<?php

declare(strict_types=1);

/*
 * This file is part of the Ferienpass package.
 *
 * (c) Richard Henkenjohann <richard@ferienpass.online>
 *
 * For more information visit the project website <https://ferienpass.online>
 * or the documentation under <https://docs.ferienpass.online>.
 */

namespace Ferienpass\CoreBundle\Tests\Security\Voter;

use Ferienpass\CoreBundle\Entity\Consent;
use Ferienpass\CoreBundle\Entity\User;
use Ferienpass\CoreBundle\Security\Voter\ConsentVoter;
use PHPUnit\Framework\TestCase;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;

final class ConsentVoterTest extends TestCase
{
    public function testSupportsReturnsFalseForNonConsentSubject(): void
    {
        $security = $this->createStub(Security::class);
        $voter = new ConsentVoter($security);

        // Uses Voter base class supports() which calls our protected method
        $token = $this->createStub(TokenInterface::class);
        $result = $voter->vote($token, new \stdClass(), ['view']);

        self::assertSame(VoterInterface::ACCESS_ABSTAIN, $result);
    }

    public function testSupportsReturnsFalseForNonMatchingAttribute(): void
    {
        $security = $this->createStub(Security::class);
        $voter = new ConsentVoter($security);

        $token = $this->createStub(TokenInterface::class);
        $consent = $this->createStub(Consent::class);
        $result = $voter->vote($token, $consent, ['edit']);

        self::assertSame(VoterInterface::ACCESS_ABSTAIN, $result);
    }

    public function testVoteDeniesWhenTokenUserIsNotUser(): void
    {
        $security = $this->createStub(Security::class);
        $voter = new ConsentVoter($security);

        $token = $this->createStub(TokenInterface::class);
        $token->method('getUser')->willReturn(null);
        $consent = $this->createStub(Consent::class);

        $result = $voter->vote($token, $consent, ['view']);

        self::assertSame(VoterInterface::ACCESS_DENIED, $result);
    }

    public function testVoteGrantsWhenUserIsAdmin(): void
    {
        $security = $this->createMock(Security::class);
        $security->method('isGranted')->with('ROLE_ADMIN')->willReturn(true);
        $voter = new ConsentVoter($security);

        $token = $this->createStub(TokenInterface::class);
        $token->method('getUser')->willReturn(new User());
        $consent = $this->createStub(Consent::class);

        $result = $voter->vote($token, $consent, ['view']);

        self::assertSame(VoterInterface::ACCESS_GRANTED, $result);
    }

    public function testVoteDeniesWhenUserIsNotAdmin(): void
    {
        $security = $this->createMock(Security::class);
        $security->method('isGranted')->with('ROLE_ADMIN')->willReturn(false);
        $voter = new ConsentVoter($security);

        $token = $this->createStub(TokenInterface::class);
        $token->method('getUser')->willReturn(new User());
        $consent = $this->createStub(Consent::class);

        $result = $voter->vote($token, $consent, ['delete']);

        self::assertSame(VoterInterface::ACCESS_DENIED, $result);
    }
}
