<?php

it('applies separate IP and identity throttles to public customer registration', function (): void {
    $code = preg_replace(
        '/\s+/',
        ' ',
        (string)file_get_contents(app_path('routes/authRoute.php'))
    );

    expect($code)->toContain("\$this->post('/auth/register/cvr', function () {");
    expect($code)->toContain('$this->requireRecaptcha();');
    expect($code)->toContain("requirePublicRegistrationRateLimit('customer_ip', 'all')");
    expect($code)->toContain("'customer_identity', 'cvr:' . (string)\$cvr . ':phone:' . \$companyPhone, 3, 60 * 60, false");
    expect($code)->toContain("'enabled' => defined('redis')");
    expect($code)->toContain('incrementWithExpiration($key, $windowSeconds)');
    expect($code)->toContain("Registration protection is temporarily unavailable.");
    expect($code)->not->toContain("\$attempts = (int)(\$redis->get(\$key)");
});