<?php

declare(strict_types=1);

namespace Tests\Feature\Api\Admin;

use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;
use Tests\TestCase;

class ClientMenuTest extends TestCase
{
    use RefreshDatabase;

    private function admin(): User
    {
        $role = Role::create(['name' => 'role-' . uniqid(), 'guard_name' => 'admin']);
        $role->givePermissionTo(Permission::firstOrCreate(['name' => 'setting.manager', 'guard_name' => 'admin']));
        $admin = User::factory()->create();
        $admin->assignRole($role);

        return $admin;
    }

    public function test_admin_saves_menu_and_client_reads_it(): void
    {
        $items = [
            ['title' => 'Dashboard', 'icon' => 'hugeicons:home-01', 'href' => '/'],
            ['title' => 'Dịch vụ', 'icon' => null, 'href' => null, 'children' => [
                ['title' => 'VPS', 'href' => '/dich-vu/vps', 'disabled' => true],
            ]],
        ];

        $this->actingAs($this->admin(), 'admin')
            ->putJson('/api/v1/administrator/client-menu', ['items' => $items])
            ->assertOk();

        $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
            ->getJson('/v1/setting/menu')
            ->assertOk()
            ->assertJsonPath('data.0.title', 'Dashboard')
            ->assertJsonPath('data.0.children', [])
            ->assertJsonPath('data.1.href', null)
            ->assertJsonPath('data.1.children.0.href', '/dich-vu/vps')
            ->assertJsonPath('data.1.children.0.disabled', true);
    }

    public function test_rejects_unsafe_href_and_leaf_without_href(): void
    {
        $admin = $this->admin();

        $this->actingAs($admin, 'admin')
            ->putJson('/api/v1/administrator/client-menu', ['items' => [
                ['title' => 'X', 'href' => 'javascript:alert(1)'],
                ['title' => 'Y', 'href' => '//evil.example'],
                ['title' => 'Z', 'href' => null],
                ['title' => 'W', 'href' => null, 'children' => [['title' => 'C', 'href' => 'data:text/html,x']]],
            ]])
            ->assertStatus(422)
            ->assertJsonValidationErrors(['items.0.href', 'items.1.href', 'items.2.href', 'items.3.children.0.href']);
    }

    public function test_admin_saves_quick_links_and_client_reads_them(): void
    {
        $admin = $this->admin();

        $this->actingAs($admin, 'admin')
            ->putJson('/api/v1/administrator/client-menu/quick-links', ['items' => [
                ['title' => 'Tạo Cloud VPS', 'icon' => 'lucide:cloud', 'href' => '/san-pham/vps'],
            ]])
            ->assertOk();

        $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
            ->getJson('/v1/setting/quick-links')
            ->assertOk()
            ->assertJsonPath('data.0.title', 'Tạo Cloud VPS')
            ->assertJsonPath('data.0.disabled', false);

        $this->actingAs($admin, 'admin')
            ->putJson('/api/v1/administrator/client-menu/quick-links', ['items' => [
                ['title' => 'X', 'href' => 'javascript:alert(1)'],
                ['title' => 'Y', 'href' => null],
            ]])
            ->assertStatus(422)
            ->assertJsonValidationErrors(['items.0.href', 'items.1.href']);
    }
}