<?php

namespace App\Tests\Insurance;

use App\Doctor\Entity\Doctor;
use App\Insurance\Entity\DoctorInsurance;
use App\Insurance\Entity\Insurance;
use App\Insurance\Enum\InsuranceType;
use App\Tests\ApiTestCase;

/**
 * GET /api/v1/insurance/{id} must enforce ownership — a doctor must not read
 * another doctor's insurance record (incl. negotiated price) by id enumeration.
 */
class DoctorInsuranceOwnershipTest extends ApiTestCase
{
    private function makeDoctorInsurance(): DoctorInsurance
    {
        $doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر مالک');
        $this->em->persist($doctor);
        $insurance = new Insurance('بیمه تست', InsuranceType::Basic);
        $this->em->persist($insurance);
        $di = new DoctorInsurance($doctor, $insurance);
        $this->em->persist($di);
        $this->em->flush();

        return $di;
    }

    public function testOtherDoctorCannotRead(): void
    {
        $di      = $this->makeDoctorInsurance();
        $stranger = $this->createUser(['ROLE_DOCTOR']);

        $this->authJson('GET', '/api/v1/insurance/' . $di->getId(), $stranger);

        $this->assertSame(403, $this->responseCode());
    }

    public function testOwnerCanRead(): void
    {
        $di    = $this->makeDoctorInsurance();
        $owner = $di->getDoctor()->getUser();

        $this->authJson('GET', '/api/v1/insurance/' . $di->getId(), $owner);

        $this->assertSame(200, $this->responseCode());
    }
}