<?php

namespace Tests\Unit\Models;

use App\Models\ReinstallLog;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\DB;
use Tests\TestCase;

class ReinstallLogPlainPasswordTest extends TestCase
{
    use RefreshDatabase;

    public function test_plain_password_is_stored_encrypted_and_reads_back_transparently(): void
    {
        $log = ReinstallLog::create([
            'product_id'     => 1,
            'product_type'   => ReinstallLog::PRODUCT_TYPE_VPS,
            'status'         => ReinstallLog::STATUS_PENDING,
            'plain_password' => 'S3cr3t!pass',
        ]);

        $raw = DB::table('reinstall_logs')->where('id', $log->id)->value('plain_password');

        $this->assertNotSame('S3cr3t!pass', $raw);
        $this->assertSame('S3cr3t!pass', $log->fresh()->plain_password);
    }

    public function test_backfill_migration_is_idempotent(): void
    {
        DB::table('reinstall_logs')->insert([
            'product_id'      => 1,
            'product_type'    => ReinstallLog::PRODUCT_TYPE_VPS,
            'status'          => ReinstallLog::STATUS_PENDING,
            'plain_password'  => 'plaintext-legacy-row',
        ]);

        $migration = require database_path('migrations/2026_09_26_100000_encrypt_reinstall_logs_plain_password.php');
        $migration->up();
        $migration->up();

        $row = DB::table('reinstall_logs')->where('plain_password', '!=', '')->whereNotNull('plain_password')->first();
        $this->assertSame('plaintext-legacy-row', \Illuminate\Support\Facades\Crypt::decryptString($row->plain_password));
    }
}