<?php

declare(strict_types=1);

namespace Tests\Feature\Api\Admin\Customer;

use App\Mail\Customer\PasswordResetByAdmin;
use App\Models\Customer;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Mail;
use Spatie\Permission\Models\Role;
use Tests\TestCase;

class ResetPasswordTest extends TestCase
{
    use RefreshDatabase;

    private User $admin;
    private Customer $customer;

    protected function setUp(): void
    {
        parent::setUp();

        // Email render từ template DB; template password_reset_admin chỉ có trong seeder.
        $this->seed(\Database\Seeders\TemplateSeeder::class);

        Role::firstOrCreate(['name' => 'Full Administrator', 'guard_name' => 'admin']);
        $this->admin = User::factory()->create();
        $this->admin->assignRole('Full Administrator');

        $this->customer = Customer::factory()->create([
            'password' => Hash::make('old-password'),
        ]);
    }

    public function test_reset_password_sends_email_and_does_not_leak_password_in_response(): void
    {
        Mail::fake();
        $oldHash = $this->customer->password;

        $response = $this->actingAs($this->admin, 'admin')
            ->postJson("/api/v1/administrator/customers/{$this->customer->uuid}/reset-password");

        $response->assertOk();
        $response->assertJsonMissingPath('data.new_password');
        $response->assertJsonMissing(['new_password']);

        Mail::assertSent(PasswordResetByAdmin::class, function (PasswordResetByAdmin $mail) {
            return $mail->hasTo($this->customer->email);
        });

        $this->assertNotSame($oldHash, $this->customer->fresh()->password);
    }
}