<?php

namespace Tests\Feature;

use App\Models\User;
use App\Services\PortalProfileAccess;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Crypt;
use PragmaRX\Google2FA\Google2FA;
use Tests\TestCase;

class CountryCandidateMfaTest extends TestCase
{
    use RefreshDatabase;

    public function test_only_a_valid_fortify_challenge_records_recent_mfa_without_the_profile_module(): void
    {
        $this->withoutVite();
        config(['portal.profile_access_enabled' => false]);
        $actor = User::factory()->create();
        $totp = new Google2FA;
        $secret = $totp->generateSecretKey();
        $actor->forceFill(['two_factor_secret' => Crypt::encrypt($secret), 'two_factor_confirmed_at' => now()])->save();
        $this->post('/login', ['email' => $actor->email, 'password' => 'password'])->assertRedirect('/two-factor-challenge');
        $this->assertGuest();
        $this->assertFalse(app(PortalProfileAccess::class)->mfa($actor));
        $this->post('/two-factor-challenge', ['code' => 'not-a-code'])->assertSessionHasErrors('code');
        $this->assertGuest();
        $this->assertFalse(app(PortalProfileAccess::class)->mfa($actor));
        $this->post('/two-factor-challenge', ['code' => $totp->getCurrentOtp($secret)])->assertRedirect();
        $this->assertAuthenticatedAs($actor);
        $this->assertTrue(app(PortalProfileAccess::class)->mfa($actor));
        $this->post('/logout')->assertRedirect('/');
        $this->assertGuest();
        $this->assertFalse(app(PortalProfileAccess::class)->mfa($actor));
    }
}