<?php

use App\Enums\UserRole;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Gate;

uses(RefreshDatabase::class);

it('allows only administrators through production tooling gates', function (): void {
    $admin = User::factory()->create([
        'role' => UserRole::ADMIN,
    ]);
    $moderator = User::factory()->create([
        'role' => UserRole::MODERATOR,
    ]);
    $user = User::factory()->create([
        'role' => UserRole::USER,
    ]);

    expect(Gate::forUser($admin)->allows('viewApiDocs'))->toBeTrue()
        ->and(Gate::forUser($moderator)->allows('viewApiDocs'))->toBeFalse()
        ->and(Gate::forUser($user)->allows('viewApiDocs'))->toBeFalse()
        ->and(Gate::allows('viewApiDocs'))->toBeFalse();
});

it('does not expose a queue dashboard', function (): void {
    $this->get('/horizon')->assertNotFound();
});

it('protects the scramble documentation outside local environments', function (): void {
    $user = User::factory()->create([
        'role' => UserRole::USER,
    ]);

    $this->get('/docs/api')->assertForbidden();

    $this->actingAs($user)
        ->get('/docs/api')
        ->assertForbidden();
});