<?php

namespace Tests\Feature\Api;

use Tests\TestCase;

class AuthOtpTest extends TestCase
{
    public function test_otp_request_requires_phone(): void
    {
        $response = $this->postJson('/api/v1/auth/otp/request', []);

        $response->assertStatus(422);
    }

    public function test_otp_request_validates_phone_format(): void
    {
        $response = $this->postJson('/api/v1/auth/otp/request', [
            'phone' => 'invalid',
        ]);

        $response->assertStatus(422);
    }

    public function test_otp_verify_requires_phone_and_otp(): void
    {
        $response = $this->postJson('/api/v1/auth/otp/verify', []);

        $response->assertStatus(422);
    }

    public function test_protected_endpoints_require_auth(): void
    {
        $endpoints = [
            ['GET', '/api/v1/dashboard'],
            ['GET', '/api/v1/guardian/children'],
            ['GET', '/api/v1/profile'],
            ['GET', '/api/v1/notifications'],
            ['GET', '/api/v1/messages'],
            ['GET', '/api/v1/products'],
        ];

        foreach ($endpoints as [$method, $url]) {
            $response = $this->json($method, $url);
            $this->assertContains($response->status(), [401, 403],
                "Expected 401/403 for {$method} {$url}, got {$response->status()}");
        }
    }

    public function test_logout_requires_auth(): void
    {
        $response = $this->postJson('/api/v1/auth/logout');

        $response->assertUnauthorized();
    }
}
