<?php

namespace Tests\Feature\Admin;

use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Inertia\Testing\AssertableInertia as Assert;
use Tests\TestCase;

class UserManagementControllerTest extends TestCase
{
    use RefreshDatabase;

    /**
     * Ensure admins can view the user management page.
     */
    public function test_admin_can_view_the_user_management_page(): void
    {
        $admin = User::factory()->admin()->create();
        $member = User::factory()->create([
            'name' => 'Regular User',
            'email' => 'member@example.com',
        ]);

        $this->actingAs($admin)
            ->get(route('admin.users.index'))
            ->assertOk()
            ->assertInertia(fn (Assert $page) => $page
                ->component('admin/users/Index')
                ->has('users', 2)
                ->where("directPermissions.{$admin->id}.0", 'global:admin')
                ->where('permissionOptions.0.value', 'global:admin')
                ->where('permissionOptions.1.value', 'project:create'),
            );
    }

    /**
     * Ensure non-admin users cannot view the user management page.
     */
    public function test_non_admin_cannot_view_the_user_management_page(): void
    {
        $member = User::factory()->create();

        $this->actingAs($member)
            ->get(route('admin.users.index'))
            ->assertForbidden();
    }

    /**
     * Ensure admins can view the create user page.
     */
    public function test_admin_can_view_the_create_user_page(): void
    {
        $admin = User::factory()->admin()->create();

        $this->actingAs($admin)
            ->get(route('admin.users.create'))
            ->assertOk()
            ->assertInertia(fn (Assert $page) => $page
                ->component('admin/users/Create'),
            );
    }

    /**
     * Ensure admins can create managed users.
     */
    public function test_admin_can_create_a_user_that_must_change_password_on_next_login(): void
    {
        $admin = User::factory()->admin()->create();

        $this->actingAs($admin)
            ->post(route('admin.users.store'), [
                'name' => 'New Member',
                'email' => 'new-member@example.com',
                'password' => 'temporary-password',
                'password_confirmation' => 'temporary-password',
                'must_change_password_on_next_login' => true,
            ])
            ->assertRedirect(route('admin.users.index'))
            ->assertSessionHas('status', 'User was created.');

        $this->assertDatabaseHas('users', [
            'name' => 'New Member',
            'email' => 'new-member@example.com',
            'must_change_password_on_next_login' => true,
        ]);
    }

    /**
     * Ensure admins can update another user's global permissions.
     */
    public function test_admin_can_update_a_users_global_permissions(): void
    {
        $admin = User::factory()->admin()->create();
        $member = User::factory()->create([
            'name' => 'Regular User',
        ]);

        $this->actingAs($admin)
            ->patch(route('admin.users.update', $member), [
                'permissions' => ['global:admin', 'project:create'],
            ])
            ->assertRedirect(route('admin.users.index'))
            ->assertSessionHas('status', 'Regular User global permissions were updated.');

        $this->assertDatabaseHas('permission_assignments', [
            'assignee_id' => $member->id,
            'assignee_type' => $member->getMorphClass(),
            'permission' => 'global:admin',
            'scope_id' => null,
            'scope_type' => null,
        ]);

        $this->assertDatabaseHas('permission_assignments', [
            'assignee_id' => $member->id,
            'assignee_type' => $member->getMorphClass(),
            'permission' => 'project:create',
            'scope_id' => null,
            'scope_type' => null,
        ]);
    }

    /**
     * Ensure admins can also clear a user's global permissions.
     */
    public function test_admin_can_clear_a_users_global_permissions(): void
    {
        $admin = User::factory()->admin()->create();
        $member = User::factory()->create();
        $this->syncGlobalPermissions($member, ['global:admin', 'project:create']);

        $this->actingAs($admin)
            ->patch(route('admin.users.update', $member), [
                'permissions' => [],
            ])
            ->assertRedirect(route('admin.users.index'))
            ->assertSessionHas('status', "{$member->name} global permissions were updated.");

        $this->assertDatabaseMissing('permission_assignments', [
            'assignee_id' => $member->id,
            'assignee_type' => $member->getMorphClass(),
            'scope_id' => null,
            'scope_type' => null,
        ]);
    }

    /**
     * Ensure non-admin users cannot update global permissions.
     */
    public function test_non_admin_cannot_update_a_users_global_permissions(): void
    {
        $member = User::factory()->create();
        $otherUser = User::factory()->create();

        $this->actingAs($member)
            ->patch(route('admin.users.update', $otherUser), [
                'permissions' => ['global:admin'],
            ])
            ->assertForbidden();

        $this->assertDatabaseMissing('permission_assignments', [
            'assignee_id' => $otherUser->id,
            'assignee_type' => $otherUser->getMorphClass(),
            'permission' => 'global:admin',
            'scope_id' => null,
            'scope_type' => null,
        ]);
    }

    /**
     * Ensure non-admin users cannot create managed users.
     */
    public function test_non_admin_cannot_create_a_user(): void
    {
        $member = User::factory()->create();

        $this->actingAs($member)
            ->post(route('admin.users.store'), [
                'name' => 'Blocked User',
                'email' => 'blocked-user@example.com',
                'password' => 'temporary-password',
                'password_confirmation' => 'temporary-password',
                'must_change_password_on_next_login' => true,
            ])
            ->assertForbidden();

        $this->assertDatabaseMissing('users', [
            'email' => 'blocked-user@example.com',
        ]);
    }
}