<?php

declare(strict_types=1);

namespace Tests;

use App\Models\User;
use Illuminate\Support\Facades\Http;

/**
 * Fakes the Pireon identity server so tests exercise the real OAuth code paths
 * without any network access.
 */
trait FakesPireon
{
    protected string $pireonServer = 'https://oauth.pireon.test';

    /**
     * @param  array<string, mixed>  $identity  Overrides for the GET /api/user payload.
     * @param  array<string, mixed>  $token  Overrides for the POST /oauth/token payload.
     */
    protected function fakePireon(array $identity = [], array $token = []): void
    {
        Http::fake([
            "{$this->pireonServer}/oauth/token" => Http::response([
                'access_token' => 'fake-access-token',
                'refresh_token' => 'fake-refresh-token',
                'token_type' => 'Bearer',
                'expires_in' => 3600,
                'scope' => 'account:read',
                ...$token,
            ]),

            "{$this->pireonServer}/api/user" => Http::response([
                'id' => 4242,
                'name' => 'Ada Lovelace',
                'email' => 'ada@example.com',
                'is_active' => true,
                'roles' => ['user'],
                'app_roles' => ['admin'],
                'approved_at' => '2026-01-01T00:00:00+00:00',
                'created_at' => '2025-12-01T00:00:00+00:00',
                ...$identity,
            ]),
        ]);
    }

    /**
     * Make the identity server reject whatever token it is handed.
     */
    protected function fakePireonRejectingTokens(): void
    {
        Http::fake([
            "{$this->pireonServer}/api/user" => Http::response(['message' => 'Unauthenticated.'], 401),
        ]);
    }

    /**
     * A local user holding the given roles, as if they had already signed in.
     *
     * @param  array<int, string>|string  $roles
     */
    protected function userWithRoles(array|string $roles, array $attributes = []): User
    {
        $user = User::factory()->create($attributes);
        $user->syncRoles((array) $roles);

        return $user->fresh();
    }

    /**
     * Authenticate API requests as $user by faking the upstream introspection
     * call that the "api" guard performs.
     */
    protected function apiHeadersFor(User $user): array
    {
        Http::fake([
            "{$this->pireonServer}/api/user" => Http::response([
                'id' => $user->oauth_id,
                'name' => $user->name,
                'email' => $user->email,
                'is_active' => true,
                'roles' => ['user'],
                'app_roles' => [],
                'approved_at' => '2026-01-01T00:00:00+00:00',
            ]),
        ]);

        return [
            'Authorization' => 'Bearer token-for-'.$user->oauth_id,
            'Accept' => 'application/json',
        ];
    }
}