<?php

declare(strict_types=1);

namespace Tests\Feature\Api\Admin\Employee;

use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;
use Tests\TestCase;

class EmployeeRoleGuardTest extends TestCase
{
    use RefreshDatabase;

    protected function setUp(): void
    {
        parent::setUp();

        Permission::firstOrCreate(['name' => 'administrator.edit', 'guard_name' => 'admin']);
        Permission::firstOrCreate(['name' => 'administrator.destroy', 'guard_name' => 'admin']);

        Role::firstOrCreate(['name' => 'Full Administrator', 'guard_name' => 'admin']);
        $administrator = Role::firstOrCreate(['name' => 'Administrator', 'guard_name' => 'admin']);
        $sale = Role::firstOrCreate(['name' => 'Sale', 'guard_name' => 'admin']);

        $administrator->givePermissionTo(['administrator.edit', 'administrator.destroy']);
        $sale->givePermissionTo(['administrator.edit', 'administrator.destroy']);
    }

    private function makeEmployee(string $role): User
    {
        $user = User::factory()->create([
            'username' => 'user-' . uniqid(),
            'email'    => uniqid() . '@example.com',
        ]);
        $user->assignRole($role);

        return $user;
    }

    private function payload(array $overrides = []): array
    {
        return array_merge([
            'fullname' => 'Test User',
            'username' => 'test-' . uniqid(),
            'email'    => uniqid() . '@example.com',
            'role'     => 'Sale',
        ], $overrides);
    }

    public function test_non_full_administrator_cannot_edit_a_full_administrator(): void
    {
        $fullAdmin = $this->makeEmployee('Full Administrator');
        $caller    = $this->makeEmployee('Administrator');

        $response = $this->actingAs($caller, 'admin')->putJson(
            "/api/v1/administrator/employees/{$fullAdmin->id}",
            $this->payload(['role' => 'Sale']),
        );

        $response->assertStatus(403);
    }

    public function test_non_full_administrator_cannot_delete_a_full_administrator(): void
    {
        $fullAdmin = $this->makeEmployee('Full Administrator');
        $caller    = $this->makeEmployee('Administrator');

        $response = $this->actingAs($caller, 'admin')->deleteJson(
            "/api/v1/administrator/employees/{$fullAdmin->id}",
        );

        $response->assertStatus(403);
    }

    public function test_cannot_change_own_role(): void
    {
        $caller = $this->makeEmployee('Sale');

        $response = $this->actingAs($caller, 'admin')->putJson(
            "/api/v1/administrator/employees/{$caller->id}",
            $this->payload(['username' => $caller->username, 'email' => $caller->email, 'role' => 'Administrator']),
        );

        $response->assertStatus(403);
    }

    public function test_non_full_administrator_cannot_assign_administrator_role(): void
    {
        $caller = $this->makeEmployee('Administrator');
        $target = $this->makeEmployee('Sale');

        $response = $this->actingAs($caller, 'admin')->putJson(
            "/api/v1/administrator/employees/{$target->id}",
            $this->payload(['username' => $target->username, 'email' => $target->email, 'role' => 'Administrator']),
        );

        $response->assertStatus(403);
    }

    public function test_full_administrator_can_assign_administrator_role(): void
    {
        $caller = $this->makeEmployee('Full Administrator');
        $target = $this->makeEmployee('Sale');

        $response = $this->actingAs($caller, 'admin')->putJson(
            "/api/v1/administrator/employees/{$target->id}",
            $this->payload(['username' => $target->username, 'email' => $target->email, 'role' => 'Administrator']),
        );

        $response->assertOk();
        $this->assertTrue($target->fresh()->hasRole('Administrator'));
    }
}