<?php

namespace Tests\Feature;

use App\Models\Client;
use App\Models\Product;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Gate;
use Tests\TestCase;

class Tp8AuthorizationTest extends TestCase
{
    use RefreshDatabase;

    public function test_client_policy_permission_matrix_matches_the_tp(): void
    {
        $admin = User::factory()->admin()->create();
        $user = User::factory()->create();
        $client = Client::create(['name' => 'Jean Client', 'email' => 'client@example.com']);

        $this->assertTrue(Gate::forUser($admin)->allows('view', $client));
        $this->assertTrue(Gate::forUser($admin)->allows('create', Client::class));
        $this->assertTrue(Gate::forUser($admin)->allows('update', $client));
        $this->assertTrue(Gate::forUser($admin)->allows('delete', $client));
        $this->assertTrue(Gate::forUser($user)->allows('view', $client));
        $this->assertTrue(Gate::forUser($user)->allows('create', Client::class));
        $this->assertTrue(Gate::forUser($user)->allows('update', $client));
        $this->assertFalse(Gate::forUser($user)->allows('delete', $client));
    }

    public function test_standard_user_cannot_delete_client_or_product(): void
    {
        $user = User::factory()->create();
        $client = Client::create(['name' => 'Client protégé', 'email' => 'client@example.com']);
        $product = Product::create(['name' => 'Produit protégé', 'price' => 25, 'stock' => 5]);

        $this->actingAs($user)->delete(route('clients.destroy', $client))->assertForbidden();
        $this->actingAs($user)->delete(route('products.destroy', $product))->assertForbidden();

        $this->assertModelExists($client);
        $this->assertModelExists($product);
    }

    public function test_administrator_can_delete_client_and_product(): void
    {
        $admin = User::factory()->admin()->create();
        $client = Client::create(['name' => 'Client à supprimer', 'email' => 'delete@example.com']);
        $product = Product::create(['name' => 'Produit à supprimer', 'price' => 25, 'stock' => 5]);

        $this->actingAs($admin)
            ->delete(route('clients.destroy', $client))
            ->assertRedirect(route('clients.index'));
        $this->actingAs($admin)
            ->delete(route('products.destroy', $product))
            ->assertRedirect(route('products.index'));

        $this->assertModelMissing($client);
        $this->assertModelMissing($product);
    }

    public function test_delete_buttons_are_hidden_from_standard_user(): void
    {
        $user = User::factory()->create();
        Client::create(['name' => 'Client visible', 'email' => 'visible@example.com']);
        Product::create(['name' => 'Produit visible', 'price' => 25, 'stock' => 5]);

        $this->actingAs($user)->get(route('clients.index'))
            ->assertSee('Client visible')
            ->assertDontSee('Supprimer');
        $this->actingAs($user)->get(route('products.index'))
            ->assertSee('Produit visible')
            ->assertDontSee('Supprimer');
    }

    public function test_admin_page_is_restricted_to_administrators(): void
    {
        $user = User::factory()->create();
        $admin = User::factory()->admin()->create();

        $this->actingAs($user)->get(route('admin'))->assertForbidden();
        $this->actingAs($admin)->get(route('admin'))->assertSee('Administration');
    }
}