<?php
/**
 * File: tests/unit/Core/AuthMiddlewareRolePermissionTest.php
 *
 * Author: Funky Waddle
 * Date: 2026-09-12
 *
 * Purpose:
 *   Unit tests for AuthMiddleware role and permission checks.
 */
declare(strict_types=1);
namespace Tests\unit\Core;

use SiteWeaver\Core\Repositories\UserRepository;
use SiteWeaver\Core\Services\AuthService;
use SiteWeaver\Core\Services\SessionService;
use SiteWeaver\Core\Models\User;
use SiteWeaver\Core\Models\Role;
use SiteWeaver\Core\Models\Permission;
use SiteWeaver\Core\Middleware\AuthMiddleware;
use SiteWeaver\Core\Config;
use PHPUnit\Framework\TestCase;

final class AuthMiddlewareRolePermissionTest extends TestCase
{
    private AuthService $auth;
    private SessionService $session;
    private UserRepository $user_repo;

    protected function setUp(): void
    {
        if (session_status() !== PHP_SESSION_ACTIVE) {
            session_start();
        }
        $config = new Config();
        $this->session = $this->createMock(SessionService::class);
        $this->user_repo = $this->createMock(UserRepository::class);

        $this->auth = new AuthService($config, $this->session, $this->user_repo);
    }

    protected function tearDown(): void
    {
        if (session_status() === PHP_SESSION_ACTIVE) {
            session_destroy();
        }
    }

    public function testAuthorizeRoleAndPermission(): void
    {
        // Create role and permission
        $role = new Role(1, 'Admin');
        $permEditPage = new Permission(1, 'edit:page');

        // Add permission to role
        $role->addPermission($permEditPage);

        // Register user and assign role
        $user = $this->auth->register('dave', 'dave@example.com', 'pass');
        $user->addRole($role);

        $mockUser = new \SiteWeaver\Core\Models\User(1, 'dave', 'dave@example.com', 'pass');
        $mockUser->setHashedPassword(password_hash('pass', PASSWORD_DEFAULT));

        $this->user_repo->method('findByUsername')->willReturn($user);
        $this->user_repo->method('findById')->willReturn($user);
        $this->session->method('get')->willReturn(1);

        // Log in user
        $this->auth->login('dave', 'pass');

        $middleware = new AuthMiddleware($this->auth);

        // Authorize role - should pass
        $middleware->authorizeRole('Admin');

        // Authorize permission - should pass
        $middleware->authorizePermission('edit:page');

        // Now test missing role
        $this->expectException(\RuntimeException::class);
        $this->expectExceptionMessage('Forbidden: missing role Editor');
        $middleware->authorizeRole('Editor'); // not assigned
    }

    public function testAuthorizePermissionMissing(): void
    {
        // Create user without permissions
        $user = $this->auth->register('erin', 'erin@example.com', 'pass');
        $this->auth->login('erin', 'pass');

        $mockUser = new \SiteWeaver\Core\Models\User(1, 'erin', 'erin@example.com', 'pass');
        $mockUser->setHashedPassword(password_hash('pass', PASSWORD_DEFAULT));

        $this->user_repo->method('findByUsername')->willReturn($mockUser);
        $this->user_repo->method('findById')->willReturn($mockUser);
        $this->session->method('get')->willReturn(1);

        $middleware = new AuthMiddleware($this->auth);

        $this->expectException(\RuntimeException::class);
        $this->expectExceptionMessage('Forbidden: missing permission delete:page');
        $middleware->authorizePermission('delete:page');
    }
}