<?php

namespace Tests\Feature\InternalApi;

use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Modules\Platform\app\Models\Company;
use Modules\Platform\app\Models\LicenseKey;
use Modules\Warehouse\app\Models\Warehouse;
use Tests\TestCase;

/**
 * Covers CompanySummaryController and VerifyInternalApiSignature.
 */
class InternalApiCoverageTest extends TestCase
{
    use RefreshDatabase;

    /**
     * Ensure the internal API rejects empty configuration.
     */
    public function test_internal_api_rejects_when_secret_is_missing(): void
    {
        config(['platform.internal_api_key' => '']);

        $this->getJson('/api/internal/companies')->assertUnauthorized();
    }

    /**
     * Ensure invalid timestamps are rejected.
     */
    public function test_internal_api_rejects_invalid_timestamp(): void
    {
        config(['platform.internal_api_key' => 'testing-secret']);

        $this->withHeaders([
            'X-WMS-Timestamp' => 'not-a-date',
            'X-WMS-Signature' => 'bad',
        ])->getJson('/api/internal/companies')->assertUnauthorized();
    }

    /**
     * Ensure expired timestamps are rejected.
     */
    public function test_internal_api_rejects_expired_timestamp(): void
    {
        config(['platform.internal_api_key' => 'testing-secret']);
        $timestamp = now()->subMinutes(10)->toIso8601String();
        $signature = hash_hmac('sha256', $timestamp.'.', 'testing-secret');

        $this->withHeaders([
            'X-WMS-Timestamp' => $timestamp,
            'X-WMS-Signature' => $signature,
        ])->getJson('/api/internal/companies')->assertUnauthorized();
    }

    /**
     * Ensure incorrect HMAC signatures are rejected.
     */
    public function test_internal_api_rejects_invalid_signature(): void
    {
        config(['platform.internal_api_key' => 'testing-secret']);
        $timestamp = now()->toIso8601String();

        $this->withHeaders([
            'X-WMS-Timestamp' => $timestamp,
            'X-WMS-Signature' => hash_hmac('sha256', $timestamp.'.', 'wrong-secret'),
        ])->getJson('/api/internal/companies')->assertUnauthorized();
    }

    /**
     * Ensure valid signatures return company summaries and relationship counts.
     */
    public function test_internal_api_returns_company_summary_counts(): void
    {
        config(['platform.internal_api_key' => 'testing-secret']);

        $company = Company::create(['name' => 'Summary Tenant', 'slug' => 'summary-tenant']);
        User::factory()->create(['company_id' => $company->id]);
        LicenseKey::issueFor($company, 'Summary licence');
        Warehouse::create(['company_id' => $company->id, 'code' => 'SUM', 'name' => 'Summary Warehouse']);

        $timestamp = now()->toIso8601String();
        $signature = hash_hmac('sha256', $timestamp.'.', 'testing-secret');

        $this->withHeaders([
            'X-WMS-Timestamp' => $timestamp,
            'X-WMS-Signature' => $signature,
        ])->getJson('/api/internal/companies')
            ->assertOk()
            ->assertJsonPath('companies.0.name', 'Summary Tenant')
            ->assertJsonPath('companies.0.users_count', 1)
            ->assertJsonPath('companies.0.warehouses_count', 1)
            ->assertJsonPath('companies.0.license_keys_count', 1);
    }
}