<?php

it('registers the superuser security endpoints and permissions', function (): void {
    $content = file_get_contents(app_path('routes/superuserSecurityRoute.php'));

    expect($content)->not->toBeFalse();
    expect($content)->toContain('/superuser/system/security/summary');
    expect($content)->toContain('/superuser/system/security/settings');
    expect($content)->toContain('/superuser/system/security/firewall-rules');
    expect($content)->toContain('/superuser/system/security/firewall-rules/{id}');
    expect($content)->toContain('/superuser/system/security/incidents');
    expect($content)->toContain('/superuser/system/security/incidents/{id}');
    expect($content)->toContain('/superuser/system/security/incidents/{id}/notes');
    expect($content)->toContain("requireClassicSuperuserPermission('superuser_security_view')");
    expect($content)->toContain("requireClassicSuperuserPermission('superuser_security_settings_manage')");
    expect($content)->toContain("requireClassicSuperuserPermission('superuser_security_firewall_manage')");
    expect($content)->toContain("requireClassicSuperuserPermission('superuser_security_incidents_manage')");
    expect($content)->toContain("'superuser_security_limits_exempt' => 'Exempt requests from observe-mode security limit incidents'");
});

it('keeps superuser security controls unavailable to subuser sessions', function (): void {
    $content = file_get_contents(app_path('routes/superuserSecurityRoute.php'));

    expect($content)->not->toBeFalse();
    expect($content)->toContain('private function requireClassicSuperuserPermission(string $permission): bool');
    expect($content)->toContain('get_subuser() !== false');
    expect($content)->toContain("Subuser sessions cannot manage security controls.");
    expect($content)->toContain('return $this->requirePermission($permission);');
    expect($content)->not->toContain("requirePermission('superuser_security_");
});

it('wires request and domain event observation into the backend', function (): void {
    $routeTrait = file_get_contents(app_path('traits/route_t.php'));
    $authRoute = file_get_contents(app_path('routes/authRoute.php'));
    $bookingRoute = file_get_contents(app_path('routes/orderBookingRoute.php'));
    $vehiclesRoute = file_get_contents(app_path('routes/vehiclesRoute.php'));

    expect($routeTrait)->toContain('security_policy_service');
    expect($routeTrait)->toContain('inspectRequest($route, $method)');
    expect($authRoute)->toContain('observeLoginFailure(');
    expect($bookingRoute)->toContain('observeBookingCreated');
    expect($vehiclesRoute)->toContain('observeVehicleCreated');
});

it('defines persistent security tables for runtime and api tests', function (): void {
    $runtimeSchema = file_get_contents(app_path('classes/security_schema_bootstrap.php'));
    $testSchema = file_get_contents(app_path('tests/Support/Api/ApiSchemaBootstrap.php'));

    foreach ([
        'security_firewall_rules',
        'security_policy_rules',
        'security_policy_events',
        'security_incidents',
        'security_incident_notes',
    ] as $table) {
        expect($runtimeSchema)->toContain($table);
        expect($testSchema)->toContain($table);
    }
});

it('documents superuser security endpoints in openapi', function (): void {
    $content = file_get_contents(app_path('openapi.yaml'));

    expect($content)->not->toBeFalse();
    expect($content)->toContain('/superuser/system/security/summary:');
    expect($content)->toContain('/superuser/system/security/settings:');
    expect($content)->toContain('/superuser/system/security/firewall-rules:');
    expect($content)->toContain('/superuser/system/security/firewall-rules/{id}:');
    expect($content)->toContain('/superuser/system/security/incidents:');
    expect($content)->toContain('/superuser/system/security/incidents/{id}:');
    expect($content)->toContain('/superuser/system/security/incidents/{id}/notes:');
    expect($content)->toContain('SuperuserSecuritySettingsUpdateRequest');
    expect($content)->toContain('SuperuserSecurityFirewallRuleMutation');
    expect($content)->toContain('SuperuserSecurityIncidentResponse');
});