<?php

declare(strict_types=1);

namespace KTXT\Unit\Event;

use KTXC\Models\Firewall\FirewallRuleObject;
use KTXC\Security\Event\AccessDeniedEvent;
use KTXC\Security\Event\SecurityEventSeverity;
use PHPUnit\Framework\Attributes\Test;
use PHPUnit\Framework\Attributes\TestDox;
use PHPUnit\Framework\TestCase;

final class AccessDeniedEventTest extends TestCase
{
    #[Test]
    #[TestDox('Access-denial state is typed and complete at construction')]
    public function constructsTypedState(): void
    {
        $event = new AccessDeniedEvent(
            '203.0.113.10',
            'rule-a',
            FirewallRuleObject::SCOPE_TENANT,
            'device-a',
            'Blocked by policy',
            'tenant-a',
            'identity-a',
        );

        self::assertSame(AccessDeniedEvent::class, $event->label());
        self::assertSame('203.0.113.10', $event->getIpAddress());
        self::assertSame('device-a', $event->getDeviceFingerprint());
        self::assertSame('rule-a', $event->getRuleId());
        self::assertSame(FirewallRuleObject::SCOPE_TENANT, $event->getRuleScope());
        self::assertSame('Blocked by policy', $event->getReason());
        self::assertSame('tenant-a', $event->tenantIdentifier());
        self::assertSame('identity-a', $event->actorIdentity());
        self::assertSame(SecurityEventSeverity::WARNING, $event->getSeverity());
    }

    #[Test]
    #[TestDox('Access denial rejects incomplete rule context')]
    public function rejectsIncompleteRuleContext(): void
    {
        foreach ([
            ['', 'rule-a', FirewallRuleObject::SCOPE_TENANT],
            ['203.0.113.10', '', FirewallRuleObject::SCOPE_TENANT],
            ['203.0.113.10', 'rule-a', 'unknown'],
        ] as $arguments) {
            try {
                new AccessDeniedEvent(...$arguments);
                self::fail('Incomplete access-denial context was accepted.');
            } catch (\InvalidArgumentException) {
                $this->addToAssertionCount(1);
            }
        }
    }
}