AggloSign/backend/tests/Feature/AdminTemplatesTest.php

<?php

namespace Tests\Feature;

use App\Models\Assignment;
use App\Models\AuditLog;
use App\Models\DirectoryGroup;
use App\Models\DirectoryUser;
use App\Models\Template;
use App\Models\Tenant;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class AdminTemplatesTest extends TestCase
{
    use RefreshDatabase;

    private Tenant $tenant;
    private DirectoryUser $agent;

    protected function setUp(): void
    {
        parent::setUp();
        config(['signature.admin_allowed_cidrs' => []]);

        $this->tenant = Tenant::create(['name' => 'CABM', 'entra_tenant_id' => '11111111-1111-1111-1111-111111111111']);
        $this->agent = DirectoryUser::create([
            'tenant_id' => $this->tenant->id, 'entra_oid' => '22222222-2222-2222-2222-222222222222',
            'display_name' => 'Jean Martin', 'given_name' => 'Jean', 'surname' => 'Martin',
            'mail' => 'j.martin@beziers-mediterranee.fr', 'account_enabled' => true,
        ]);
    }

    private function user(string $role): User
    {
        return User::create([
            'name' => $role, 'email' => "{$role}@beziers-mediterranee.fr", 'tenant_id' => $this->tenant->id,
            'entra_oid' => '22222222-2222-2222-2222-222222222222', 'role' => $role,
        ]);
    }

    private function payload(array $over = []): array
    {
        return array_merge(['name' => 'Directeurs', 'draft_html_full' => '<b>{{prenom}}</b>', 'draft_html_short' => '{{nom}}'], $over);
    }

    public function test_agent_sans_role_refuse(): void
    {
        $this->actingAs($this->user(''))->get('/admin/templates')->assertForbidden();
    }

    public function test_editeur_cree_et_modifie_un_brouillon_nettoye_mais_ne_publie_pas(): void
    {
        $editor = $this->user('editor');
        $this->actingAs($editor)->post('/admin/templates', $this->payload([
            'draft_html_full' => '<b>{{prenom}}</b><script>alert(1)</script>',
        ]))->assertRedirect();

        $t = Template::firstWhere('name', 'Directeurs');
        $this->assertSame('<b>{{prenom}}</b>', $t->draft_html_full);
        $this->assertNull($t->html_full, 'rien n\'est publié tant qu\'un admin ne publie pas');

        $this->actingAs($editor)->post("/admin/templates/{$t->id}/publish")->assertForbidden();
        $this->actingAs($editor)->get('/admin/affectations')->assertForbidden();
        $this->assertTrue(AuditLog::where('action', 'template.create')->exists());
    }

    public function test_admin_publie_versionne_et_restaure(): void
    {
        $admin = $this->user('admin');
        $t = Template::create(['tenant_id' => $this->tenant->id] + $this->payload());

        $this->actingAs($admin)->post("/admin/templates/{$t->id}/publish")->assertRedirect();
        $t->refresh();
        $this->assertSame(1, $t->published_version);
        $this->assertSame('<b>{{prenom}}</b>', $t->html_full);

        $this->actingAs($admin)->put("/admin/templates/{$t->id}", $this->payload(['draft_html_full' => 'v2']))->assertRedirect();
        $this->assertSame('<b>{{prenom}}</b>', $t->fresh()->html_full, 'le brouillon ne modifie pas le publié');

        $version = $t->versions()->first();
        $this->actingAs($admin)->post("/admin/templates/{$t->id}/versions/{$version->id}/restore")->assertRedirect();
        $this->assertSame('<b>{{prenom}}</b>', $t->fresh()->draft_html_full);
    }

    public function test_apercu_rend_le_brouillon_pour_un_agent(): void
    {
        $this->actingAs($this->user('editor'))
            ->postJson('/admin/templates/preview', ['html' => 'Bonjour {{prenom}} <img src=x onerror=alert(1)>', 'variant' => 'full', 'agent_id' => $this->agent->id])
            ->assertOk()
            ->assertJson(['html' => 'Bonjour Jean <img src=x>', 'agent' => 'Jean Martin — j.martin@beziers-mediterranee.fr']);
    }

    public function test_cloisonnement_entre_tenants(): void
    {
        $other = Tenant::create(['name' => 'Commune', 'entra_tenant_id' => '99999999-9999-9999-9999-999999999999']);
        $foreign = Template::create(['tenant_id' => $other->id, 'name' => 'Autre', 'draft_html_full' => 'x']);

        $this->actingAs($this->user('superadmin'))->get("/admin/templates/{$foreign->id}")->assertNotFound();
    }

    public function test_affectations_crud_et_template_par_defaut(): void
    {
        $admin = $this->user('admin');
        $t = Template::create(['tenant_id' => $this->tenant->id] + $this->payload());
        $t->publish();
        $group = DirectoryGroup::create(['tenant_id' => $this->tenant->id, 'entra_oid' => '33333333-3333-3333-3333-333333333333', 'display_name' => 'signature_mail_directeurs']);

        $this->actingAs($admin)->post('/admin/affectations', ['template_id' => $t->id, 'directory_group_id' => $group->id, 'priority' => 50])->assertRedirect();
        $this->actingAs($admin)->post('/admin/affectations', ['template_id' => $t->id, 'directory_group_id' => $group->id, 'priority' => 60])
            ->assertSessionHasErrors('directory_group_id');

        $a = Assignment::first();
        $this->actingAs($admin)->put("/admin/affectations/{$a->id}", ['priority' => 100])->assertRedirect();
        $this->assertSame(100, $a->fresh()->priority);

        $this->actingAs($admin)->post("/admin/templates/{$t->id}/default")->assertRedirect();
        $this->assertTrue($t->fresh()->is_default);
        $this->actingAs($admin)->delete("/admin/templates/{$t->id}")->assertStatus(422);

        $this->actingAs($admin)->delete("/admin/affectations/{$a->id}")->assertRedirect();
        $this->assertSame(0, Assignment::count());
    }

    public function test_pages_principales_s_affichent(): void
    {
        $admin = $this->user('superadmin');
        $t = Template::create(['tenant_id' => $this->tenant->id] + $this->payload());
        foreach (['/admin', '/admin/templates', '/admin/templates/create', "/admin/templates/{$t->id}", '/admin/affectations', '/admin/agents', "/admin/agents/{$this->agent->id}", '/me'] as $url) {
            $this->actingAs($admin)->get($url)->assertOk();
        }
        $this->actingAs($admin)->getJson('/admin/agents/recherche?q=mar')->assertOk()->assertJsonFragment(['id' => $this->agent->id]);
    }
}