<?php

namespace Tests\Feature;

use App\Http\Middleware\LogViewerPassword;
use Illuminate\Http\Request;
use Tests\TestCase;

class LogViewerPasswordTest extends TestCase
{
    public function test_missing_configuration_denies_access()
    {
        config(['logviewer.password' => null]);
        $response = $this->checkAccess();
        $this->assertSame(503, $response->getStatusCode());
    }

    public function test_missing_or_incorrect_credentials_are_rejected()
    {
        config(['logviewer.password' => password_hash('test-only-secret', PASSWORD_DEFAULT)]);
        foreach ([[], ['PHP_AUTH_USER' => 'logs', 'PHP_AUTH_PW' => 'wrong'],
            ['PHP_AUTH_USER' => 'other', 'PHP_AUTH_PW' => 'test-only-secret']] as $server) {
            $response = $this->checkAccess($server);
            $this->assertSame(401, $response->getStatusCode());
            $this->assertStringContainsString('Basic realm=', $response->headers->get('WWW-Authenticate'));
        }
    }

    public function test_correct_credentials_allow_access_without_caching()
    {
        config(['logviewer.password' => password_hash('test-only-secret', PASSWORD_DEFAULT)]);
        $response = $this->checkAccess(['PHP_AUTH_USER' => 'logs', 'PHP_AUTH_PW' => 'test-only-secret']);
        $this->assertSame(200, $response->getStatusCode());
        $this->assertSame('allowed', $response->getContent());
        $this->assertStringContainsString('no-store', $response->headers->get('Cache-Control'));
    }

    public function test_logs_route_has_auth_role_password_and_throttle_middleware()
    {
        $route = app('router')->getRoutes()->match(Request::create('/logs'));
        $middleware = $route->gatherMiddleware();
        $this->assertContains('auth', $middleware);
        $this->assertContains('role:admin,masteradmin', $middleware);
        $this->assertContains(LogViewerPassword::class, $middleware);
        $this->assertContains('throttle:10,1', $middleware);
    }

    private function checkAccess(array $server = [])
    {
        $request = Request::create('/logs?dl=example', 'GET', [], [], [], $server);
        return (new LogViewerPassword)->handle($request, function () {
            return response('allowed');
        });
    }
}