<?php

namespace Tests\Feature\Auth;

use App\Auth\PasswordHasher;
use App\Auth\SessionRepository;
use App\Email\EmailConfirmationToken\EmailConfirmationTokenRepository;
use App\Email\EmailConfirmationToken\UseCases\CreateEmailConfirmationToken;
use App\Email\EmailConfirmationToken\UseCases\CreateEmailConfirmationTokenRequest;
use App\Http\Middleware\AuthMiddleware;
use App\Shared\ValueObject\EmailAddress;
use App\User\CreateUserDto;
use App\User\UserRepository;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class ConfirmEmailEndpointTest extends TestCase
{
    use RefreshDatabase;

    public function test_confirmation_sets_password_and_starts_session(): void
    {
        $userRepository = app(UserRepository::class);
        $user = $userRepository->create(new CreateUserDto(
            email: new EmailAddress('user@example.com'),
            passwordHash: null,
        ));
        $token = app(CreateEmailConfirmationToken::class)->execute(
            new CreateEmailConfirmationTokenRequest(
                user: $user,
                minuteOffset: 10,
            ),
        );

        $response = $this->postJson('/api/confirm-email', [
            'token' => $token->getToken(),
            'password' => 'password123',
        ]);

        $response->assertOk();
        $response->assertJsonPath('user.email', 'user@example.com');
        $confirmedUser = $userRepository->find($user->getId());
        $this->assertNotNull($confirmedUser);
        $passwordHash = $confirmedUser->getPasswordHash();
        $this->assertNotNull($passwordHash);
        $this->assertTrue(
            app(PasswordHasher::class)->verify('password123', $passwordHash),
        );
        $this->assertNull(
            app(EmailConfirmationTokenRepository::class)
                ->findByToken($token->getToken()),
        );
        $cookie = $response->getCookie(AuthMiddleware::COOKIE_NAME, false);
        $this->assertNotNull($cookie);
        $this->assertNotNull(
            app(SessionRepository::class)->findByToken($cookie->getValue()),
        );
    }

    public function test_confirmation_rejects_an_unknown_token(): void
    {
        $response = $this->postJson('/api/confirm-email', [
            'token' => 'unknown-token',
            'password' => 'password123',
        ]);

        $response->assertConflict();
        $response->assertJson(['error' => 'token not found']);
    }
}