<?php

namespace App\Tests\Appointment;

use App\Doctor\Entity\Doctor;
use App\Tests\ApiTestCase;

/**
 * POST /api/v1/my/appointment must enforce that the acting user is scoped to
 * the target doctor. A doctor having the ROLE_DOCTOR role is not enough — they
 * must not be able to book onto another doctor's calendar via doctor_uuid.
 */
class BookingScopeTest extends ApiTestCase
{
    private function makeDoctor(): Doctor
    {
        $user = $this->createUser(['ROLE_USER', 'ROLE_DOCTOR']);
        $doctor = new Doctor($user, 'دکتر تست');
        $this->em->persist($doctor);
        $this->em->flush();

        return $doctor;
    }

    private function bookingBody(string $doctorUuid): array
    {
        $start = time() + 86_400;

        return [
            'doctor_uuid'           => $doctorUuid,
            'slot_start'            => $start,
            'slot_end'              => $start + 1_800,
            'patient_mobile'        => '09' . str_pad((string) random_int(0, 999_999_999), 9, '0', STR_PAD_LEFT),
            'patient_name'          => 'بیمار تست',
            'patient_national_code' => '00' . str_pad((string) random_int(0, 99_999_999), 8, '0', STR_PAD_LEFT),
        ];
    }

    public function testDoctorCannotBookOntoAnotherDoctor(): void
    {
        $doctorA = $this->makeDoctor();
        $doctorB = $this->makeDoctor();

        $this->authJson('POST', '/api/v1/my/appointment', $doctorA->getUser(), $this->bookingBody($doctorB->getUuid()));

        $this->assertSame(403, $this->responseCode());
    }

    public function testDoctorCanBookOntoOwnCalendar(): void
    {
        $doctorA = $this->makeDoctor();

        $this->authJson('POST', '/api/v1/my/appointment', $doctorA->getUser(), $this->bookingBody($doctorA->getUuid()));

        $this->assertSame(201, $this->responseCode());
    }
}