<?php

use App\Models\Operator;
use App\Models\User;
use Illuminate\Support\Facades\Auth;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;

/**
 * R21 — the console and the portal share no identity.
 *
 * Not a style rule. A shared sign-in page showed an operator a registration
 * link with a 404 behind it, and that was not a display fault: it was two
 * different groups of people in one table.
 */

it('leaves no role or permission on the web guard', function () {
    expect(Role::where('guard_name', 'web')->count())->toBe(0)
        ->and(Permission::where('guard_name', 'web')->count())->toBe(0);
});

it('gives the User model no way to hold a role', function () {
    expect(method_exists(User::class, 'hasRole'))->toBeFalse()
        ->and(method_exists(User::class, 'isOperator'))->toBeFalse();
});

it('cannot authenticate an operator on the web guard', function () {
    $operator = Operator::factory()->role('Owner')->create(['password' => 'operator-passwort']);

    expect(Auth::guard('web')->attempt([
        'email' => $operator->email, 'password' => 'operator-passwort',
    ]))->toBeFalse();
});

it('cannot authenticate a portal user on the operator guard', function () {
    $user = User::factory()->create(['password' => 'kunden-passwort']);

    expect(Auth::guard('operator')->attempt([
        'email' => $user->email, 'password' => 'kunden-passwort',
    ]))->toBeFalse();
});

it('shares no authentication route between the two sides', function () {
    $shared = (new ReflectionClass(App\Http\Middleware\RestrictAdminHost::class))
        ->getConstant('SHARED');

    foreach (['login', 'logout', 'register', 'two-factor-challenge'] as $path) {
        expect($shared)->not->toContain($path);
    }
});

it('has no console-aware login response left, because there is nothing to disambiguate', function () {
    // A third class lived here too: ConsoleAwareTwoFactorLoginResponse, Fortify's
    // TwoFactorLoginResponse-contract sibling of ConsoleAwareLoginResponse, for
    // the two-factor completion path (see the deletion in 8f8a0ad — every one of
    // the three landing-disambiguation classes went together, not just these two).
    // Checking two of the three would let the third quietly come back.
    expect(class_exists(App\Http\Responses\ConsoleAwareLoginResponse::class))->toBeFalse()
        ->and(class_exists(App\Http\Responses\ConsoleAwareTwoFactorLoginResponse::class))->toBeFalse()
        ->and(class_exists(App\Http\Responses\LandsWhereSignedIn::class))->toBeFalse();
});