breadcrumb-the-shire/tests/Service/Auth/AuthServiceTest.php

<?php

namespace MintyPHP\Tests\Service\Auth;

use MintyPHP\Http\SessionStoreInterface;
use MintyPHP\Repository\User\UserReadRepositoryInterface;
use MintyPHP\Repository\User\UserWriteRepositoryInterface;
use MintyPHP\Service\Audit\SystemAuditService;
use MintyPHP\Service\Auth\AuthPermissionGateway;
use MintyPHP\Service\Auth\AuthService;
use MintyPHP\Service\Auth\AuthSessionTenantContextService;
use MintyPHP\Service\Auth\AuthTenantSsoGateway;
use MintyPHP\Service\Auth\EmailVerificationService;
use MintyPHP\Service\Auth\RememberMeService;
use MintyPHP\Service\User\UserAccountService;
use MintyPHP\Service\User\UserTenantContextService;
use PHPUnit\Framework\TestCase;

class AuthServiceTest extends TestCase
{
    // ---------------------------------------------------------------
    // canLoginToTenant
    // ---------------------------------------------------------------

    public function testCanLoginToTenantReturnsFalseForInvalidUserId(): void
    {
        $service = $this->newService();
        $this->assertFalse($service->canLoginToTenant(0, 5));
    }

    public function testCanLoginToTenantReturnsFalseForInvalidTenantId(): void
    {
        $service = $this->newService();
        $this->assertFalse($service->canLoginToTenant(1, 0));
    }

    public function testCanLoginToTenantReturnsTrueWhenTenantIsAssigned(): void
    {
        $tenantCtx = $this->createMock(UserTenantContextService::class);
        $tenantCtx->method('getAvailableTenants')->willReturn([
            ['id' => 3],
            ['id' => 7],
        ]);

        $service = $this->newService(userTenantContextService: $tenantCtx);
        $this->assertTrue($service->canLoginToTenant(1, 7));
    }

    public function testCanLoginToTenantReturnsFalseWhenTenantNotAssigned(): void
    {
        $tenantCtx = $this->createMock(UserTenantContextService::class);
        $tenantCtx->method('getAvailableTenants')->willReturn([
            ['id' => 3],
        ]);

        $service = $this->newService(userTenantContextService: $tenantCtx);
        $this->assertFalse($service->canLoginToTenant(1, 99));
    }

    // ---------------------------------------------------------------
    // refreshSessionAuthState
    // ---------------------------------------------------------------

    public function testRefreshSessionRequiresLogoutWhenUserIdIsZero(): void
    {
        $service = $this->newService();
        $result = $service->refreshSessionAuthState(0);

        $this->assertFalse($result['ok']);
        $this->assertTrue($result['logout_required']);
        $this->assertSame('user_missing', $result['reason']);
    }

    public function testRefreshSessionRequiresLogoutWhenUserNotFound(): void
    {
        $userRead = $this->createMock(UserReadRepositoryInterface::class);
        $userRead->method('findAuthzSnapshot')->willReturn(null);

        $service = $this->newService(userReadRepository: $userRead);
        $result = $service->refreshSessionAuthState(5);

        $this->assertFalse($result['ok']);
        $this->assertTrue($result['logout_required']);
        $this->assertSame('user_not_found', $result['reason']);
    }

    public function testRefreshSessionRequiresLogoutWhenUserIsInactive(): void
    {
        $userRead = $this->createMock(UserReadRepositoryInterface::class);
        $userRead->method('findAuthzSnapshot')->willReturn(['active' => 0, 'authz_version' => 1]);

        $service = $this->newService(userReadRepository: $userRead);
        $result = $service->refreshSessionAuthState(5);

        $this->assertFalse($result['ok']);
        $this->assertTrue($result['logout_required']);
        $this->assertSame('inactive', $result['reason']);
    }

    public function testRefreshSessionReturnsOkWhenVersionMatchesAndTenantActive(): void
    {
        $session = $this->createMock(SessionStoreInterface::class);
        $session->method('get')->willReturnMap([
            ['user', [], ['id' => 5, 'authz_version' => 2]],
            ['current_tenant', [], ['id' => 10]],
            ['no_active_tenant', false, false],
        ]);

        $userRead = $this->createMock(UserReadRepositoryInterface::class);
        $userRead->method('findAuthzSnapshot')->willReturn(['active' => 1, 'authz_version' => 2]);

        $service = $this->newService(userReadRepository: $userRead, sessionStore: $session);
        $result = $service->refreshSessionAuthState(5);

        $this->assertTrue($result['ok']);
        $this->assertFalse($result['logout_required']);
        $this->assertFalse($result['refreshed']);
    }

    public function testRefreshSessionRefreshesWhenVersionMismatch(): void
    {
        $session = $this->createMock(SessionStoreInterface::class);
        $session->method('get')->willReturnCallback(function (string $key, mixed $default) {
            if ($key === 'user') {
                return ['id' => 5, 'authz_version' => 1];
            }
            if ($key === 'no_active_tenant') {
                return false;
            }
            return $default;
        });
        $session->expects($this->atLeastOnce())->method('set');

        $userRead = $this->createMock(UserReadRepositoryInterface::class);
        $userRead->method('findAuthzSnapshot')->willReturn(['active' => 1, 'authz_version' => 3]);
        $userRead->method('find')->willReturn(['id' => 5, 'active' => 1, 'authz_version' => 3]);

        $permGateway = $this->createMock(AuthPermissionGateway::class);
        $permGateway->expects($this->once())->method('warmUserPermissions')->with(5, true);

        $tenantCtxService = $this->createMock(AuthSessionTenantContextService::class);
        $tenantCtxService->expects($this->once())->method('hydrateForUser')->with(5);

        $service = $this->newService(
            userReadRepository: $userRead,
            permissionGateway: $permGateway,
            authSessionTenantContextService: $tenantCtxService,
            sessionStore: $session
        );
        $result = $service->refreshSessionAuthState(5);

        $this->assertTrue($result['ok']);
        $this->assertFalse($result['logout_required']);
        $this->assertTrue($result['refreshed']);
    }

    public function testRefreshSessionRequiresLogoutWhenNoActiveTenantAfterRefresh(): void
    {
        $session = $this->createMock(SessionStoreInterface::class);
        $session->method('get')->willReturnCallback(function (string $key, mixed $default) {
            if ($key === 'user') {
                return ['id' => 5, 'authz_version' => 1];
            }
            if ($key === 'no_active_tenant') {
                return true; // no active tenant
            }
            return $default;
        });

        $userRead = $this->createMock(UserReadRepositoryInterface::class);
        $userRead->method('findAuthzSnapshot')->willReturn(['active' => 1, 'authz_version' => 2]);
        $userRead->method('find')->willReturn(['id' => 5, 'active' => 1, 'authz_version' => 2]);

        $service = $this->newService(userReadRepository: $userRead, sessionStore: $session);
        $result = $service->refreshSessionAuthState(5);

        $this->assertFalse($result['ok']);
        $this->assertTrue($result['logout_required']);
        $this->assertSame('no_active_tenant', $result['reason']);
    }

    // ---------------------------------------------------------------
    // loginUserById
    // ---------------------------------------------------------------

    public function testLoginUserByIdReturnsErrorForZeroId(): void
    {
        $service = $this->newService();
        $result = $service->loginUserById(0);

        $this->assertFalse($result['ok']);
        $this->assertSame('user_not_found', $result['error']);
    }

    public function testLoginUserByIdReturnsErrorWhenUserNotFound(): void
    {
        $userRead = $this->createMock(UserReadRepositoryInterface::class);
        $userRead->method('find')->willReturn(null);

        $service = $this->newService(userReadRepository: $userRead);
        $result = $service->loginUserById(5);

        $this->assertFalse($result['ok']);
        $this->assertSame('user_not_found', $result['error']);
    }

    public function testLoginUserByIdReturnsErrorWhenUserInactive(): void
    {
        $userRead = $this->createMock(UserReadRepositoryInterface::class);
        $userRead->method('find')->willReturn(['id' => 5, 'active' => 0]);

        $service = $this->newService(userReadRepository: $userRead);
        $result = $service->loginUserById(5);

        $this->assertFalse($result['ok']);
        $this->assertSame('user_inactive', $result['error']);
    }

    public function testLoginUserByIdSucceedsWithActiveTenant(): void
    {
        $_SESSION = [];

        $userRead = $this->createMock(UserReadRepositoryInterface::class);
        $userRead->method('find')->willReturn(['id' => 5, 'active' => 1]);

        $userWrite = $this->createMock(UserWriteRepositoryInterface::class);
        $userWrite->expects($this->once())->method('updateLastLogin')->with(5, 'microsoft');

        $session = $this->createMock(SessionStoreInterface::class);
        $session->expects($this->atLeastOnce())->method('set');
        $session->method('get')->willReturnMap([
            ['user', [], ['id' => 5, 'active' => 1]],
            ['current_tenant', [], ['id' => 10]],
            ['no_active_tenant', false, false],
        ]);

        $permGateway = $this->createMock(AuthPermissionGateway::class);
        $permGateway->expects($this->once())->method('warmUserPermissions')->with(5, true);

        $tenantCtxService = $this->createMock(AuthSessionTenantContextService::class);
        $tenantCtxService->expects($this->once())->method('hydrateForUser')->with(5);

        $audit = $this->createMock(SystemAuditService::class);
        $audit->expects($this->once())->method('record')
            ->with('auth.login.success', 'success', $this->anything());

        $service = $this->newService(
            userReadRepository: $userRead,
            userWriteRepository: $userWrite,
            permissionGateway: $permGateway,
            authSessionTenantContextService: $tenantCtxService,
            systemAuditService: $audit,
            sessionStore: $session
        );
        $result = $service->loginUserById(5, null, 'microsoft');

        $this->assertTrue($result['ok']);
        $this->assertSame(5, (int) ($result['user']['id'] ?? 0));
    }

    public function testLoginUserByIdFailsWhenNoActiveTenant(): void
    {
        $_SESSION = [];

        $userRead = $this->createMock(UserReadRepositoryInterface::class);
        $userRead->method('find')->willReturn(['id' => 5, 'active' => 1]);

        $session = $this->createMock(SessionStoreInterface::class);
        $session->method('get')->willReturnCallback(function (string $key, mixed $default) {
            if ($key === 'user') {
                return ['id' => 5, 'active' => 1];
            }
            if ($key === 'no_active_tenant') {
                return true;
            }
            return $default;
        });

        $audit = $this->createMock(SystemAuditService::class);
        $audit->expects($this->once())->method('record')
            ->with('auth.login.failed', 'failed', $this->anything());

        $service = $this->newService(
            userReadRepository: $userRead,
            systemAuditService: $audit,
            sessionStore: $session
        );
        $result = $service->loginUserById(5);

        $this->assertFalse($result['ok']);
        $this->assertSame('login_no_active_tenant', $result['error']);
    }

    public function testLoginUserByIdSetsPreferredTenantWhenProvided(): void
    {
        $_SESSION = [];

        $userRead = $this->createMock(UserReadRepositoryInterface::class);
        $userRead->method('find')->willReturn(['id' => 5, 'active' => 1]);

        $tenantCtx = $this->createMock(UserTenantContextService::class);
        $tenantCtx->expects($this->once())
            ->method('setCurrentTenant')
            ->with(5, 42)
            ->willReturn(['ok' => true]);

        $session = $this->createMock(SessionStoreInterface::class);
        $session->method('get')->willReturnMap([
            ['user', [], ['id' => 5, 'active' => 1]],
            ['current_tenant', [], ['id' => 42]],
            ['no_active_tenant', false, false],
        ]);
        $session->expects($this->atLeastOnce())->method('set');

        $service = $this->newService(
            userReadRepository: $userRead,
            userTenantContextService: $tenantCtx,
            sessionStore: $session
        );
        $result = $service->loginUserById(5, 42, 'local');

        $this->assertTrue($result['ok']);
    }

    // ---------------------------------------------------------------
    // login — email not verified branch
    // ---------------------------------------------------------------

    public function testLoginReturnsNeedsVerificationWhenEmailNotVerified(): void
    {
        $userRead = $this->createMock(UserReadRepositoryInterface::class);
        $userRead->method('findByEmail')->willReturn([
            'id' => 5,
            'email' => 'test@example.com',
            'email_verified_at' => null,
        ]);

        $audit = $this->createMock(SystemAuditService::class);
        $audit->expects($this->once())->method('record')
            ->with('auth.login.failed', 'failed', $this->callback(function (array $ctx): bool {
                return ($ctx['error_code'] ?? '') === 'email_not_verified';
            }));

        $service = $this->newService(userReadRepository: $userRead, systemAuditService: $audit);
        $result = $service->login('test@example.com', 'password');

        $this->assertFalse($result['ok']);
        $this->assertTrue($result['needs_verification'] ?? false);
        $this->assertSame('login_not_verified', $result['flash_key']);
    }

    // ---------------------------------------------------------------
    // Helper
    // ---------------------------------------------------------------

    private function newService(
        ?UserReadRepositoryInterface $userReadRepository = null,
        ?UserWriteRepositoryInterface $userWriteRepository = null,
        ?UserAccountService $userAccountService = null,
        ?UserTenantContextService $userTenantContextService = null,
        ?RememberMeService $rememberMeService = null,
        ?EmailVerificationService $emailVerificationService = null,
        ?AuthPermissionGateway $permissionGateway = null,
        ?AuthTenantSsoGateway $tenantSsoGateway = null,
        ?AuthSessionTenantContextService $authSessionTenantContextService = null,
        ?SystemAuditService $systemAuditService = null,
        ?SessionStoreInterface $sessionStore = null
    ): AuthService {
        return new AuthService(
            $userReadRepository ?? $this->createMock(UserReadRepositoryInterface::class),
            $userWriteRepository ?? $this->createMock(UserWriteRepositoryInterface::class),
            $userAccountService ?? $this->createMock(UserAccountService::class),
            $userTenantContextService ?? $this->createMock(UserTenantContextService::class),
            $rememberMeService ?? $this->createMock(RememberMeService::class),
            $emailVerificationService ?? $this->createMock(EmailVerificationService::class),
            $permissionGateway ?? $this->createMock(AuthPermissionGateway::class),
            $tenantSsoGateway ?? $this->createMock(AuthTenantSsoGateway::class),
            $authSessionTenantContextService ?? $this->createMock(AuthSessionTenantContextService::class),
            $systemAuditService ?? $this->createMock(SystemAuditService::class),
            $sessionStore ?? $this->createMock(SessionStoreInterface::class)
        );
    }
}