<?php

use App\Models\User;
use function Pest\Laravel\actingAs;

uses(\Illuminate\Foundation\Testing\RefreshDatabase::class);

it('API-OPTIONS-Preflight von app.dev gibt 204 zurück', function () {
    $this->withHeaders([
        'Origin' => 'https://app.dev.lernschiff.com',
        'Access-Control-Request-Method' => 'GET',
        'Access-Control-Request-Headers' => 'X-XSRF-TOKEN',
    ])->options('/api/v1/me')->assertStatus(204)
      ->assertHeader('Access-Control-Allow-Origin', 'https://app.dev.lernschiff.com')
      ->assertHeader('Access-Control-Allow-Credentials', 'true');
});

it('API-Call mit Cookie-Session von app.dev→api.dev gibt 200 zurück', function () {
    $user = User::factory()->create();
    actingAs($user)
        ->withHeaders(['Origin' => 'https://app.dev.lernschiff.com'])
        ->getJson('/api/v1/me')
        ->assertOk()
        ->assertHeader('Access-Control-Allow-Origin', 'https://app.dev.lernschiff.com');
});