<?php

use App\Models\User;
use App\Notifications\PasswordChangedNotification;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Notification;
use Inertia\Testing\AssertableInertia as Assert;

uses(RefreshDatabase::class);

beforeEach(function () {
    config([
        'auth-ui.features.email_verification' => false,
        'auth-ui.features.two_factor_required' => false,
    ]);
});

it('renders separate general and security profile pages', function () {
    $user = User::factory()->create();

    $this->actingAs($user)
        ->get('/profile')
        ->assertInertia(fn (Assert $page) => $page
            ->component('Profile/Show'));

    $this->actingAs($user)
        ->get('/profile/security')
        ->assertInertia(fn (Assert $page) => $page
            ->component('Profile/Security')
            ->where('twoFactor.requiresPassword', true));
});

it('updates profile details and requires email reverification after an email change', function () {
    $user = User::factory()->create([
        'email' => 'before@example.com',
        'email_verified_at' => now(),
    ]);

    $this->actingAs($user)
        ->patch('/profile', [
            'first_name' => 'Updated',
            'last_name' => 'Person',
            'username' => 'updated-person',
            'email' => 'after@example.com',
        ])
        ->assertRedirect('/profile')
        ->assertSessionHas('success');

    $user->refresh();

    expect($user->first_name)->toBe('Updated')
        ->and($user->last_name)->toBe('Person')
        ->and($user->username)->toBe('updated-person')
        ->and($user->email)->toBe('after@example.com')
        ->and($user->email_verified_at)->toBeNull();
});

it('rejects a case-insensitive duplicate username on profile update', function () {
    User::factory()->create(['username' => 'ExistingUser']);
    $user = User::factory()->create(['username' => 'different-user']);

    $this->actingAs($user)
        ->patch('/profile', [
            'first_name' => $user->first_name,
            'last_name' => $user->last_name,
            'username' => 'existinguser',
            'email' => $user->email,
        ])
        ->assertSessionHasErrors('username');

    expect($user->fresh()->username)->toBe('different-user');
});

it('requires the current password and revokes other sessions after a password change', function () {
    Notification::fake();
    config(['session.driver' => 'database']);
    $user = User::factory()->create(['password' => 'current secure password']);

    DB::table('sessions')->insert([
        'id' => 'another-authenticated-session',
        'user_id' => $user->id,
        'ip_address' => '192.0.2.10',
        'user_agent' => 'Test',
        'payload' => 'payload',
        'last_activity' => now()->timestamp,
    ]);

    $this->actingAs($user)
        ->put('/profile/password', [
            'current_password' => 'incorrect password',
            'password' => 'a completely new secure password',
            'password_confirmation' => 'a completely new secure password',
        ])
        ->assertSessionHasErrors('current_password');

    $this->actingAs($user)
        ->put('/profile/password', [
            'current_password' => 'current secure password',
            'password' => 'a completely new secure password',
            'password_confirmation' => 'a completely new secure password',
        ])
        ->assertRedirect('/profile/security')
        ->assertSessionHas('auth.session_version', 1);

    $user->refresh();

    expect(Hash::check('a completely new secure password', $user->password))->toBeTrue()
        ->and($user->auth_session_version)->toBe(1)
        ->and(DB::table('sessions')->where('id', 'another-authenticated-session')->exists())->toBeFalse();
    $this->assertAuthenticatedAs($user);
    Notification::assertSentTo($user, PasswordChangedNotification::class);
});

it('allows a social-only user to establish a password', function () {
    Notification::fake();
    $user = User::factory()->social()->create();

    $this->actingAs($user)
        ->put('/profile/password', [
            'current_password' => '',
            'password' => 'a secure password for social login',
            'password_confirmation' => 'a secure password for social login',
        ])
        ->assertRedirect('/profile/security');

    expect(Hash::check(
        'a secure password for social login',
        $user->fresh()->password
    ))->toBeTrue();
});