<?php

namespace Rodev\DelegateAuth\Tests\Feature;

use Illuminate\Foundation\Testing\RefreshDatabase;
use Rodev\DelegateAuth\Tests\Fixtures\User;
use Rodev\DelegateAuth\Tests\TestCase;

class LoginTest extends TestCase
{
    use RefreshDatabase;

    public function test_valid_token_authenticates_user_and_redirects(): void
    {
        $user  = User::create(['email' => 'user@example.com']);
        $token = $this->makeToken(['email' => 'user@example.com']);

        $this->get(route('delegate-auth.login', ['token' => $token]))
             ->assertRedirect('/dashboard');

        $this->assertAuthenticatedAs($user);
    }

    public function test_missing_token_fails_validation(): void
    {
        $this->get(route('delegate-auth.login'))
             ->assertSessionHasErrors('token');
    }

    public function test_malformed_token_returns_401(): void
    {
        $this->get(route('delegate-auth.login', ['token' => 'notavalidtoken']))
             ->assertStatus(401);
    }

    public function test_token_encrypted_with_wrong_key_returns_401(): void
    {
        $wrongKey  = substr(hash('sha256', 'wrong-key', binary: true), 0, 32);
        $iv        = random_bytes(16);
        $encrypted = openssl_encrypt(json_encode(['email' => 'user@example.com']), 'AES-256-CBC', $wrongKey, OPENSSL_RAW_DATA, $iv);
        $token     = base64_encode($iv.$encrypted);

        User::create(['email' => 'user@example.com']);

        $this->get(route('delegate-auth.login', ['token' => $token]))
             ->assertStatus(401);
    }

    public function test_token_for_unknown_user_returns_401(): void
    {
        $token = $this->makeToken(['email' => 'nobody@example.com']);

        $this->get(route('delegate-auth.login', ['token' => $token]))
             ->assertStatus(401);
    }

    public function test_token_missing_user_field_returns_401(): void
    {
        $token = $this->makeToken(['foo' => 'bar']);

        $this->get(route('delegate-auth.login', ['token' => $token]))
             ->assertStatus(401);
    }
}