<?php

namespace Tests\Feature;

use App\Models\Group;
use App\Models\Investigation;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class InvestigationAccessManagementTest extends TestCase
{
    use RefreshDatabase;

    public function test_owner_can_grant_a_user_viewer_access(): void
    {
        $owner = User::factory()->create();
        $grantee = User::factory()->create(['email' => 'grantee@example.com']);
        $investigation = Investigation::factory()->for($owner, 'owner')->create();

        $this->actingAs($owner)
            ->post(route('investigations.access.users.store', $investigation), [
                'email' => 'grantee@example.com',
                'role' => 'viewer',
            ])
            ->assertRedirect(route('investigations.access.index', $investigation));

        $this->assertSame('viewer', $investigation->fresh()->roleFor($grantee));
    }

    public function test_owner_can_revoke_a_users_access(): void
    {
        $owner = User::factory()->create();
        $grantee = User::factory()->create();
        $investigation = Investigation::factory()->for($owner, 'owner')->create();
        $investigation->users()->attach($grantee, ['role' => 'editor']);

        $this->actingAs($owner)
            ->delete(route('investigations.access.users.destroy', [$investigation, $grantee]))
            ->assertRedirect(route('investigations.access.index', $investigation));

        $this->assertNull($investigation->fresh()->roleFor($grantee));
    }

    public function test_owner_can_grant_a_group_editor_access(): void
    {
        $owner = User::factory()->create();
        $member = User::factory()->create();
        $group = Group::factory()->for($owner, 'owner')->create();
        $group->members()->attach($member);
        $investigation = Investigation::factory()->for($owner, 'owner')->create();

        $this->actingAs($owner)
            ->post(route('investigations.access.groups.store', $investigation), [
                'group_id' => $group->id,
                'role' => 'editor',
            ])
            ->assertRedirect(route('investigations.access.index', $investigation));

        $this->assertSame('editor', $investigation->fresh()->roleFor($member));
    }

    public function test_owner_can_revoke_a_groups_access(): void
    {
        $owner = User::factory()->create();
        $member = User::factory()->create();
        $group = Group::factory()->for($owner, 'owner')->create();
        $group->members()->attach($member);
        $investigation = Investigation::factory()->for($owner, 'owner')->create();
        $investigation->groups()->attach($group, ['role' => 'viewer']);

        $this->actingAs($owner)
            ->delete(route('investigations.access.groups.destroy', [$investigation, $group]))
            ->assertRedirect(route('investigations.access.index', $investigation));

        $this->assertNull($investigation->fresh()->roleFor($member));
    }

    public function test_editor_cannot_manage_access(): void
    {
        $owner = User::factory()->create();
        $editor = User::factory()->create();
        $investigation = Investigation::factory()->for($owner, 'owner')->create();
        $investigation->users()->attach($editor, ['role' => 'editor']);

        $this->actingAs($editor)
            ->get(route('investigations.access.index', $investigation))
            ->assertForbidden();
    }

    public function test_owner_cannot_grant_a_group_they_have_no_relation_to(): void
    {
        $owner = User::factory()->create();
        $unrelatedGroup = Group::factory()->create();
        $investigation = Investigation::factory()->for($owner, 'owner')->create();

        $this->actingAs($owner)
            ->post(route('investigations.access.groups.store', $investigation), [
                'group_id' => $unrelatedGroup->id,
                'role' => 'viewer',
            ])
            ->assertForbidden();
    }
}