<?php

namespace Tests\Feature\Unit;

use App\Models\PaymentGateway;
use App\Models\PaymentTransaction;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class WebhookVerificationServiceTest extends TestCase
{
    use RefreshDatabase;

    public function test_invalid_signature_is_rejected(): void
    {
        PaymentGateway::query()->create([
            'code' => 'razorpay',
            'name' => 'Razorpay',
            'type' => 'payment',
            'environment' => 'sandbox',
            'is_enabled' => true,
            'config_json' => [
                'webhook_secret' => 'secret123',
            ],
        ]);

        $payload = json_encode(['event' => 'payment.captured', 'order_id' => 'ORD-1'], JSON_UNESCAPED_SLASHES);

        $response = $this->postJson('/webhooks/razorpay', json_decode($payload, true), [
            'X-Signature' => 'invalid-signature',
        ]);

        $response->assertStatus(422);
        $response->assertJson(['message' => 'Invalid webhook signature']);
    }

    public function test_duplicate_verified_webhook_is_ignored(): void
    {
        PaymentGateway::query()->create([
            'code' => 'razorpay',
            'name' => 'Razorpay',
            'type' => 'payment',
            'environment' => 'sandbox',
            'is_enabled' => true,
            'config_json' => [
                'webhook_secret' => 'secret123',
            ],
        ]);

        $user = User::query()->create([
            'member_code' => 'LW9100001',
            'referral_code' => 'LW9100002',
            'name' => 'Webhook User',
            'email' => 'webhook-user@example.com',
            'mobile' => '919100000001',
            'password' => 'password',
            'role' => 'user',
            'status' => 'pending',
        ]);

        $tx = PaymentTransaction::query()->create([
            'user_id' => $user->id,
            'gateway' => 'razorpay',
            'merchant_order_ref' => 'order_test_123',
            'amount' => 1000,
            'payment_for' => 'joining',
            'status' => 'pending',
        ]);

        $payload = json_encode([
            'event' => 'payment.captured',
            'payload' => [
                'payment' => [
                    'entity' => [
                        'id' => 'pay_test_123',
                        'order_id' => 'order_test_123',
                    ],
                ],
            ],
        ], JSON_UNESCAPED_SLASHES);

        $signature = hash_hmac('sha256', $payload, 'secret123');

        $first = $this->withHeaders(['X-Razorpay-Signature' => $signature])
            ->post('/webhooks/razorpay', json_decode($payload, true));
        $first->assertStatus(200);
        $first->assertJson(['message' => 'Webhook processed']);

        $second = $this->withHeaders(['X-Razorpay-Signature' => $signature])
            ->post('/webhooks/razorpay', json_decode($payload, true));
        $second->assertStatus(200);
        $second->assertJson(['message' => 'Duplicate callback ignored']);

        $tx->refresh();
        $this->assertSame('success', $tx->status);
        $this->assertTrue((bool) $tx->webhook_verified);
    }
}
