<?php

namespace Tests\Feature;

use App\Models\Group;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class GroupManagementTest extends TestCase
{
    use RefreshDatabase;

    public function test_owner_can_add_a_member_by_email(): void
    {
        $owner = User::factory()->create();
        $newMember = User::factory()->create(['email' => 'member@example.com']);
        $group = Group::factory()->for($owner, 'owner')->create();

        $this->actingAs($owner)
            ->post(route('groups.members.store', $group), ['email' => 'member@example.com'])
            ->assertRedirect(route('groups.show', $group));

        $this->assertTrue($group->fresh()->members->contains($newMember));
    }

    public function test_adding_a_member_with_unknown_email_fails_gracefully(): void
    {
        $owner = User::factory()->create();
        $group = Group::factory()->for($owner, 'owner')->create();

        $this->actingAs($owner)
            ->post(route('groups.members.store', $group), ['email' => 'nobody@example.com'])
            ->assertSessionHasErrors('email');

        $this->assertCount(0, $group->fresh()->members);
    }

    public function test_owner_can_remove_a_member(): void
    {
        $owner = User::factory()->create();
        $member = User::factory()->create();
        $group = Group::factory()->for($owner, 'owner')->create();
        $group->members()->attach($member);

        $this->actingAs($owner)
            ->delete(route('groups.members.destroy', [$group, $member]))
            ->assertRedirect(route('groups.show', $group));

        $this->assertFalse($group->fresh()->members->contains($member));
    }

    public function test_non_owner_member_cannot_manage_members(): void
    {
        $owner = User::factory()->create();
        $member = User::factory()->create();
        $anotherUser = User::factory()->create(['email' => 'another@example.com']);
        $group = Group::factory()->for($owner, 'owner')->create();
        $group->members()->attach($member);

        $this->actingAs($member)
            ->post(route('groups.members.store', $group), ['email' => 'another@example.com'])
            ->assertForbidden();
    }

    public function test_unrelated_user_cannot_view_group(): void
    {
        $owner = User::factory()->create();
        $stranger = User::factory()->create();
        $group = Group::factory()->for($owner, 'owner')->create();

        $this->actingAs($stranger)
            ->get(route('groups.show', $group))
            ->assertForbidden();
    }
}