<?php

use App\Models\User;
use Illuminate\Support\Facades\Hash;

test('a user can log in with correct credentials and fetch /auth/me', function () {
    $user = User::factory()->branchAdmin()->create([
        'email' => 'login-happy@branch.test',
        'password' => Hash::make('correct-password'),
    ]);

    $login = $this->postJson('/api/v1/auth/login', [
        'email' => 'login-happy@branch.test',
        'password' => 'correct-password',
    ]);

    $login->assertOk()->assertJsonPath('data.id', $user->id);

    $me = $this->getJson('/api/v1/auth/me');
    $me->assertOk()->assertJsonPath('data.email', 'login-happy@branch.test');
});

test('login fails with wrong password', function () {
    User::factory()->branchAdmin()->create([
        'email' => 'login-wrongpass@branch.test',
        'password' => Hash::make('correct-password'),
    ]);

    $response = $this->postJson('/api/v1/auth/login', [
        'email' => 'login-wrongpass@branch.test',
        'password' => 'wrong-password',
    ]);

    $response->assertStatus(422);
});

test('inactive user is rejected at login', function () {
    User::factory()->branchAdmin()->create([
        'email' => 'login-inactive@branch.test',
        'password' => Hash::make('correct-password'),
        'is_active' => false,
    ]);

    $response = $this->postJson('/api/v1/auth/login', [
        'email' => 'login-inactive@branch.test',
        'password' => 'correct-password',
    ]);

    $response->assertStatus(422);
    $this->assertGuest('web');
});

test('an authenticated user can log out', function () {
    User::factory()->branchAdmin()->create([
        'email' => 'login-logout@branch.test',
        'password' => Hash::make('correct-password'),
    ]);

    $this->postJson('/api/v1/auth/login', [
        'email' => 'login-logout@branch.test',
        'password' => 'correct-password',
    ])->assertOk();

    $this->getJson('/api/v1/auth/me')->assertOk();

    $this->postJson('/api/v1/auth/logout')->assertOk();

    // Explicit guard name: auth:sanctum's Authenticate middleware calls
    // Auth::shouldUse('sanctum') on success, which changes the *default*
    // guard for the rest of this test process, and Sanctum's RequestGuard
    // caches its resolved user for the guard instance's lifetime — so the
    // default-guard check (what assertGuest() uses) would see a stale
    // cached user even though 'web' (what this app actually authenticates
    // against) was correctly logged out.
    $this->assertGuest('web');
});

test('unauthenticated request to /auth/me is rejected', function () {
    $this->getJson('/api/v1/auth/me')->assertStatus(401);
});

test('login rate limit fires after 5 attempts', function () {
    User::factory()->branchAdmin()->create([
        'email' => 'login-throttle@branch.test',
        'password' => Hash::make('correct-password'),
    ]);

    for ($i = 0; $i < 5; $i++) {
        $this->postJson('/api/v1/auth/login', [
            'email' => 'login-throttle@branch.test',
            'password' => 'wrong-password',
        ])->assertStatus(422);
    }

    $this->postJson('/api/v1/auth/login', [
        'email' => 'login-throttle@branch.test',
        'password' => 'wrong-password',
    ])->assertStatus(429);
});
