<?php

use App\Models\User;

// operator() helper is defined in RbacTest.

it('serves the console on any host when ADMIN_HOSTS is empty (default)', function () {
    config()->set('admin_access.hosts', []);

    $this->actingAs(operator('Owner'))
        ->get('http://app.dev.clupilot.com/admin')
        ->assertOk();
});

it('404s the console on a hostname that is not allowed', function () {
    config()->set('admin_access.hosts', ['admin.dev.clupilot.com']);

    // A PUBLIC hostname must not even hint that a console exists here.
    $this->actingAs(operator('Owner'))
        ->get('http://app.dev.clupilot.com/admin')
        ->assertNotFound();

    $this->actingAs(operator('Owner'))
        ->get('http://www.dev.clupilot.com/admin/hosts')
        ->assertNotFound();
});

it('serves the console on an allowed hostname', function () {
    config()->set('admin_access.hosts', ['admin.dev.clupilot.com', '10.10.90.185']);

    $this->actingAs(operator('Owner'))
        ->get('http://admin.dev.clupilot.com/admin')
        ->assertOk();

    $this->actingAs(operator('Owner'))
        ->get('http://10.10.90.185/admin')
        ->assertOk();
});

it('404s before revealing a login redirect to guests on a public host', function () {
    config()->set('admin_access.hosts', ['admin.dev.clupilot.com']);

    // Not a redirect to /login — that would confirm the console's existence.
    $this->get('http://www.dev.clupilot.com/admin')->assertNotFound();
});

it('keeps the customer portal reachable on public hosts', function () {
    config()->set('admin_access.hosts', ['admin.dev.clupilot.com']);
    $user = User::factory()->create();

    $this->actingAs($user)->get('http://app.dev.clupilot.com/dashboard')->assertOk();
    $this->get('http://www.dev.clupilot.com/')->assertOk();
});