<?php

use App\Models\User;

/**
 * T6.1 — write-heavy booking/payment endpoints are throttled tighter than
 * read-only catalog/routing endpoints (domain.md §8).
 */
test('the booking write limiter is tighter than the catalog read limiter', function () {
    $user = User::factory()->create();
    $token = $user->createToken('test')->plainTextToken;

    $readResponses = collect(range(1, 25))->map(
        fn () => $this->withHeader('Authorization', "Bearer {$token}")->getJson('/api/v1/companies')
    );
    expect($readResponses->every(fn ($response) => $response->status() !== 429))->toBeTrue();

    $writeResponses = collect(range(1, 25))->map(
        fn () => $this->withHeader('Authorization', "Bearer {$token}")->postJson('/api/v1/bookings', [])
    );
    expect($writeResponses->contains(fn ($response) => $response->status() === 429))->toBeTrue();
});

test('a rate-limited api request gets a 429 JSON envelope', function () {
    $user = User::factory()->create();
    $token = $user->createToken('test')->plainTextToken;

    $responses = collect(range(1, 25))->map(
        fn () => $this->withHeader('Authorization', "Bearer {$token}")->postJson('/api/v1/bookings', [])
    );

    $limited = $responses->first(fn ($response) => $response->status() === 429);

    expect($limited)->not->toBeNull();
    $limited->assertJsonStructure(['message']);
});