<?php

namespace Tests\Feature;

use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use PragmaRX\Google2FAQRCode\Google2FA;
use Tests\TestCase;

class VerifyTotpTest extends TestCase
{
    use RefreshDatabase;

    public function test_no_totp_user_returns_false_without_throwing(): void
    {
        $this->assertFalse(User::factory()->create()->verifyTotp('123456'));
    }

    public function test_malformed_secret_returns_false_without_throwing(): void
    {
        // A non-null but invalid secret must not bubble a Google2FA exception.
        $user = User::factory()->create(['two_factor_secret' => 'x', 'two_factor_confirmed_at' => now()]);

        $this->assertFalse($user->verifyTotp('123456'));
    }

    public function test_valid_secret_accepts_the_current_code(): void
    {
        $g = new Google2FA;
        $secret = $g->generateSecretKey();
        $user = User::factory()->create(['two_factor_secret' => $secret, 'two_factor_confirmed_at' => now()]);

        $this->assertTrue($user->verifyTotp($g->getCurrentOtp($secret)));
        $this->assertFalse($user->verifyTotp('000000'));
    }
}