<?php

namespace Tests\Feature;

use Tests\TestCase;

class AdminSmsLoginSecurityTest extends TestCase
{
    public function test_legacy_get_sms_login_is_not_available(): void
    {
        $this->getJson('/api/admin/auth/sms-login')->assertStatus(405);
        $this->getJson('/api/admin/auth/send-sms')->assertStatus(405);
    }

    public function test_sms_login_requires_six_digit_code_and_challenge(): void
    {
        $response = $this->postJson('/api/admin/auth/sms-login', [
            'mobile' => '13800138000',
            'code' => '1234',
            'challenge_id' => 'not-a-uuid',
        ]);

        $response->assertOk()->assertJsonPath('errcode', 30001);
    }
}