<?php

namespace Tests\Feature\Auth;

use App\Auth\CreateSessionDto;
use App\Auth\SessionRepository;
use App\Http\Middleware\AuthMiddleware;
use App\Shared\ValueObject\EmailAddress;
use App\User\CreateUserDto;
use App\User\UserRepository;
use DateTimeImmutable;
use DateTimeZone;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class LogoutEndpointTest extends TestCase
{
    use RefreshDatabase;

    public function test_logout_deletes_session_and_clears_cookie(): void
    {
        $now = new DateTimeImmutable(
            '2026-07-31T12:00:00',
            new DateTimeZone('UTC'),
        );
        $user = app(UserRepository::class)->create(new CreateUserDto(
            email: new EmailAddress('user@example.com'),
            passwordHash: 'hashed-password',
        ));
        app(SessionRepository::class)->create(new CreateSessionDto(
            token: 'session-token',
            user: $user,
            createdAt: $now,
            expiresAt: $now->modify('+7 days'),
        ));

        $response = $this->withCredentials()
            ->withUnencryptedCookie(
                AuthMiddleware::COOKIE_NAME,
                'session-token',
            )->postJson('/api/logout');

        $response->assertNoContent();
        $response->assertCookieExpired(AuthMiddleware::COOKIE_NAME);
        $this->assertNull(
            app(SessionRepository::class)->findByToken('session-token'),
        );
    }

    public function test_logout_rejects_a_request_without_a_cookie(): void
    {
        $response = $this->postJson('/api/logout');

        $response
            ->assertStatus(401)
            ->assertExactJson(['error' => 'unauthenticated']);
    }
}