CluPilotCloud/tests/Feature/Mail/MailboxSeedMigrationTest.php

<?php

use App\Models\Mailbox;
use App\Services\Secrets\SecretCipher;
use App\Support\Settings;
use Illuminate\Support\Facades\DB;

/**
 * Loads a fresh instance of the seed migration's anonymous class every call.
 * `require`, not `require_once`: PHP re-evaluates the `return new class ...`
 * expression each time, so every call gets its own instance — this is what
 * lets a test call ->up() with config the REAL migrate run (already applied
 * once by RefreshDatabase before any test's own beforeEach) could not have
 * used, to reach branches nothing else exercises.
 */
function loadMailboxSeedMigration(): object
{
    return require database_path('migrations/2026_07_28_100000_seed_mailboxes_from_environment.php');
}

beforeEach(function () {
    config()->set('admin_access.secrets_key', 'base64:'.base64_encode(random_bytes(32)));
});

it('does not copy MAIL_SCHEME through — a Symfony transport only knows smtp and smtps', function () {
    clearMailboxSeed();
    config()->set('mail.mailers.smtp.scheme', 'not-a-symfony-scheme');
    config()->set('mail.mailers.smtp.port', 587);

    loadMailboxSeedMigration()->up();

    expect(Settings::get('mail.encryption'))->toBe('tls');
});

it('derives ssl from port 465, regardless of what scheme is configured', function () {
    clearMailboxSeed();
    config()->set('mail.mailers.smtp.scheme', 'irrelevant');
    config()->set('mail.mailers.smtp.port', 465);

    loadMailboxSeedMigration()->up();

    expect(Settings::get('mail.encryption'))->toBe('ssl')
        ->and(Settings::get('mail.port'))->toBe(465);
});

it('treats config/mail.php\'s own 127.0.0.1 / 2525 defaults as unset, not as a real relay', function () {
    clearMailboxSeed();
    config()->set('mail.mailers.smtp.host', '127.0.0.1');
    config()->set('mail.mailers.smtp.port', 2525);

    loadMailboxSeedMigration()->up();

    // '' / 0 is exactly what MailboxTransport's guards treat as "not
    // configured" — 127.0.0.1 is not '', so it would have sailed straight
    // past the Task 4 guard and quietly dialled localhost instead.
    expect(Settings::get('mail.host'))->toBe('')
        ->and(Settings::get('mail.port'))->toBe(0);
});

it('still stores a deliberately configured host and port untouched', function () {
    clearMailboxSeed();
    config()->set('mail.mailers.smtp.host', 'smtp.example.test');
    config()->set('mail.mailers.smtp.port', 587);

    loadMailboxSeedMigration()->up();

    expect(Settings::get('mail.host'))->toBe('smtp.example.test')
        ->and(Settings::get('mail.port'))->toBe(587);
});

it('carries the vault password across as ciphertext, never decrypting and re-encrypting it', function () {
    clearMailboxSeed();
    config()->set('mail.mailers.smtp.username', 'no-reply@clupilot.com');

    $ciphertext = app(SecretCipher::class)->encrypt('rotated-through-the-console');
    DB::table('app_secrets')->insert([
        'key' => 'mail.password', 'value' => $ciphertext, 'created_at' => now(), 'updated_at' => now(),
    ]);

    loadMailboxSeedMigration()->up();

    $stored = DB::table('mailboxes')->where('key', 'no-reply')->value('password');

    // Byte-for-byte, not just "decrypts to the same plaintext": AES-CBC's
    // random IV means re-encrypting the SAME plaintext produces a DIFFERENT
    // ciphertext string, so this is what actually discriminates "carried
    // as-is" from "decrypted and re-encrypted" — the migration's own claim,
    // never exercised by any test before this one.
    expect($stored)->toBe($ciphertext)
        ->and(app(SecretCipher::class)->decrypt($stored))->toBe('rotated-through-the-console');
});

it('leaves the vault row in the database even after a normal, fully successful carry-over', function () {
    clearMailboxSeed();
    config()->set('mail.mailers.smtp.username', 'no-reply@clupilot.com');

    $ciphertext = app(SecretCipher::class)->encrypt('rotated-through-the-console');
    DB::table('app_secrets')->insert([
        'key' => 'mail.password', 'value' => $ciphertext, 'created_at' => now(), 'updated_at' => now(),
    ]);

    loadMailboxSeedMigration()->up();

    expect(DB::table('app_secrets')->where('key', 'mail.password')->value('value'))->toBe($ciphertext);
});

it('does not destroy a stored vault password when MAIL_USERNAME is empty, because it never lands anywhere', function () {
    // Reproduces the Critical finding: $isConfigured is false for every key
    // when MAIL_USERNAME is empty, so the carry-over never runs — the old
    // code deleted the vault row unconditionally regardless.
    clearMailboxSeed();
    config()->set('mail.mailers.smtp.username', '');

    $ciphertext = app(SecretCipher::class)->encrypt('nowhere-to-go');
    DB::table('app_secrets')->insert([
        'key' => 'mail.password', 'value' => $ciphertext, 'created_at' => now(), 'updated_at' => now(),
    ]);

    loadMailboxSeedMigration()->up();

    expect(DB::table('app_secrets')->where('key', 'mail.password')->value('value'))->toBe($ciphertext)
        ->and(Mailbox::findByKey('no-reply')->getRawOriginal('password'))->toBeNull();
});

it('survives a migrate, rollback, migrate-again cycle without losing the credential', function () {
    // Reproduces the other Critical finding: down() deletes the mailbox
    // rows, which is where the ONLY copy of the password would end up if the
    // vault row had been deleted (the old behaviour) during the first up().
    clearMailboxSeed();
    config()->set('mail.mailers.smtp.username', 'no-reply@clupilot.com');

    $ciphertext = app(SecretCipher::class)->encrypt('rotated-through-the-console');
    DB::table('app_secrets')->insert([
        'key' => 'mail.password', 'value' => $ciphertext, 'created_at' => now(), 'updated_at' => now(),
    ]);

    $migration = loadMailboxSeedMigration();
    $migration->up();
    $migration->down();
    $migration->up();

    expect(DB::table('mailboxes')->where('key', 'no-reply')->value('password'))->toBe($ciphertext);
});

it('is safe to run twice — a migrations-table drift must not crash on the unique key', function () {
    // The real baseline from RefreshDatabase's own migrate is already there
    // (nothing cleared it) — calling up() again must update those rows in
    // place, not attempt a second INSERT under the same key.
    //
    // A plain try/catch, NOT expect(fn () => ...)->not->toThrow(Throwable::class):
    // verified directly that the latter is not reliable here — a closure that
    // unconditionally throws still passes ->not->toThrow(Throwable::class) in
    // this Pest version, which would have made this test pass whether or not
    // the migration actually crashed.
    $threw = null;
    try {
        loadMailboxSeedMigration()->up();
    } catch (Throwable $e) {
        $threw = $e;
    }

    expect($threw)->toBeNull();
    expect(Mailbox::query()->pluck('key')->sort()->values()->all())
        ->toBe(['billing', 'info', 'no-reply', 'office', 'support']);
});

it('un-seeds on rollback, and does not leave the settings cache holding what it just deleted', function () {
    // Against the real baseline again — this is what a real rollback tears
    // down. Warms the cache first the same way a real request would, so a
    // migration that bypassed Settings::forget() (a raw DB delete) and left
    // the Cache::forever() entry behind would still read back the old value.
    expect(Settings::get('mail.purpose.system'))->toBe('no-reply');

    loadMailboxSeedMigration()->down();

    expect(Mailbox::query()->count())->toBe(0)
        ->and(Settings::get('mail.purpose.system'))->toBeNull()
        ->and(Settings::get('mail.host'))->toBeNull();
});

it('prints an operator-visible warning when SECRETS_KEY is missing and a .env password had to be skipped', function () {
    clearMailboxSeed();
    config()->set('admin_access.secrets_key', ''); // canEncrypt false
    config()->set('mail.mailers.smtp.username', 'no-reply@clupilot.com');
    config()->set('mail.mailers.smtp.password', 'dummy-nicht-echt');

    ob_start();
    loadMailboxSeedMigration()->up();
    $output = ob_get_clean();

    expect($output)->toContain('SECRETS_KEY')
        ->toContain('no-reply@clupilot.com');
});

it('stays silent when there is no .env password to skip in the first place', function () {
    clearMailboxSeed();
    config()->set('admin_access.secrets_key', ''); // canEncrypt false
    config()->set('mail.mailers.smtp.username', 'no-reply@clupilot.com');
    config()->set('mail.mailers.smtp.password', '');

    ob_start();
    loadMailboxSeedMigration()->up();
    $output = ob_get_clean();

    expect($output)->toBe('');
});

it('Settings::forget removes the row and does not leave a stale cache entry behind', function () {
    Settings::set('probe.key', 'value');
    expect(Settings::get('probe.key'))->toBe('value');

    Settings::forget('probe.key');

    expect(Settings::get('probe.key'))->toBeNull()
        ->and(DB::table('app_settings')->where('key', 'probe.key')->exists())->toBeFalse();
});