<?php

use App\Models\Mailbox;
use Illuminate\Contracts\Encryption\DecryptException;
use Illuminate\Support\Facades\DB;

beforeEach(function () {
    config()->set('admin_access.secrets_key', 'base64:'.base64_encode(random_bytes(32)));
});

it('stores the password encrypted and never in the clear', function () {
    $box = Mailbox::factory()->create(['key' => 'support', 'password' => 'sehr-geheim']);

    $stored = DB::table('mailboxes')->where('id', $box->id)->value('password');

    expect($stored)->not->toContain('sehr-geheim')
        ->and($box->fresh()->password)->toBe('sehr-geheim');
});

it('is keyed to SECRETS_KEY — rotating it makes the password unreadable', function () {
    // The POSITIVE proof, and the one that discriminates.
    $box = Mailbox::factory()->create(['password' => 'geheim']);

    config()->set('admin_access.secrets_key', 'base64:'.base64_encode(random_bytes(32)));

    expect(fn () => $box->fresh()->password)
        ->toThrow(DecryptException::class);
});

it('is NOT keyed to APP_KEY — rotating that leaves mail working', function () {
    $box = Mailbox::factory()->create(['password' => 'bleibt-lesbar']);

    config()->set('app.key', 'base64:'.base64_encode(random_bytes(32)));

    // forgetInstance is what makes this test mean anything — see above.
    app()->forgetInstance('encrypter');

    expect($box->fresh()->password)->toBe('bleibt-lesbar');
});

it('falls back to the address when no separate username is given', function () {
    $box = Mailbox::factory()->create([
        'address' => 'support@clupilot.com',
        'username' => null,
    ]);

    expect($box->smtpUsername())->toBe('support@clupilot.com');
});

it('finds a mailbox by its key', function () {
    Mailbox::factory()->create(['key' => 'billing']);

    expect(Mailbox::findByKey('billing'))->not->toBeNull()
        ->and(Mailbox::findByKey('gibtsnicht'))->toBeNull();
});

it('auto-assigns a uuid and routes by it', function () {
    $box = Mailbox::factory()->create();

    expect($box->uuid)->not->toBeNull()
        ->and($box->getRouteKeyName())->toBe('uuid');
});