<?php

namespace Tests\Feature\Settings;

use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Hash;
use Inertia\Testing\AssertableInertia as Assert;
use Laravel\Fortify\Contracts\TwoFactorAuthenticationProvider;
use Laravel\Fortify\Features;
use Tests\TestCase;

class SecurityTest extends TestCase
{
    use RefreshDatabase;

    public function test_security_page_is_displayed()
    {
        $this->skipUnlessFortifyFeature(Features::twoFactorAuthentication());

        Features::twoFactorAuthentication([
            'confirm' => true,
            'confirmPassword' => true,
        ]);

        $user = User::factory()->create();

        $this->actingAs($user)
            ->withSession(['auth.password_confirmed_at' => time()])
            ->get(route('security.edit'))
            ->assertInertia(fn (Assert $page) => $page
                ->component('settings/Security')
                ->where('canManageTwoFactor', true)
                ->where('twoFactorEnabled', false),
            );
    }

    public function test_security_page_requires_password_confirmation_when_enabled()
    {
        $this->skipUnlessFortifyFeature(Features::twoFactorAuthentication());

        $user = User::factory()->create();

        Features::twoFactorAuthentication([
            'confirm' => true,
            'confirmPassword' => true,
        ]);

        $response = $this->actingAs($user)
            ->get(route('security.edit'));

        $response->assertRedirect(route('password.confirm'));
    }

    public function test_security_page_does_not_require_password_confirmation_when_disabled()
    {
        $this->skipUnlessFortifyFeature(Features::twoFactorAuthentication());

        $user = User::factory()->create();

        Features::twoFactorAuthentication([
            'confirm' => true,
            'confirmPassword' => false,
        ]);

        $this->actingAs($user)
            ->get(route('security.edit'))
            ->assertOk()
            ->assertInertia(fn (Assert $page) => $page
                ->component('settings/Security'),
            );
    }

    public function test_security_page_renders_without_two_factor_when_feature_is_disabled()
    {
        $this->skipUnlessFortifyFeature(Features::twoFactorAuthentication());

        config(['fortify.features' => []]);

        $user = User::factory()->create();

        $this->actingAs($user)
            ->get(route('security.edit'))
            ->assertOk()
            ->assertInertia(fn (Assert $page) => $page
                ->component('settings/Security')
                ->where('canManageTwoFactor', false)
                ->missing('twoFactorEnabled')
                ->missing('requiresConfirmation'),
            );
    }

    public function test_users_who_must_change_their_password_are_redirected_to_security_when_visiting_other_pages()
    {
        $user = User::factory()->create([
            'must_change_password_on_next_login' => true,
        ]);

        $this->actingAs($user)
            ->get(route('dashboard'))
            ->assertRedirect(route('password.force-change.edit'));
    }

    public function test_users_who_must_change_their_password_can_view_the_dedicated_force_change_page()
    {
        $user = User::factory()->create([
            'must_change_password_on_next_login' => true,
        ]);

        $this->actingAs($user)
            ->get(route('password.force-change.edit'))
            ->assertOk()
            ->assertInertia(fn (Assert $page) => $page
                ->component('auth/ForcePasswordChange')
                ->where('status', null),
            );
    }

    public function test_forced_password_change_page_exposes_a_logout_action()
    {
        $user = User::factory()->create([
            'must_change_password_on_next_login' => true,
        ]);

        $this->actingAs($user)
            ->get(route('password.force-change.edit'))
            ->assertInertia(fn (Assert $page) => $page
                ->component('auth/ForcePasswordChange'),
            );
    }

    public function test_users_who_must_change_their_password_are_not_sent_to_the_normal_security_page()
    {
        $this->skipUnlessFortifyFeature(Features::twoFactorAuthentication());

        Features::twoFactorAuthentication([
            'confirm' => true,
            'confirmPassword' => true,
        ]);

        $user = User::factory()->create([
            'must_change_password_on_next_login' => true,
        ]);

        $this->actingAs($user)
            ->withSession(['auth.password_confirmed_at' => time()])
            ->get(route('security.edit'))
            ->assertRedirect(route('password.force-change.edit'));
    }

    public function test_password_can_be_updated()
    {
        $user = User::factory()->create();

        $response = $this
            ->actingAs($user)
            ->from(route('security.edit'))
            ->put(route('user-password.update'), [
                'current_password' => 'password',
                'password' => 'new-password',
                'password_confirmation' => 'new-password',
            ]);

        $response
            ->assertSessionHasNoErrors()
            ->assertRedirect(route('security.edit'));

        $this->assertTrue(Hash::check('new-password', $user->refresh()->password));
    }

    public function test_password_update_clears_the_forced_password_change_flag()
    {
        $user = User::factory()->create([
            'must_change_password_on_next_login' => true,
        ]);

        $this
            ->actingAs($user)
            ->from(route('security.edit'))
            ->put(route('user-password.update'), [
                'current_password' => 'password',
                'password' => 'new-password',
                'password_confirmation' => 'new-password',
            ])
            ->assertSessionHasNoErrors()
            ->assertRedirect(route('dashboard'));

        $this->assertFalse((bool) $user->refresh()->must_change_password_on_next_login);
    }

    public function test_forced_password_change_returns_the_user_to_their_intended_page_after_updating()
    {
        $user = User::factory()->create([
            'must_change_password_on_next_login' => true,
        ]);

        $this->actingAs($user)
            ->get(route('dashboard'));

        $this->actingAs($user)
            ->from(route('password.force-change.edit'))
            ->put(route('user-password.update'), [
                'current_password' => 'password',
                'password' => 'new-password',
                'password_confirmation' => 'new-password',
            ])
            ->assertSessionHasNoErrors()
            ->assertRedirect(route('dashboard'));

        $this->assertFalse((bool) $user->refresh()->must_change_password_on_next_login);
        $this->assertTrue(Hash::check('new-password', $user->password));
    }

    public function test_correct_password_must_be_provided_to_update_password()
    {
        $user = User::factory()->create();

        $response = $this
            ->actingAs($user)
            ->from(route('security.edit'))
            ->put(route('user-password.update'), [
                'current_password' => 'wrong-password',
                'password' => 'new-password',
                'password_confirmation' => 'new-password',
            ]);

        $response
            ->assertSessionHasErrors('current_password')
            ->assertRedirect(route('security.edit'));
    }

    public function test_new_password_must_be_different_from_the_current_password()
    {
        $user = User::factory()->create();

        $response = $this
            ->actingAs($user)
            ->from(route('security.edit'))
            ->put(route('user-password.update'), [
                'current_password' => 'password',
                'password' => 'password',
                'password_confirmation' => 'password',
            ]);

        $response
            ->assertSessionHasErrors([
                'password' => 'The new password must be different from your current password.',
            ])
            ->assertRedirect(route('security.edit'));

        $this->assertTrue(Hash::check('password', $user->fresh()->password));
    }

    public function test_two_factor_setup_requires_a_valid_code_before_protection_is_enabled(): void
    {
        $user = User::factory()->create();
        $this->actingAs($user)->withSession(['auth.password_confirmed_at' => time()])
            ->from(route('security.edit'))
            ->post(route('two-factor.enable'))->assertSessionHasNoErrors();

        $this->assertNotNull($user->refresh()->two_factor_secret);
        $this->assertFalse($user->hasEnabledTwoFactorAuthentication());
        $this->getJson(route('two-factor.secret-key'))->assertOk()->assertJsonStructure(['secretKey']);
        $this->getJson(route('two-factor.qr-code'))->assertOk()->assertJsonStructure(['svg']);

        $this->mock(TwoFactorAuthenticationProvider::class, function ($mock): void {
            $mock->shouldReceive('verify')->withArgs(fn ($secret, $code) => $code === '000000')->once()->andReturn(false);
            $mock->shouldReceive('verify')->withArgs(fn ($secret, $code) => $code === '123456')->once()->andReturn(true);
        });
        $this->post(route('two-factor.confirm'), ['code' => '000000'])
            ->assertSessionHasErrors('code', errorBag: 'confirmTwoFactorAuthentication');
        $this->assertFalse($user->refresh()->hasEnabledTwoFactorAuthentication());
        $this->post(route('two-factor.confirm'), ['code' => '123456'])->assertSessionHasNoErrors();
        $this->assertTrue($user->refresh()->hasEnabledTwoFactorAuthentication());
    }

    public function test_recovery_codes_can_be_retrieved_regenerated_and_removed_with_two_factor(): void
    {
        $user = User::factory()->withTwoFactor()->create();
        $this->actingAs($user)->withSession(['auth.password_confirmed_at' => time()]);
        $oldCodes = $this->getJson(route('two-factor.recovery-codes'))->assertOk()->json();
        $this->assertSame($user->recoveryCodes(), $oldCodes);
        $this->post(route('two-factor.regenerate-recovery-codes'))->assertSessionHasNoErrors();
        $newCodes = $this->getJson(route('two-factor.recovery-codes'))->assertOk()->json();
        $this->assertCount(8, $newCodes);
        $this->assertEmpty(array_intersect($oldCodes, $newCodes));
        $this->delete(route('two-factor.disable'))->assertSessionHasNoErrors();
        $this->assertNull($user->refresh()->two_factor_secret);
        $this->assertNull($user->two_factor_recovery_codes);
        $this->assertFalse($user->hasEnabledTwoFactorAuthentication());
    }

    public function test_sensitive_two_factor_endpoints_reject_expired_password_confirmation(): void
    {
        $user = User::factory()->withTwoFactor()->create();
        $this->actingAs($user);
        foreach (['two-factor.qr-code', 'two-factor.secret-key', 'two-factor.recovery-codes'] as $route) {
            $this->getJson(route($route))->assertStatus(423);
        }
        $this->deleteJson(route('two-factor.disable'))->assertStatus(423);
        $this->postJson(route('two-factor.regenerate-recovery-codes'))->assertStatus(423);
        $this->assertTrue($user->refresh()->hasEnabledTwoFactorAuthentication());
    }
}