<?php

declare(strict_types=1);

namespace KTXT\Unit\Models\Firewall;

use KTXC\Models\Firewall\FirewallRuleObject;
use PHPUnit\Framework\Attributes\TestDox;
use PHPUnit\Framework\TestCase;

class FirewallRuleObjectTest extends TestCase
{
    #[TestDox('Persisted rules without an explicit scope are rejected')]
    public function testMissingScope(): void
    {
        $this->expectException(\InvalidArgumentException::class);
        $this->expectExceptionMessage('explicit scope');

        (new FirewallRuleObject())->jsonDeserialize([
            'tenantId' => 'tenant-a',
            'type' => FirewallRuleObject::TYPE_IP,
            'action' => FirewallRuleObject::ACTION_BLOCK,
            'value' => '203.0.113.10',
        ]);
    }

    #[TestDox('Unknown rule scopes are rejected')]
    public function testUnknownScope(): void
    {
        $this->expectException(\InvalidArgumentException::class);

        (new FirewallRuleObject())->setScope('unknown');
    }

    #[TestDox('Tenant rules require a tenant ID')]
    public function testTenantOwnership(): void
    {
        $this->expectException(\InvalidArgumentException::class);
        $this->expectExceptionMessage('require a tenant ID');

        (new FirewallRuleObject())->assertValidScopeOwnership();
    }

    #[TestDox('System rules cannot have a tenant ID')]
    public function testSystemOwnership(): void
    {
        $this->expectException(\InvalidArgumentException::class);
        $this->expectExceptionMessage('cannot have a tenant ID');

        (new FirewallRuleObject())
            ->setScope(FirewallRuleObject::SCOPE_SYSTEM)
            ->setTenantId('tenant-a')
            ->assertValidScopeOwnership();
    }
}