<?php

namespace Tests\Feature\Api;

use Tests\TestCase;

class RateLimitingTest extends TestCase
{
    public function test_otp_endpoint_is_rate_limited(): void
    {
        // OTP limit is 3 per minute per phone
        for ($i = 0; $i < 4; $i++) {
            $response = $this->postJson('/api/v1/auth/otp/request', [
                'phone' => '+201012345678',
            ]);
        }

        // The 4th request should be rate limited (429)
        $this->assertEquals(429, $response->status());
    }

    public function test_general_api_has_rate_limit_headers(): void
    {
        $response = $this->getJson('/api/v1/health');

        $response->assertOk();
        // Laravel includes these headers when rate limiting middleware is active
        $this->assertTrue(
            $response->headers->has('X-RateLimit-Limit') || $response->headers->has('x-ratelimit-limit'),
            'Rate limit headers should be present'
        );
    }
}
