<?php

namespace App\Tests\Clinic;

use App\Clinic\Entity\Clinic;
use App\Doctor\Entity\Doctor;
use App\Tests\ApiTestCase;

/**
 * Detaching a doctor from a clinic is allowed for an admin OR the clinic owner.
 * Any other authenticated user (incl. a foreign clinic owner or a plain doctor)
 * must be rejected with 403.
 */
class DetachDoctorPermissionTest extends ApiTestCase
{
    /** @return array{0: Clinic, 1: Doctor} */
    private function makeClinicWithDoctor(): array
    {
        $clinic = new Clinic($this->createUser(['ROLE_CLINIC']));
        $this->em->persist($clinic);

        $doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر آزمایشی');
        $this->em->persist($doctor);
        $clinic->getDoctors()->add($doctor);
        $this->em->flush();

        return [$clinic, $doctor];
    }

    private function detachUri(Clinic $clinic, Doctor $doctor): string
    {
        return '/api/v1/admin/clinic/' . $clinic->getUuid() . '/doctor/' . $doctor->getUuid();
    }

    public function testClinicOwnerCanDetachOwnDoctor(): void
    {
        [$clinic, $doctor] = $this->makeClinicWithDoctor();
        $owner = $clinic->getUser();

        $body = $this->authJson('DELETE', $this->detachUri($clinic, $doctor), $owner);

        $this->assertSame(200, $this->responseCode());
        $this->assertTrue($body['success']);
    }

    public function testAdminCanDetachAnyDoctor(): void
    {
        [$clinic, $doctor] = $this->makeClinicWithDoctor();
        $admin = $this->createUser(['ROLE_ADMIN']);

        $body = $this->authJson('DELETE', $this->detachUri($clinic, $doctor), $admin);

        $this->assertSame(200, $this->responseCode());
        $this->assertTrue($body['success']);
    }

    public function testForeignClinicOwnerIsForbidden(): void
    {
        [$clinic, $doctor] = $this->makeClinicWithDoctor();
        $intruder = $this->createUser(['ROLE_CLINIC']);

        $body = $this->authJson('DELETE', $this->detachUri($clinic, $doctor), $intruder);

        $this->assertSame(403, $this->responseCode());
        $this->assertFalse($body['success']);
        $this->assertSame('ERR_ACCESS_DENIED', $body['errors'][0]['code']);
    }

    public function testPlainDoctorIsForbidden(): void
    {
        [$clinic, $doctor] = $this->makeClinicWithDoctor();
        $otherDoctor = $this->createUser(['ROLE_DOCTOR']);

        $this->authJson('DELETE', $this->detachUri($clinic, $doctor), $otherDoctor);

        $this->assertSame(403, $this->responseCode());
    }
}