<?php

namespace Tests\Feature\Business;

use App\Models\Auth\DingTalkIdentity;
use App\Models\Auth\Permission;
use App\Models\Auth\Role;
use App\Models\Auth\User;
use App\Utilities\SidebarPermissions;
use Tests\Feature\FeatureTestCase;

class LogStatisticsPageAccessTest extends FeatureTestCase
{
    public function test_log_statistics_is_locked_to_renshen_even_for_explicit_grants_and_admins(): void
    {
        $renshen = $this->account('人参', '1004216768778351');
        $sameName = $this->account('人参');
        $other = $this->account('其他财务');
        $subject = 'user_' . $other->id;
        setting()->set('system.sidebar_permissions', [
            'configured' => [$subject],
            'subjects' => [$subject => ['other/log-statistics']],
        ]);

        $this->assertTrue(SidebarPermissions::canViewPage($renshen, 'other', 'log-statistics'));
        $this->assertFalse(SidebarPermissions::canViewPage($sameName, 'other', 'log-statistics'));
        $this->assertFalse(SidebarPermissions::canViewPage($other, 'other', 'log-statistics'));
        $this->assertFalse(SidebarPermissions::canViewPage($this->user, 'other', 'log-statistics'));

        $this->loginAs($renshen)
            ->get(route('business.pages.show', [
                'section' => 'other',
                'page' => 'log-statistics',
            ]))
            ->assertOk();

        $this->withExceptionHandling()->loginAs($other)
            ->get(route('business.pages.show', [
                'section' => 'other',
                'page' => 'log-statistics',
            ]))
            ->assertForbidden();
        $this->post(route('business.pages.store', [
            'section' => 'other',
            'page' => 'log-statistics',
        ]), [])->assertForbidden();
    }

    private function account(string $name, ?string $dingTalkUserId = null): User
    {
        $suffix = User::count();
        $user = User::create([
            'name' => $name,
            'email' => 'log-statistics-access-' . $suffix . '@example.test',
            'password' => 'fixture-unused-password',
            'enabled' => true,
            'locale' => 'zh-CN',
            'landing_page' => 'dashboard',
        ]);
        $user->roles()->attach(Role::where('name', 'user')->firstOrFail()->id);
        $user->permissions()->attach(Permission::where('name', 'read-admin-panel')->firstOrFail()->id);
        $user->companies()->attach($this->company->id);
        if ($dingTalkUserId !== null) {
            DingTalkIdentity::create([
                'user_id' => $user->id,
                'union_id' => 'union-log-statistics-' . $user->id,
                'dingtalk_user_id' => $dingTalkUserId,
                'nickname' => $name,
                'bound_at' => now(),
            ]);
        }

        return $user;
    }
}