<?php

use workfeed\config\workfeed_api_url_c;

it('uses company-scoped workfeed endpoints and raw Authorization header', function (): void {
    $classFile = app_path('classes/workfeed.php');
    $content = file_get_contents($classFile);

    expect($content)->not->toBeFalse();
    expect($content)->toContain('/companies/');
    expect($content)->toContain("'Authorization: '");
    expect($content)->not->toContain('Authorization: Bearer');
    expect($content)->toContain('/employees');
    expect($content)->toContain('/shifts');
    expect($content)->toContain('/departments');
});

it('normalizes documented shift query parameters', function (): void {
    $classFile = app_path('classes/workfeed.php');
    $content = file_get_contents($classFile);

    expect($content)->not->toBeFalse();
    expect($content)->toContain('startFrom');
    expect($content)->toContain('startTo');
    expect($content)->toContain('employeeID');
    expect($content)->toContain('Workfeed shift query requires startFrom.');
    expect($content)->toContain('Workfeed shift query requires startTo.');
});


it('only trusts documented workfeed api hosts', function (): void {
    expect(workfeed_api_url_c::isTrustedApiUrl('https://api.workfeed.io'))->toBeTrue();
    expect(workfeed_api_url_c::isTrustedApiUrl('https://europe-west1-production-eu-327a3.cloudfunctions.net/api'))->toBeTrue();
    expect(workfeed_api_url_c::isTrustedApiUrl('api.workfeed.io'))->toBeTrue();

    expect(workfeed_api_url_c::isTrustedApiUrl('http://api.workfeed.io'))->toBeFalse();
    expect(workfeed_api_url_c::isTrustedApiUrl('https://169.254.169.254/latest/meta-data'))->toBeFalse();
    expect(workfeed_api_url_c::isTrustedApiUrl('https://localhost'))->toBeFalse();
    expect(workfeed_api_url_c::isTrustedApiUrl('https://api.workfeed.io.example.com'))->toBeFalse();
    expect(workfeed_api_url_c::isTrustedApiUrl('https://api.workfeed.io:444'))->toBeFalse();
    expect(workfeed_api_url_c::isTrustedApiUrl('https://user:pass@api.workfeed.io'))->toBeFalse();
});
