<?php

declare(strict_types=1);

namespace Tests\Feature;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Maestro\Core\Database\Seeders\UserSeeder;
use Maestro\Core\Models\MaestroAppSetting;
use Maestro\Core\Support\MaestroAppSettingsPresenter;
use Tests\Fixtures\AuthTestUser;
use Tests\TestCase;

final class LoginSettingsSuperadminApiTest extends TestCase
{
    use RefreshDatabase;

    protected function setUp(): void
    {
        parent::setUp();
        $this->withoutMiddleware(VerifyCsrfToken::class);
        $this->seed([UserSeeder::class]);
    }

    public function test_app_settings_includes_login_defaults(): void
    {
        $response = $this->getJson('/api/app-settings');

        $response->assertOk();
        $response->assertJsonPath('login.providers.microsoft', false);
        $response->assertJsonPath('login.providers.google', false);
        $response->assertJsonPath('login.providers.apple', false);
        $response->assertJsonPath('login.providersStored.microsoft', null);
        $response->assertJsonPath('login.microsoftConfigured', false);
    }

    public function test_superadmin_can_store_login_provider_settings(): void
    {
        $user = AuthTestUser::query()->where('email', 'demo@example.com')->first();
        self::assertNotNull($user);

        $response = $this->actingAs($user, 'web')->patchJson('/api/superadmin/app-settings', [
            'login' => [
                'providers' => [
                    'microsoft' => false,
                    'google' => true,
                    'apple' => false,
                ],
            ],
        ]);

        $response->assertOk();
        $response->assertJsonPath('login.providers.google', true);
        $response->assertJsonPath('login.providers.apple', false);
        $response->assertJsonPath('login.providersStored.google', true);

        $row = MaestroAppSetting::instance()->fresh();
        self::assertNotNull($row);
        self::assertIsArray($row->login);
        self::assertFalse((bool) ($row->login['providers']['microsoft'] ?? true));
        self::assertTrue((bool) ($row->login['providers']['google'] ?? false));
    }

    public function test_microsoft_auto_enabled_when_configured_and_not_explicitly_disabled(): void
    {
        $this->app['config']->set('services.microsoft.client_id', 'test-client');
        $this->app['config']->set('services.microsoft.client_secret', 'test-secret');
        $this->app['config']->set('services.microsoft.redirect', 'http://localhost/auth/microsoft/callback');

        $payload = MaestroAppSettingsPresenter::toArray(MaestroAppSetting::instance());

        self::assertTrue($payload['login']['microsoftConfigured']);
        self::assertTrue($payload['login']['providers']['microsoft']);
        self::assertNull($payload['login']['providersStored']['microsoft']);
    }

    public function test_explicit_microsoft_false_hides_provider_even_when_configured(): void
    {
        $this->app['config']->set('services.microsoft.client_id', 'test-client');
        $this->app['config']->set('services.microsoft.client_secret', 'test-secret');
        $this->app['config']->set('services.microsoft.redirect', 'http://localhost/auth/microsoft/callback');

        $row = MaestroAppSetting::instance();
        $row->login = [
            'providers' => [
                'microsoft' => false,
            ],
        ];
        $row->save();

        $payload = MaestroAppSettingsPresenter::toArray($row->fresh());

        self::assertTrue($payload['login']['microsoftConfigured']);
        self::assertFalse($payload['login']['providers']['microsoft']);
        self::assertFalse($payload['login']['providersStored']['microsoft']);
    }
}
