<?php

namespace Tests\Feature\Admin;

use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Hash;
use Inertia\Testing\AssertableInertia as Assert;
use Tests\TestCase;

class UserManagementControllerTest extends TestCase
{
    use RefreshDatabase;

    /**
     * Ensure admins can view the user management page.
     */
    public function test_admin_can_view_the_user_management_page(): void
    {
        $admin = User::factory()->admin()->create();
        $member = User::factory()->create([
            'name' => 'Regular User',
            'email' => 'member@example.com',
        ]);

        $this->actingAs($admin)
            ->get(route('admin.users.index'))
            ->assertOk()
            ->assertInertia(fn (Assert $page) => $page
                ->component('admin/users/Index')
                ->has('users', 2)
                ->where("directPermissions.{$admin->id}.0", 'global:admin')
                ->where('permissionOptions.0.value', 'global:admin')
                ->where('permissionOptions.1.value', 'project:create'),
            );
    }

    /**
     * Ensure non-admin users cannot view the user management page.
     */
    public function test_non_admin_cannot_view_the_user_management_page(): void
    {
        $member = User::factory()->create();

        $this->actingAs($member)
            ->get(route('admin.users.index'))
            ->assertForbidden();
    }

    /**
     * Ensure admins can view the create user page.
     */
    public function test_admin_can_view_the_create_user_page(): void
    {
        $admin = User::factory()->admin()->create();

        $this->actingAs($admin)
            ->get(route('admin.users.create'))
            ->assertOk()
            ->assertInertia(fn (Assert $page) => $page
                ->component('admin/users/Create'),
            );
    }

    /**
     * Ensure admins can view the edit user page.
     */
    public function test_admin_can_view_the_edit_user_page(): void
    {
        $admin = User::factory()->admin()->create();
        $member = User::factory()->create();

        $this->actingAs($admin)
            ->get(route('admin.users.edit', $member))
            ->assertOk()
            ->assertInertia(fn (Assert $page) => $page
                ->component('admin/users/Edit')
                ->where('user.id', $member->id)
                ->where('user.email', $member->email),
            );
    }

    /**
     * Ensure admins can create managed users.
     */
    public function test_admin_can_create_a_user_that_must_change_password_on_next_login(): void
    {
        $admin = User::factory()->admin()->create();

        $this->actingAs($admin)
            ->post(route('admin.users.store'), [
                'name' => 'New Member',
                'email' => 'new-member@example.com',
                'password' => 'temporary-password',
                'password_confirmation' => 'temporary-password',
                'must_change_password_on_next_login' => true,
            ])
            ->assertRedirect(route('admin.users.index'))
            ->assertSessionHas('status', 'User was created.');

        $this->assertDatabaseHas('users', [
            'name' => 'New Member',
            'email' => 'new-member@example.com',
            'must_change_password_on_next_login' => true,
        ]);
    }

    /**
     * Ensure admins can update another user's global permissions.
     */
    public function test_admin_can_update_a_users_global_permissions(): void
    {
        $admin = User::factory()->admin()->create();
        $member = User::factory()->create([
            'name' => 'Regular User',
        ]);

        $this->actingAs($admin)
            ->patch(route('admin.users.update', $member), [
                'permissions' => ['global:admin', 'project:create'],
            ])
            ->assertRedirect(route('admin.users.index'))
            ->assertSessionHas('status', 'Regular User global permissions were updated.');

        $this->assertDatabaseHas('permission_assignments', [
            'assignee_id' => $member->id,
            'assignee_type' => $member->getMorphClass(),
            'permission' => 'global:admin',
            'scope_id' => null,
            'scope_type' => null,
        ]);

        $this->assertDatabaseHas('permission_assignments', [
            'assignee_id' => $member->id,
            'assignee_type' => $member->getMorphClass(),
            'permission' => 'project:create',
            'scope_id' => null,
            'scope_type' => null,
        ]);
    }

    /**
     * Ensure admins can update managed users, including password and forced password changes.
     */
    public function test_admin_can_update_a_managed_user(): void
    {
        $admin = User::factory()->admin()->create();
        $member = User::factory()->create([
            'name' => 'Regular User',
            'email' => 'member@example.com',
            'must_change_password_on_next_login' => false,
        ]);

        $this->actingAs($admin)
            ->patch(route('admin.users.save', $member), [
                'name' => 'Updated User',
                'email' => 'updated-user@example.com',
                'password' => 'fresh-password',
                'password_confirmation' => 'fresh-password',
                'must_change_password_on_next_login' => true,
            ])
            ->assertRedirect(route('admin.users.index'))
            ->assertSessionHas('status', 'Updated User was updated.');

        $member->refresh();

        $this->assertSame('Updated User', $member->name);
        $this->assertSame('updated-user@example.com', $member->email);
        $this->assertTrue($member->must_change_password_on_next_login);
        $this->assertTrue(Hash::check('fresh-password', $member->password));
    }

    /**
     * Ensure admins can also clear a user's global permissions.
     */
    public function test_admin_can_clear_a_users_global_permissions(): void
    {
        $admin = User::factory()->admin()->create();
        $member = User::factory()->create();
        $this->syncGlobalPermissions($member, ['global:admin', 'project:create']);

        $this->actingAs($admin)
            ->patch(route('admin.users.update', $member), [
                'permissions' => [],
            ])
            ->assertRedirect(route('admin.users.index'))
            ->assertSessionHas('status', "{$member->name} global permissions were updated.");

        $this->assertDatabaseMissing('permission_assignments', [
            'assignee_id' => $member->id,
            'assignee_type' => $member->getMorphClass(),
            'scope_id' => null,
            'scope_type' => null,
        ]);
    }

    /**
     * Ensure non-admin users cannot update global permissions.
     */
    public function test_non_admin_cannot_update_a_users_global_permissions(): void
    {
        $member = User::factory()->create();
        $otherUser = User::factory()->create();

        $this->actingAs($member)
            ->patch(route('admin.users.update', $otherUser), [
                'permissions' => ['global:admin'],
            ])
            ->assertForbidden();

        $this->assertDatabaseMissing('permission_assignments', [
            'assignee_id' => $otherUser->id,
            'assignee_type' => $otherUser->getMorphClass(),
            'permission' => 'global:admin',
            'scope_id' => null,
            'scope_type' => null,
        ]);
    }

    /**
     * Ensure non-admin users cannot create managed users.
     */
    public function test_non_admin_cannot_create_a_user(): void
    {
        $member = User::factory()->create();

        $this->actingAs($member)
            ->post(route('admin.users.store'), [
                'name' => 'Blocked User',
                'email' => 'blocked-user@example.com',
                'password' => 'temporary-password',
                'password_confirmation' => 'temporary-password',
                'must_change_password_on_next_login' => true,
            ])
            ->assertForbidden();

        $this->assertDatabaseMissing('users', [
            'email' => 'blocked-user@example.com',
        ]);
    }

    /**
     * Ensure non-admin users cannot edit managed users.
     */
    public function test_non_admin_cannot_edit_a_user(): void
    {
        $member = User::factory()->create();
        $otherUser = User::factory()->create();

        $this->actingAs($member)
            ->patch(route('admin.users.save', $otherUser), [
                'name' => 'Blocked User',
                'email' => 'blocked-user@example.com',
                'password' => 'fresh-password',
                'password_confirmation' => 'fresh-password',
                'must_change_password_on_next_login' => true,
            ])
            ->assertForbidden();

        $this->assertDatabaseMissing('users', [
            'email' => 'blocked-user@example.com',
        ]);
    }
}