<?php

declare(strict_types=1);

usesApiSuite();

function wash_certificate_download_legacy_booking(int $customerNumber, int $departmentId, array $attributes = []): array
{
    return api_fixtures()->createLegacyBooking(array_merge([
        'customer_number' => $customerNumber,
        'department' => $departmentId,
        'washCertificateStatus' => 'pending',
        'status' => 'pending',
    ], $attributes));
}

it('lets customer accounts reach their own wash certificate download without the download permission', function (): void {
    api_test_covers('POST /user/bookings/washcertificate/download', 'customer-access');

    $session = api_fixtures()->createUserSession(['user']);
    $department = api_fixtures()->createDepartment(['name' => 'Wash Certificate Customer Department']);
    $booking = wash_certificate_download_legacy_booking(
        (int)$session['user']['customer_number'],
        (int)$department['id']
    );

    $response = api_client()->post('/user/bookings/washcertificate/download', [
        'id' => (int)$booking['id'],
    ], $session['headers']);

    $response
        ->assertStatus(400)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMessage('Wash certificate has not been issued yet');

    expect($response->body)->not->toContain('download_own_wash_certificate');
});

it('keeps customer wash certificate downloads scoped to their own bookings', function (): void {
    api_test_covers('POST /user/bookings/washcertificate/download', 'customer-access');

    $session = api_fixtures()->createUserSession(['user']);
    $otherCustomer = api_fixtures()->createUser(['display_name' => 'Other Wash Certificate Customer']);
    $department = api_fixtures()->createDepartment(['name' => 'Other Wash Certificate Department']);
    $booking = wash_certificate_download_legacy_booking(
        (int)$otherCustomer['customer_number'],
        (int)$department['id']
    );

    $response = api_client()->post('/user/bookings/washcertificate/download', [
        'id' => (int)$booking['id'],
    ], $session['headers']);

    $response
        ->assertStatus(400)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMessage('You are not allowed to download this wash certificate');

    expect($response->body)->not->toContain('download_own_wash_certificate');
});

it('lets customer accounts reach the legacy wash certificate pdf download gate', function (): void {
    api_test_covers('GET /bookings/download_pdf', 'customer-access');

    $session = api_fixtures()->createUserSession(['user']);
    $otherCustomer = api_fixtures()->createUser(['display_name' => 'Legacy PDF Other Customer']);
    $department = api_fixtures()->createDepartment(['name' => 'Legacy PDF Department']);
    $booking = wash_certificate_download_legacy_booking(
        (int)$otherCustomer['customer_number'],
        (int)$department['id']
    );

    $response = api_client()->get(
        '/bookings/download_pdf?id=' . (int)$booking['id'],
        $session['headers']
    );

    $response
        ->assertStatus(400)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMessage('You are not allowed to download this wash certificate');

    expect($response->body)->not->toContain('download_own_wash_certificate');
});
