<?php

namespace App\Tests\Appointment;

use App\Doctor\Entity\Doctor;
use App\Tests\ApiTestCase;
use PHPUnit\Framework\Attributes\DataProvider;

/**
 * The appointment-settings list endpoints (date-overrides, holidays,
 * available-locations) must not leak another doctor's configuration.
 */
class AppointmentSettingsListOwnershipTest extends ApiTestCase
{
    private function makeDoctor(): Doctor
    {
        $doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر');
        $this->em->persist($doctor);
        $this->em->flush();

        return $doctor;
    }

    /** @return iterable<string, array{0: string}> */
    public static function endpoints(): iterable
    {
        yield 'date-override list' => ['/api/v1/appointment-settings/date-override/list/'];
        yield 'holidays list'      => ['/api/v1/appointment-settings/holidays/list/'];
        yield 'available-locations' => ['/api/v1/appointment-settings/available-locations/'];
    }

    #[DataProvider('endpoints')]
    public function testStrangerForbidden(string $prefix): void
    {
        $doctor   = $this->makeDoctor();
        $stranger = $this->createUser(['ROLE_DOCTOR']);

        $this->authJson('GET', $prefix . $doctor->getUuid(), $stranger);

        $this->assertSame(403, $this->responseCode());
    }

    #[DataProvider('endpoints')]
    public function testOwnerAllowed(string $prefix): void
    {
        $doctor = $this->makeDoctor();

        $this->authJson('GET', $prefix . $doctor->getUuid(), $doctor->getUser());

        $this->assertSame(200, $this->responseCode());
    }
}