api/services/nginx/app/tests/Unit/Subusers/SubusersRouteManagementContractTest.php

<?php

it('exposes chauffeur management endpoints on the subusers route', function (): void {
    $routeFile = app_path('routes/subusersRoute.php');
    expect(is_file($routeFile))->toBeTrue();

    $code = (string)file_get_contents($routeFile);
    $normalized = preg_replace('/\s+/', ' ', $code);

    expect($normalized)->toContain("\$this->post('/subusers/invite', function () {");
    expect($normalized)->toContain("\$this->post('/subusers/invite/resend', function () {");
    expect($normalized)->toContain("\$this->get('/superuser/subusers', function () {");
    expect($normalized)->toContain("\$this->post('/superuser/subusers/invite', function () {");
    expect($normalized)->toContain("\$this->post('/superuser/subusers/invite/resend', function () {");
    expect($normalized)->toContain("\$this->put('/subusers', function () {");
    expect($normalized)->toContain("\$this->put('/subusers/me', function () {");
    expect($normalized)->toContain("\$this->get('/subusers/me/verification', function () {");
    expect($normalized)->toContain("\$this->post('/subusers/me/verification/{channel}/send', function () {");
    expect($normalized)->toContain("\$this->post('/subusers/me/verification/{channel}/verify', function () {");
    expect($normalized)->toContain("\$this->post('/superuser/subusers/{subuser_id}/verification/{channel}/send', function () {");
    expect($normalized)->toContain("\$this->patch('/superuser/subusers/{subuser_id}/verification/{channel}', function () {");
    expect($normalized)->toContain("\$this->post('/superuser/subusers/{subuser_id}/password-guide/{channel}/send', function () {");
    expect($normalized)->toContain("\$this->post('/superuser/subusers/{subuser_id}/login-link/{channel}/send', function () {");
    expect($normalized)->toContain("\$this->post('/subusers/{subuser_id}/verification/{channel}/send', function () {");
    expect($normalized)->toContain("\$this->post('/subusers/password-reset/request', function () {");
    expect($normalized)->toContain("\$this->get('/subusers/password-reset/validate', function () {");
    expect($normalized)->toContain("\$this->post('/subusers/password-reset/set', function () {");
    expect($normalized)->toContain("\$this->post('/subusers/me/password', function () {");
    expect($normalized)->toContain("\$this->get('/subusers/access-decision', function () {");
    expect($normalized)->toContain("\$this->post('/subusers/access-decision', function () {");
});

it('delivers purpose-bound SMS notifications for grant requests and decisions', function (): void {
    $code = (string)file_get_contents(app_path('routes/subusersRoute.php'));
    $normalized = preg_replace('/\s+/', ' ', $code);

    expect($normalized)->toContain('notifyCustomerOfGrantRequest(');
    expect($normalized)->toContain('PURPOSE_GRANT_APPROVE');
    expect($normalized)->toContain('PURPOSE_GRANT_DENY');
    expect($normalized)->toContain('notifySubuserGrantDecision(');
    expect($normalized)->toContain("'decision_notification' => \$delivery");
    expect($normalized)->toContain("'customer_notification' => \$customerNotification");
});

it('keeps forgot-password responses generic and protects reset tokens by purpose', function (): void {
    $code = (string)file_get_contents(app_path('routes/subusersRoute.php'));
    $normalized = preg_replace('/\s+/', ' ', $code);

    expect($normalized)->toContain('Hvis chaufførkontoen findes, er et nulstillingslink sendt.');
    expect($normalized)->toContain('PURPOSE_PASSWORD_RESET');
    expect($normalized)->toContain("account_deletion_service::principalIsBlocked('subuser'");
    expect($normalized)->toContain('invalidateCurrentSetupToken()');
});

it('includes grant management fields in the subusers payload builder', function (): void {
    $routeFile = app_path('routes/subusersRoute.php');
    expect(is_file($routeFile))->toBeTrue();

    $code = (string)file_get_contents($routeFile);
    $normalized = preg_replace('/\s+/', ' ', $code);

    expect($normalized)->toContain("'grant_id' =>");
    expect($normalized)->toContain("'grant_enabled' =>");
    expect($normalized)->toContain("'grant_note' =>");
    expect($normalized)->toContain("'grant_permissions' =>");
    expect($normalized)->toContain("'setup_required' =>");
    expect($normalized)->toContain("'invite_accepted' =>");
    expect($normalized)->toContain("'can_resend_invite' =>");
    expect($normalized)->toContain("'profile_editable_by_manager' => false");
    expect($normalized)->toContain("'access_state' =>");
    expect($normalized)->toContain("'email_verified' =>");
    expect($normalized)->toContain("'phone_verified' =>");
    expect($normalized)->toContain("'verification_state' =>");
});

it('resolves subuser customer names without external lookups during list requests', function (): void {
    $routeFile = app_path('routes/subusersRoute.php');
    expect(is_file($routeFile))->toBeTrue();

    $code = (string)file_get_contents($routeFile);
    $normalized = preg_replace('/\s+/', ' ', $code);

    expect($normalized)->toContain('getCustomerNames($customerNumbers, false)');
    expect($normalized)->toContain('$customerName = $this->resolveCustomerName($customerNumber);');
    expect($normalized)->toContain('buildSubuserManagementPayload($subuser, $customerNumber, $customerName)');
    expect($normalized)->not->toContain("'customer_name' => (new users_o())->getCustomerName(\$customerNumber)");
    expect($normalized)->not->toContain("'name' => (new users_o())->getCustomerName((int)\$grant['billing_customer_number'])");
});

it('links grant disable operations to SUBUSERS_DELETE for own-customer managers', function (): void {
    $routeFile = app_path('routes/subusersRoute.php');
    expect(is_file($routeFile))->toBeTrue();

    $code = (string)file_get_contents($routeFile);
    $normalized = preg_replace('/\s+/', ' ', $code);

    expect($normalized)->toContain("definePermission('delete_own_subusers', subusers_permission_node_key::SUBUSERS_DELETE)");
    expect($normalized)->toContain("requireManagedCustomerScope(subusers_permission_node_key::SUBUSERS_DELETE, \$targetCustomer);");
});

it('parses custom grant writes through raw permissions instead of template expansion', function (): void {
    $routeFile = app_path('routes/subusersRoute.php');
    expect(is_file($routeFile))->toBeTrue();

    $code = (string)file_get_contents($routeFile);
    $normalized = preg_replace('/\s+/', ' ', $code);

    expect($normalized)->toContain('expandTemplateForWritePayload($templateKey)');
});

it('prevents own-customer managers from editing driver-owned account profiles', function (): void {
    $routeFile = app_path('routes/subusersRoute.php');
    expect(is_file($routeFile))->toBeTrue();

    $code = (string)file_get_contents($routeFile);
    $normalized = preg_replace('/\s+/', ' ', $code);

    expect($normalized)->toContain("Customers can only manage subuser grants. Drivers own their account profile.");
});

it('scopes superuser invite resend to a selected customer grant', function (): void {
    $routeFile = app_path('routes/subusersRoute.php');
    expect(is_file($routeFile))->toBeTrue();

    $code = (string)file_get_contents($routeFile);
    $normalized = preg_replace('/\s+/', ' ', $code);

    expect($normalized)->toContain("\$this->post('/superuser/subusers/invite/resend', function () {");
    expect($normalized)->toContain("self::requireParameters(['id', 'customer_number']);");
    expect($normalized)->toContain("\$customerNumber = (int)self::getParameter('customer_number');");
    expect($normalized)->toContain("getGrantForSubuserAndCustomer(\$subuserId, \$customerNumber, true)");
    expect($normalized)->toContain("Subuser grant not found for selected customer");
    expect($normalized)->toContain("'subuser' => \$this->buildSubuserManagementPayload(\$subuser, \$customerNumber)");
    expect($normalized)->toContain("'grant' => \$grant->asArray()");
});

it('only allows invite resend while setup is still pending', function (): void {
    $routeFile = app_path('routes/subusersRoute.php');
    expect(is_file($routeFile))->toBeTrue();

    $code = (string)file_get_contents($routeFile);
    $normalized = preg_replace('/\s+/', ' ', $code);

    expect($normalized)->toContain("Driver account already accepted the invitation.");
    expect($normalized)->toContain("if (!\$subuser->requiresSetup()) {");
});

it('requires own subuser permissions for classic customer users in managed customer scope', function (): void {
    $routeFile = app_path('routes/subusersRoute.php');
    expect(is_file($routeFile))->toBeTrue();

    $code = (string)file_get_contents($routeFile);
    $normalized = preg_replace('/\s+/', ' ', $code);

    expect($normalized)->toContain("\$user = \$auth->get_user(); if (\$user !== false) { \$customerNumber = (int)\$user->customer_number->value(); if (\$customerNumber <= 0) { \$response->error('Unauthorized', 401); } if (\$targetCustomerNumber !== null && \$customerNumber !== (int)\$targetCustomerNumber) { \$this->emitForbidden([\$permission]); } self::requirePermission(\$permission); return \$customerNumber;");
});