<?php

namespace Tests\Feature;

use App\Models\Athlete;
use App\Models\AthleteAssessment;
use App\Models\Coach;
use App\Models\CoachDocument;
use App\Models\CoachRequest;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

/**
 * بازتولید خودکار مهم‌ترین تست‌های IDOR که در طول ۱۵ فاز MVP به‌صورت دستی
 * توصیه/انجام می‌شدند. لیست کامل (دستی) در docs/security-audit-checklist.md
 * (Phase 14) موجود است — این فایل فقط چند مورد پرریسک‌تر را خودکار می‌کند.
 */
class AuthorizationIdorTest extends TestCase
{
    use RefreshDatabase;

    public function test_coach_without_active_relationship_cannot_view_athlete_assessment(): void
    {
        $athlete = Athlete::factory()->create();
        $assessment = AthleteAssessment::factory()->create(['athlete_id' => $athlete->id]);

        $unrelatedCoach = Coach::factory()->create();

        $response = $this->actingAs($unrelatedCoach->user)
            ->get(route('coach.assessments.show', $assessment));

        $response->assertForbidden();
    }

    public function test_coach_with_active_relationship_can_view_athlete_assessment(): void
    {
        $athlete = Athlete::factory()->create();
        $assessment = AthleteAssessment::factory()->create(['athlete_id' => $athlete->id]);

        $coach = Coach::factory()->create();
        CoachRequest::factory()->accepted()->create([
            'athlete_id' => $athlete->id,
            'coach_id' => $coach->id,
        ]);

        $response = $this->actingAs($coach->user)
            ->get(route('coach.assessments.show', $assessment));

        $response->assertOk();
    }

    public function test_athlete_cannot_view_another_athletes_assessment(): void
    {
        $athleteA = Athlete::factory()->create();
        $assessmentA = AthleteAssessment::factory()->create(['athlete_id' => $athleteA->id]);

        $athleteB = Athlete::factory()->create();

        $response = $this->actingAs($athleteB->user)
            ->get(route('athlete.assessments.show', $assessmentA));

        $response->assertForbidden();
    }

    public function test_coach_cannot_download_another_coachs_document(): void
    {
        $coachA = Coach::factory()->create();
        $document = CoachDocument::factory()->create(['coach_id' => $coachA->id]);

        $coachB = Coach::factory()->create();

        $response = $this->actingAs($coachB->user)
            ->get(route('coach.documents.show', $document));

        $response->assertForbidden();
    }

    public function test_athlete_cannot_send_duplicate_active_request_to_same_coach(): void
    {
        $athlete = Athlete::factory()->create();
        $coach = Coach::factory()->create();

        CoachRequest::factory()->create(['athlete_id' => $athlete->id, 'coach_id' => $coach->id]);

        $response = $this->actingAs($athlete->user)
            ->post(route('athlete.coach-requests.store', $coach), ['message' => 'test']);

        $response->assertSessionHasErrors();
    }

    public function test_guest_cannot_access_any_authenticated_dashboard(): void
    {
        $this->get(route('admin.dashboard'))->assertRedirect(route('login'));
    }

    public function test_athlete_cannot_access_admin_routes(): void
    {
        $athlete = Athlete::factory()->create();

        $response = $this->actingAs($athlete->user)->get(route('admin.dashboard'));

        $response->assertForbidden();
    }
}
