputToContain('| '.$customer->id.' |')
        ->doesntExpectOutputToContain('betrieb@pressekonto.test')
        ->assertSuccessful();

    expect($superAdmin->fresh()->tokens()->count())->toBe(1)
        ->and($deleted->fresh()->trashed())->toBeTrue();
});

test('the audit prints full email addresses only on request', function () {
    /** @var TestCase $this */
    $admin = User::factory()->create(['email' => 'betrieb@pressekonto.test']);
    $admin->assignRole('admin');

    $this->artisan('audit:admins', ['--with-emails' => true])
        ->expectsOutputToContain('| '.$admin->id.' | betrieb@pressekonto.test | admin |')
        ->assertSuccessful();
});