<?php

namespace Tests\Feature;

use App\Models\User;
use App\Models\WebauthnCredential;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Hash;
use Tests\TestCase;

class ResetAdminCommandTest extends TestCase
{
    use RefreshDatabase;

    public function test_resets_password_and_disables_2fa(): void
    {
        $user = User::factory()->create([
            'email' => 'admin@clusev.local',
            'two_factor_secret' => 'x', 'two_factor_confirmed_at' => now(),
        ]);
        $user->replaceRecoveryCodes();
        WebauthnCredential::create(['user_id' => $user->id, 'name' => 'k', 'credential_id' => 'cid', 'public_key' => '{}', 'sign_count' => 0]);

        $this->artisan('clusev:reset-admin', ['--email' => 'admin@clusev.local', '--password' => 'BrandNew1234', '--disable-2fa' => true])
            ->assertExitCode(0);

        $user->refresh();
        $this->assertTrue(Hash::check('BrandNew1234', $user->password));
        $this->assertNull($user->two_factor_secret);
        $this->assertNull($user->two_factor_confirmed_at);
        $this->assertFalse($user->hasRecoveryCodes());
        $this->assertFalse($user->hasWebauthnCredentials());
    }

    public function test_unknown_email_fails(): void
    {
        $this->artisan('clusev:reset-admin', ['--email' => 'nope@x.test'])->assertExitCode(1);
    }
}