<?php

namespace App\Tests\Appointment;

use App\Appointment\Entity\DateOverride;
use App\Doctor\Entity\Doctor;
use App\Tests\ApiTestCase;

/**
 * Regression: GET date-override/{uuid} must enforce ownership (IDOR fix).
 */
class DateOverrideOwnershipTest extends ApiTestCase
{
    private function makeOverride(): array
    {
        $owner = $this->createUser(['ROLE_DOCTOR']);
        $doctor = new Doctor($owner, 'دکتر تست');
        $this->em->persist($doctor);
        $override = $this->newDateOverride($doctor, time(), true);
        $this->em->persist($override);
        $this->em->flush();

        return [$owner, $override];
    }

    public function testOwnerCanRead(): void
    {
        [$owner, $override] = $this->makeOverride();
        $this->authJson('GET', '/api/v1/appointment-settings/date-override/' . $override->getUuid(), $owner);
        $this->assertSame(200, $this->responseCode());
    }

    public function testOtherUserIsForbidden(): void
    {
        [, $override] = $this->makeOverride();
        $attacker = $this->createUser(['ROLE_DOCTOR']);
        $this->authJson('GET', '/api/v1/appointment-settings/date-override/' . $override->getUuid(), $attacker);
        $this->assertSame(403, $this->responseCode());
    }
}