<?php

declare(strict_types=1);

namespace KTXT\Unit\Event;

use KTXC\Models\Firewall\FirewallRuleObject;
use KTXC\Security\Event\FirewallRuleCreatedEvent;
use KTXC\Security\Event\FirewallRuleDisabledEvent;
use KTXC\Security\Event\FirewallRuleEnabledEvent;
use KTXC\Security\Event\FirewallRuleExtendedEvent;
use KTXC\Security\Event\FirewallRuleRemovedEvent;
use KTXC\Security\Event\SecurityEventSeverity;
use PHPUnit\Framework\Attributes\Test;
use PHPUnit\Framework\Attributes\TestDox;
use PHPUnit\Framework\TestCase;

final class FirewallRuleEventTest extends TestCase
{
    #[Test]
    #[TestDox('Firewall rule events capture immutable rule snapshots')]
    public function capturesRuleSnapshot(): void
    {
        $expiresAt = new \DateTimeImmutable('+5 minutes');
        $rule = (new FirewallRuleObject())
            ->setId('rule-a')
            ->setScope(FirewallRuleObject::SCOPE_TENANT)
            ->setTenantId('tenant-a')
            ->setType(FirewallRuleObject::TYPE_IP)
            ->setAction(FirewallRuleObject::ACTION_BLOCK)
            ->setValue('203.0.113.10')
            ->setReason('Repeated abuse')
            ->setCreatedBy('creator-a')
            ->setExpiresAt($expiresAt)
            ->setMetadata(['origin' => 'automatic', 'failureCount' => 5]);

        $event = FirewallRuleExtendedEvent::fromRule(
            $rule,
            'operator-a',
            ['changeReason' => 'Continue monitoring'],
        );
        $rule->setReason('Mutated after publication');

        self::assertSame(FirewallRuleExtendedEvent::class, $event->getName());
        self::assertSame('rule-a', $event->getRuleId());
        self::assertSame(FirewallRuleObject::SCOPE_TENANT, $event->getRuleScope());
        self::assertSame(FirewallRuleObject::TYPE_IP, $event->getRuleType());
        self::assertSame(FirewallRuleObject::ACTION_BLOCK, $event->getRuleAction());
        self::assertSame('203.0.113.10', $event->getRuleValue());
        self::assertSame('Repeated abuse', $event->getReason());
        self::assertSame('automatic', $event->getOrigin());
        self::assertSame($expiresAt->format(\DateTimeInterface::ATOM), $event->getExpiresAt());
        self::assertSame('tenant-a', $event->getTenantId());
        self::assertSame('operator-a', $event->getIdentityId());
        self::assertSame(5, $event->get('failureCount'));
        self::assertSame('Continue monitoring', $event->get('changeReason'));
        self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
    }

    #[Test]
    #[TestDox('Each firewall rule lifecycle operation has a dedicated event key')]
    public function exposesDedicatedLifecycleKeys(): void
    {
        $rule = (new FirewallRuleObject())
            ->setId('rule-a')
            ->setScope(FirewallRuleObject::SCOPE_SYSTEM)
            ->setType(FirewallRuleObject::TYPE_IP)
            ->setAction(FirewallRuleObject::ACTION_BLOCK)
            ->setValue('203.0.113.10');

        foreach ([
            FirewallRuleCreatedEvent::class,
            FirewallRuleExtendedEvent::class,
            FirewallRuleEnabledEvent::class,
            FirewallRuleDisabledEvent::class,
            FirewallRuleRemovedEvent::class,
        ] as $eventClass) {
            self::assertSame($eventClass, $eventClass::fromRule($rule)->getName());
        }
    }
}