<?php

use App\Services\EvaluationNavigation;
use Illuminate\Http\Request;

test('local evaluation links send a guest to the existing password-free entry and retain the intended report', function () {
    app()->instance('env', 'payable-testing');
    $this->get('http://127.0.0.1:8005/relatorios?status=approved')->assertRedirect('/avaliar')
        ->assertSessionHas('url.intended', 'http://127.0.0.1:8005/relatorios?status=approved');
    $this->get('http://127.0.0.1:8005/login')->assertRedirect('/avaliar');
});

test('normal application still uses its credential login', function () {
    $this->get('/relatorios')->assertRedirect('/login');
    $this->get('/login')->assertOk();
});

test('evaluation navigation requires both a local client and local host', function () {
    app()->instance('env', 'payable-testing');
    foreach ([['http://127.0.0.1:8005/relatorios', '127.0.0.1', true], ['http://compras.tempo.co.mz/relatorios', '127.0.0.1', false], ['http://localhost:8005/relatorios', '192.0.2.1', false]] as [$url, $ip, $allowed]) {
        $request = Request::create($url, 'GET', [], [], [], ['REMOTE_ADDR' => $ip]);
        expect(EvaluationNavigation::local($request))->toBe($allowed);
    }
    app()->instance('env', 'production');
    expect(EvaluationNavigation::local(Request::create('http://127.0.0.1:8005/relatorios', 'GET', [], [], [], ['REMOTE_ADDR' => '127.0.0.1'])))->toBeFalse();
});

test('evaluation return destination preserves local paths and filters but rejects external or malformed destinations', function ($intended, string $expected) {
    $request = Request::create('http://127.0.0.1:8005/avaliar/entrar', 'POST');
    expect(EvaluationNavigation::returnPath($intended, $request))->toBe($expected);
})->with([
    ['http://127.0.0.1:8005/relatorios?status=approved', '/relatorios?status=approved'],
    ['/requisicoes/1/processo', '/requisicoes/1/processo'],
    [null, '/dashboard'],
    [['invalid'], '/dashboard'],
    ['https://example.test/relatorios', '/dashboard'],
    ['//example.test/relatorios', '/dashboard'],
    ['http://127.0.0.1:8015/relatorios', '/dashboard'],
    ['javascript:alert(1)', '/dashboard'],
    ['/login', '/dashboard'],
    ['/avaliar', '/dashboard'],
    ["/relatorios\r\nLocation: https://example.test", '/dashboard'],
    ['/\\example.test', '/dashboard'],
]);