<?php

namespace Modules\InternalApi\tests\Feature;

use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class InternalApiSignatureTest extends TestCase
{
    use RefreshDatabase;

    public function test_internal_api_rejects_missing_signature(): void
    {
        $this->getJson('/api/internal/companies')->assertUnauthorized();
    }

    public function test_internal_api_accepts_valid_signature(): void
    {
        config(['platform.internal_api_key' => 'testing-secret']);
        $timestamp = now()->toIso8601String();
        $body = '';
        $signature = hash_hmac('sha256', $timestamp . '.' . $body, 'testing-secret');

        $this->withHeaders([
            'X-WMS-Timestamp' => $timestamp,
            'X-WMS-Signature' => $signature,
        ])->getJson('/api/internal/companies')->assertOk();
    }
}