<?php

use App\Models\User;
use App\Support\Settings;

it('serves the site normally while it is public', function () {
    Settings::set('site.public', true);

    $this->get('/')->assertOk();
    $this->get('/login')->assertOk();
});

it('shows outsiders a placeholder while the site is hidden', function () {
    Settings::set('site.public', false);

    $response = $this->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])->get('/');

    // 503, not 200: a 200 invites search engines to index the placeholder as
    // the site's content, and that is much harder to undo than to prevent.
    $response->assertStatus(503)
        ->assertSee(__('coming_soon.title'))
        ->assertHeader('X-Robots-Tag', 'noindex, nofollow, noarchive')
        ->assertHeader('Retry-After', 3600);

    // The portal is hidden too, not just the marketing page.
    $this->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])->get('/login')->assertStatus(503);
});

it('lets the management VPN through', function () {
    Settings::set('site.public', false);
    config()->set('admin_access.trusted_ranges', ['10.66.0.0/24']);

    $this->withServerVariables(['REMOTE_ADDR' => '10.66.0.4'])->get('/')->assertOk();
    $this->withServerVariables(['REMOTE_ADDR' => '10.66.9.4'])->get('/')->assertStatus(503);
});

it('lets a signed-in operator see the real site from anywhere', function () {
    Settings::set('site.public', false);

    $this->actingAs(operator('Support'))
        ->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
        ->get('/')
        ->assertOk();

    // A customer account is not staff — the portal stays hidden for them.
    $this->actingAs(User::factory()->create())
        ->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
        ->get('/')
        ->assertStatus(503);
});

it('keeps the console and the webhook reachable while hidden', function () {
    Settings::set('site.public', false);

    // Otherwise the switch could only ever be flipped once.
    $this->actingAs(operator('Owner'))
        ->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
        ->get(route('admin.settings'))
        ->assertOk();

    // Stripe must still be able to deliver a paid order: whatever the webhook
    // makes of an empty body, the gate must not be what answers.
    $this->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
        ->post('/webhooks/stripe', [])
        ->assertStatus(200);
});

it('tells crawlers to stay away while hidden', function () {
    Settings::set('site.public', false);

    $this->withServerVariables(['REMOTE_ADDR' => '203.0.113.50'])
        ->get('/robots.txt')
        ->assertOk()
        ->assertSee('Disallow: /');

    Settings::set('site.public', true);
    $this->get('/robots.txt')->assertOk()->assertSee('Allow: /');
});

it('flips visibility from the console, and only with the capability', function () {
    Settings::set('site.public', true);

    Livewire\Livewire::actingAs(operator('Support'))->test(App\Livewire\Admin\Settings::class)
        ->call('toggleSiteVisibility')
        ->assertForbidden();
    expect(Settings::bool('site.public', true))->toBeTrue();

    Livewire\Livewire::actingAs(operator('Owner'))->test(App\Livewire\Admin\Settings::class)
        ->call('toggleSiteVisibility');
    expect(Settings::bool('site.public', true))->toBeFalse();
});

it('keeps serving when the settings table is unavailable', function () {
    // A deploy that runs new code before migrations, or a database blip: the
    // gate must fall back to "public", not take the whole site down with a 500.
    Illuminate\Support\Facades\Schema::drop('app_settings');

    $this->get('/')->assertOk();
});