<?php

it('routes and trait use forbidden responses for permission and ownership denials', function (): void {
    $routeTrait = file_get_contents(app_path('traits/route_t.php'));
    expect($routeTrait)->not->toBeFalse();
    expect($routeTrait)->toContain('protected function emitForbidden(array $permissions): void');
    expect($routeTrait)->toContain('$response->forbidden($this->normalizePermissionKeys($permissions));');
    expect($routeTrait)->toContain('$this->emitForbidden($missingPermissions);');

    $selfserveRoute = file_get_contents(app_path('routes/departmentSelfserveVehicleConditionsRoute.php'));
    expect($selfserveRoute)->not->toBeFalse();
    expect($selfserveRoute)->toContain("forbidden(['list_department_selfserve_vehicle_conditions', 'list_own_department_selfserve_vehicle_conditions'])");
    expect($selfserveRoute)->toContain('forbidDepartmentAccess(');

    $ordersRoute = file_get_contents(app_path('routes/ordersRoute.php'));
    expect($ordersRoute)->not->toBeFalse();
    expect($ordersRoute)->toContain('$response->forbidden([$permission_other->permission]);');
    expect($ordersRoute)->not->toContain("\$response->error('You do not have permission to edit this order', 403);");
});
