<?php

namespace Tests\Unit\Http\Middleware;

use App\Http\Middleware\EnforceLocalOnly;
use Illuminate\Config\Repository;
use Illuminate\Container\Container;
use Illuminate\Http\Request;
use PHPUnit\Framework\TestCase;
use Symfony\Component\HttpFoundation\Response;

class EnforceLocalOnlyTest extends TestCase
{
    private Container $container;

    protected function setUp(): void
    {
        parent::setUp();

        $this->container = new Container();
        $this->container->instance('config', new Repository([
            'app' => [
                'offline' => true,
                'asset_url' => 'https://caiwu.jiansun.vip',
            ],
        ]));

        Container::setInstance($this->container);
    }

    protected function tearDown(): void
    {
        Container::setInstance(null);

        parent::tearDown();
    }

    public function test_offline_policy_allows_the_fixed_qiniu_asset_origin(): void
    {
        $response = (new EnforceLocalOnly())->handle(
            Request::create('/auth/login'),
            fn () => new Response('ok')
        );

        $policy = (string) $response->headers->get('Content-Security-Policy');

        $this->assertStringContainsString(
            "script-src 'self' https://caiwu.jiansun.vip",
            $policy
        );
        $this->assertStringContainsString(
            "style-src 'self' https://caiwu.jiansun.vip",
            $policy
        );
        $this->assertStringContainsString(
            "font-src 'self' https://caiwu.jiansun.vip",
            $policy
        );
        $this->assertStringContainsString(
            "img-src 'self' https://caiwu.jiansun.vip",
            $policy
        );
    }

    public function test_online_mode_does_not_add_an_offline_policy(): void
    {
        $this->container->make('config')->set('app.offline', false);

        $response = (new EnforceLocalOnly())->handle(
            Request::create('/auth/login'),
            fn () => new Response('ok')
        );

        $this->assertFalse($response->headers->has('Content-Security-Policy'));
    }
}