<?php

use App\Models\User;
use Illuminate\Support\Facades\Route;
use Modules\Identity\Enums\TokenAbility;

beforeEach(function () {
    Route::middleware(['auth:sanctum', 'fastapi.agent'])
        ->get('/__test/fastapi-agent-only', fn () => response()->json(['ok' => true]));
});

test('a token scoped to exactly the agent abilities is allowed through', function () {
    $agent = User::factory()->create();
    $token = $agent->createToken('fastapi-agent', TokenAbility::fastApiAgentAbilities())->plainTextToken;

    $this->withHeader('Authorization', "Bearer {$token}")
        ->getJson('/__test/fastapi-agent-only')
        ->assertSuccessful();
});

test('a customer token carrying broader abilities is rejected', function () {
    $customer = User::factory()->create();
    $token = $customer->createToken('iphone', TokenAbility::customerAbilities())->plainTextToken;

    $this->withHeader('Authorization', "Bearer {$token}")
        ->getJson('/__test/fastapi-agent-only')
        ->assertForbidden();
});

test('a token missing one of the agent abilities is rejected', function () {
    $user = User::factory()->create();
    $token = $user->createToken('partial', [TokenAbility::RouteRead->value, TokenAbility::BookingCreate->value])->plainTextToken;

    $this->withHeader('Authorization', "Bearer {$token}")
        ->getJson('/__test/fastapi-agent-only')
        ->assertForbidden();
});

test('an unauthenticated request is rejected', function () {
    $this->getJson('/__test/fastapi-agent-only')->assertUnauthorized();
});