<?php

namespace Tests\Feature\Auth;

use App\Domains\Attachable\Enums\AttachmentType;
use App\Domains\Attachable\Models\Attachment;
use App\Domains\Auth\Models\ResetPasswordAttempt;
use App\Domains\Auth\Models\User;
use App\Domains\Authorization\Enums\RoleCode;
use App\Domains\Notification\Events\PasswordResetRequested;
use App\Domains\Tenant\Models\Tenant;
use Database\Seeders\AuthorizationSeeder;
use Illuminate\Database\UniqueConstraintViolationException;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Routing\Middleware\ThrottleRequests;
use Illuminate\Support\Facades\Event;
use Illuminate\Support\Facades\Hash;
use Tests\TestCase;

class EmailUniquenessPerRoleTest extends TestCase
{
    use RefreshDatabase;

    protected function setUp(): void
    {
        parent::setUp();
        $this->withoutMiddleware(ThrottleRequests::class);
        $this->seed(AuthorizationSeeder::class);
        Event::fake([PasswordResetRequested::class]);
    }

    public function test_database_allows_different_roles_and_reuse_after_soft_delete(): void
    {
        foreach (RoleCode::cases() as $role) {
            User::factory()->create(['email' => 'Shared@example.com', 'rol_codigo' => $role->value]);
        }
        $user = User::where('rol_codigo', 'user')->sole();
        $user->delete();
        $replacement = User::factory()->create(['email' => 'shared@example.com']);
        $this->assertNotSame($user->id, $replacement->id);
        $this->assertSame(4, User::where('active_email', 'shared@example.com')->count());
    }

    public function test_database_rejects_same_role_case_insensitively_across_tenants(): void
    {
        foreach (['one', 'two'] as $code) {
            $this->createTenant($code);
        }
        User::factory()->create(['email' => 'Shared@example.com', 'tenant_codigo' => 'one']);
        $this->expectException(UniqueConstraintViolationException::class);
        User::factory()->create(['email' => 'shared@example.com', 'tenant_codigo' => 'two']);
    }

    public function test_role_change_cannot_create_a_duplicate_active_identity(): void
    {
        User::factory()->create(['email' => 'shared@example.com']);
        $admin = User::factory()->create(['email' => 'shared@example.com', 'rol_codigo' => 'adminapp']);
        $this->expectException(UniqueConstraintViolationException::class);
        $admin->update(['rol_codigo' => 'user']);
    }

    public function test_registration_accepts_another_role_but_rejects_same_role(): void
    {
        User::factory()->create(['email' => 'SHARED@example.com', 'rol_codigo' => 'adminapp']);
        $payload = ['nombre_apellido' => 'Shared', 'email' => ' Shared@Example.com ',
            'password' => 'Secret!123', 'password_confirmation' => 'Secret!123'];
        $this->postJson('/api/register', $payload)->assertCreated()->assertJsonPath('data.email', 'shared@example.com');
        $this->postJson('/api/register', $payload)->assertUnprocessable()->assertJsonValidationErrors('email');
    }

    public function test_login_and_password_reset_select_the_role_from_each_application(): void
    {
        $tenant = $this->createTenant('acme');
        $users = [];
        // Create staff first so an email-only lookup would select the wrong account.
        foreach (['adminapp', 'scanner', 'user'] as $role) {
            $users[$role] = User::factory()->create([
                'email' => 'Shared@example.com', 'rol_codigo' => $role,
                'tenant_codigo' => $tenant->codigo, 'password' => 'Old!'.$role,
            ]);
        }
        foreach (['user' => '/api', 'adminapp' => '/api/v1/adminapp', 'scanner' => '/api/v1/scanner'] as $role => $base) {
            $this->postJson($base.'/login', [
                'email' => 'SHARED@example.com', 'password' => 'Old!'.$role, 'tenant_codigo' => 'acme',
            ])->assertOk()->assertJsonPath('user.id', $users[$role]->id);
            $this->postJson($base.'/password/reset-attempts', [
                'email' => 'shared@example.com', 'tenant_codigo' => 'acme',
            ])->assertAccepted();
        }
        // Identical codes across roles must still only change the intended account.
        ResetPasswordAttempt::query()->update(['codigo' => '1234']);
        foreach (['user' => '/api', 'adminapp' => '/api/v1/adminapp', 'scanner' => '/api/v1/scanner'] as $role => $base) {
            $this->postJson($base.'/password/reset-attempts/validate', [
                'email' => 'shared@example.com', 'codigo' => '1234',
            ])->assertOk();
            $this->postJson($base.'/password/reset', [
                'email' => 'shared@example.com', 'codigo' => '1234',
                'password' => 'New!'.$role, 'password_confirmation' => 'New!'.$role,
            ])->assertOk();
            $this->assertTrue(Hash::check('New!'.$role, $users[$role]->fresh()->password));
        }
    }

    private function createTenant(string $code): Tenant
    {
        $headerLogo = $this->createAttachment("{$code}-header");
        $footerLogo = $this->createAttachment("{$code}-footer");

        return Tenant::query()->create([
            'codigo' => $code,
            'nombre' => ucfirst($code),
            'dominio' => "{$code}.local",
            'primary_color' => '#000000',
            'secondary_color' => '#000000',
            'danger_color' => '#000000',
            'success_color' => '#000000',
            'header_bg_color' => '#000000',
            'footer_bg_color' => '#000000',
            'header_logo_id' => $headerLogo->id,
            'footer_logo_id' => $footerLogo->id,
        ]);
    }

    private function createAttachment(string $name): Attachment
    {
        return Attachment::query()->create([
            'path' => "test/{$name}.png",
            'filename' => "{$name}.png",
            'type' => AttachmentType::Image,
            'mime_type' => 'image/png',
        ]);
    }
}