<?php

use App\Models\Customer;
use App\Models\Operator;
use App\Models\User;
use Illuminate\Support\Facades\Auth;

/**
 * Same shape as tests/Feature/Admin/OperatorLogoutTest.php, the other side of
 * the same bug family: in shared-host mode (this suite's default, ADMIN_HOSTS=""
 * — also this VM's own mode) the portal and console guards keep their login
 * key in ONE session. EnsureCustomerActive used session()->invalidate() to
 * sign a suspended or closed customer out — flush() + migrate(true) — which
 * discarded every attribute in the session, not only the 'web' guard's, so it
 * silently signed an operator elsewhere in that same browser out of the
 * console too.
 */
it("suspending a portal customer does not sign an operator out of a console session sharing the same browser", function () {
    $operator = Operator::factory()->role('Owner')->create();
    $user = User::factory()->create();
    Customer::factory()->create(['email' => $user->email, 'user_id' => $user->id, 'status' => 'suspended']);

    // Auth::guard(...)->login() rather than actingAs(): actingAs() only sets
    // an in-memory user on the guard object, it never writes to the session —
    // so it cannot tell session()->invalidate() and session()->regenerate()
    // apart. login() does the same session write a real sign-in performs.
    Auth::guard('operator')->login($operator);
    Auth::guard('web')->login($user);

    $this->get(route('dashboard'))->assertRedirect(route('login'));

    // Auth::guard('operator') is still the SAME cached guard instance from
    // the login() call above — its check() would say "authenticated" from
    // its own in-memory $user property regardless of what happened to the
    // session, which is exactly the blind spot that would make this
    // assertion pass whether the fix is there or not. forgetGuards() drops
    // that cache, forcing the next guard() call to rebuild from the CURRENT
    // session data — the same thing a genuinely new request would do.
    Auth::forgetGuards();

    expect(Auth::guard('web')->check())->toBeFalse()
        ->and(Auth::guard('operator')->check())->toBeTrue()
        ->and(Auth::guard('operator')->id())->toBe($operator->id);
});