<?php

declare(strict_types=1);

namespace Tests\Feature\Api\Client;

use App\Models\Setting;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class PublicSettingTest extends TestCase
{
    use RefreshDatabase;

    public function test_public_setting_endpoints_expose_only_whitelisted_fields(): void
    {
        Setting::updateOrCreate(['key' => 'setting'], ['value' => json_encode([
            'title'             => 'Portal',
            'brand_color'       => '#EF6824',
            'bot_token'         => 'secret-bot-token',
            'inet_api_key'      => 'secret-inet-key',
            'telegram_group_id' => '-100123',
            'admin_email'       => 'admin@example.com',
        ])]);

        $client = $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
            ->getJson('/v1/setting')
            ->assertOk()
            ->assertJsonPath('data.title', 'Portal')
            ->assertJsonPath('data.brand_color', '#EF6824');

        $admin = $this->getJson('/api/v1/settings/public')->assertOk();

        foreach ([$client, $admin] as $response) {
            $body = $response->getContent();
            $this->assertStringNotContainsString('secret-bot-token', $body);
            $this->assertStringNotContainsString('secret-inet-key', $body);
            $this->assertStringNotContainsString('-100123', $body);
            $this->assertStringNotContainsString('admin@example.com', $body);
        }
    }
}