<?php

namespace Tests\Feature;

use App\Models\AdminUser;
use App\Models\Application;
use App\Models\Competition;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Laravel\Sanctum\Sanctum;
use Tests\TestCase;

class AdminImpersonateParticipantTest extends TestCase
{
    use RefreshDatabase;

    public function test_superadmin_can_impersonate_participant(): void
    {
        Sanctum::actingAs(AdminUser::query()->create([
            'username' => 'superadmin',
            'password_hash' => 'unused',
            'name' => '超管',
            'status' => 'active',
        ]));

        $competition = Competition::query()->create([
            'slug' => 'xxf-imp',
            'name' => '测试赛',
            'published' => true,
        ]);
        $participant = User::query()->create(['mobile' => '13800138888', 'name' => '选手甲']);
        $application = Application::query()->create([
            'user_id' => $participant->id,
            'competition_id' => $competition->id,
            'status' => 'submitted',
            'project_name' => '测试项目',
        ]);

        $this->postJson(
            "/api/v1/admin/competitions/{$competition->id}/applications/{$application->id}/impersonate"
        )
            ->assertOk()
            ->assertJsonPath('competition_slug', 'xxf-imp')
            ->assertJsonPath('participant.mobile', '13800138888')
            ->assertJsonStructure(['token', 'expires_in']);

        $this->assertDatabaseHas('personal_access_tokens', [
            'tokenable_type' => User::class,
            'tokenable_id' => $participant->id,
            'name' => 'admin-impersonation',
        ]);
    }

    public function test_non_superadmin_cannot_impersonate(): void
    {
        Sanctum::actingAs(AdminUser::query()->create([
            'username' => 'admin',
            'password_hash' => 'unused',
            'name' => '普通管理员',
            'status' => 'active',
        ]));

        $competition = Competition::query()->create([
            'slug' => 'xxf-imp-2',
            'name' => '测试赛',
            'published' => true,
        ]);
        $participant = User::query()->create(['mobile' => '13800138889']);
        $application = Application::query()->create([
            'user_id' => $participant->id,
            'competition_id' => $competition->id,
            'status' => 'submitted',
        ]);

        $this->postJson(
            "/api/v1/admin/competitions/{$competition->id}/applications/{$application->id}/impersonate"
        )
            ->assertForbidden()
            ->assertJsonPath('message', '仅 superadmin 可进入选手端');
    }
}