<?php

declare(strict_types=1);

namespace Tests\Feature\Api\Client;

use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Http\UploadedFile;
use Tests\TestCase;

class SecurityHardeningTest extends TestCase
{
    use RefreshDatabase;

    public function test_register_rejects_short_password(): void
    {
        $response = $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])->postJson('/v1/client/register', [
            'fullname' => 'Nguyen Van A',
            'phone'    => '0912345678',
            'email'    => 'short-pass@example.com',
            'password' => 'abc12345',
            'password_confirmation' => 'abc12345',
        ]);

        $response->assertStatus(422);
        $response->assertJsonValidationErrors('password');
    }

    public function test_register_accepts_password_with_at_least_ten_characters(): void
    {
        $response = $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])->postJson('/v1/client/register', [
            'fullname' => 'Nguyen Van B',
            'phone'    => '0912345679',
            'email'    => 'long-pass@example.com',
            'password' => 'abcdefghij',
            'password_confirmation' => 'abcdefghij',
        ]);

        $response->assertJsonMissingValidationErrors('password');
    }

    public function test_cccd_upload_rejects_svg(): void
    {
        $customer = \App\Models\Customer::factory()->create();

        $response = $this->actingAs($customer, 'client')
            ->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
            ->post('/v1/client/update-cccd', [
                'cmnd' => '012345678901',
                'cmnd_before' => UploadedFile::fake()->create('front.svg', 10, 'image/svg+xml'),
                'cmnd_after' => UploadedFile::fake()->image('back.jpg'),
            ]);

        $response->assertStatus(422);
        $response->assertJsonValidationErrors('cmnd_before');
    }
}