<?php

declare(strict_types=1);

namespace KTXT\AuthenticationProviderPassword\Tests\Integration;

/**
 * Exercises the real /auth/start -> /auth/identify -> /auth/verify flow for
 * the password provider, through the HTTP kernel end to end.
 */
class PasswordAuthenticationTest extends IntegrationTestCase
{
    public function testAuthStartOffersPasswordMethod(): void
    {
        $start = static::request('GET', '/auth/start');

        $this->assertSame(200, $start['status']);
        $methodIds = array_column($start['body']['methods'] ?? [], 'id');
        $this->assertContains('password', $methodIds);
    }

    public function testSuccessfulLoginReturnsTokens(): void
    {
        static::createUser('alice@example.test', 'Correct-Horse-1!');

        $result = static::loginWithPassword('alice@example.test', 'Correct-Horse-1!');

        $this->assertSame('success', $result['body']['status'] ?? null, json_encode($result['body']));
        $this->assertNotNull($result['accessToken']);
        $this->assertNotNull($result['refreshToken']);
        $this->assertSame('alice@example.test', $result['body']['user']['identity'] ?? null);
    }

    public function testAccessTokenAuthorizesSubsequentRequests(): void
    {
        static::createUser('bob@example.test', 'Correct-Horse-2!');
        $login = static::loginWithPassword('bob@example.test', 'Correct-Horse-2!');

        $ping = static::authorizedRequest($login['accessToken'], 'GET', '/auth/ping');

        $this->assertSame(200, $ping['status']);
        $this->assertSame('ok', $ping['body']['status'] ?? null);
    }

    public function testWrongPasswordIsRejected(): void
    {
        static::createUser('carol@example.test', 'Correct-Horse-3!');

        $result = static::loginWithPassword('carol@example.test', 'wrong-password');

        $this->assertSame('failed', $result['body']['status'] ?? null);
        $this->assertSame(401, $result['status']);
        $this->assertNull($result['accessToken']);
    }

    public function testLoginFailsForUserWithoutAPasswordSet(): void
    {
        static::createUser('dave@example.test');

        $result = static::loginWithPassword('dave@example.test', 'anything');

        $this->assertSame('failed', $result['body']['status'] ?? null);
        $this->assertSame(401, $result['status']);
    }

    public function testLoginFailsForUnknownIdentity(): void
    {
        $result = static::loginWithPassword('nobody@example.test', 'anything');

        $this->assertSame('failed', $result['body']['status'] ?? null);
        $this->assertSame(401, $result['status']);
    }

    public function testUnauthenticatedRequestToProtectedRouteIsRejected(): void
    {
        $ping = static::request('GET', '/auth/ping');

        $this->assertSame(401, $ping['status']);
    }
}