<?php

use App\Models\User;
use Illuminate\Support\Facades\Hash;

// Post to Fortify with a matching CSRF token in session + body (the browser sends
// a real token; CSRF itself is not what these tests exercise).
function loginPost(array $data)
{
    return test()
        ->withSession(['_token' => 'test-token'])
        ->post('/login', array_merge(['_token' => 'test-token'], $data));
}

it('renders the login page', function () {
    $this->get('/login')
        ->assertOk()
        ->assertSee('CluPilot')
        ->assertSee('name="email"', false);
});

it('logs in with valid credentials and redirects to the dashboard', function () {
    $user = User::factory()->create(['password' => Hash::make('secret-password')]);

    loginPost(['email' => $user->email, 'password' => 'secret-password'])
        ->assertRedirect('/dashboard');

    $this->assertAuthenticatedAs($user);
});

it('rejects invalid credentials', function () {
    $user = User::factory()->create(['password' => Hash::make('secret-password')]);

    loginPost(['email' => $user->email, 'password' => 'wrong-password'])
        ->assertSessionHasErrors('email');

    $this->assertGuest();
});

it('throttles repeated failed attempts', function () {
    $user = User::factory()->create(['password' => Hash::make('secret-password')]);

    // Exceed the 5/min login limiter.
    foreach (range(1, 6) as $ignored) {
        loginPost(['email' => $user->email, 'password' => 'wrong-password']);
    }

    // Once throttled, even correct credentials are refused.
    loginPost(['email' => $user->email, 'password' => 'secret-password']);

    $this->assertGuest();
});