<?php

namespace Tests\Feature\Api\V1\Workflows;

use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\DB;
use Tests\Concerns\SeedsE2ETestFixtures;
use Tests\TestCase;

/**
 * Scenario K: Parent self-service and privacy boundaries.
 *
 * This verifies the parent portal as one complete use case: view household data,
 * update contact details, manage emergency contacts, and stay boxed inside the
 * authenticated family. Tiny detail, privacy. Apparently important.
 */
class ScenarioKParentSelfServiceAndPrivacyTest extends TestCase
{
    use RefreshDatabase;
    use SeedsE2ETestFixtures;

    public function test_parent_reviews_household_data_and_updates_contact_details(): void
    {
        $world = $this->seedTeacherClassWithStudent();
        $parent = $world['parent'];
        $studentId = $world['student_id'];

        $this->seedInvoiceForParent($parent->id);
        DB::table('enrollments')->insert([
            'parent_id' => $parent->id,
            'student_id' => $studentId,
            'school_year' => self::E2E_SCHOOL_YEAR,
            'semester' => self::E2E_SEMESTER,
            'enrollment_status' => 'enrolled',
            'enrollment_date' => '2025-09-01',
        ]);
        DB::table('attendance_data')->insert([
            'class_id' => 3,
            'class_section_id' => $world['class_section_id'],
            'student_id' => $studentId,
            'school_id' => 'S-E2E',
            'date' => '2025-10-05',
            'status' => 'present',
            'semester' => self::E2E_SEMESTER,
            'school_year' => self::E2E_SCHOOL_YEAR,
            'created_at' => now(),
            'updated_at' => now(),
        ]);

        $this->actingAs($parent, 'api');

        $this->getJson('/api/v1/parents/profile')
            ->assertOk()
            ->assertJsonPath('ok', true);

        $this->patchJson('/api/v1/parents/profile', [
            'firstname' => 'Updated',
            'lastname' => 'Parent',
            'cellphone' => '5557778888',
            'address_street' => '99 Parent Way',
            'city' => 'Brooklyn',
            'state' => 'NY',
            'zip' => '11215',
        ])->assertOk()->assertJsonPath('ok', true);

        $this->assertDatabaseHas('users', [
            'id' => $parent->id,
            'firstname' => 'Updated',
            'cellphone' => '5557778888',
        ]);

        $this->postJson('/api/v1/parents/emergency-contacts', [
            'name' => 'Amina Emergency',
            'cellphone' => '5550001111',
            'email' => 'amina.emergency@example.test',
            'relation' => 'Aunt',
        ])->assertCreated()->assertJsonPath('ok', true);

        $this->assertDatabaseHas('emergency_contacts', [
            'parent_id' => $parent->id,
            'emergency_contact_name' => 'Amina Emergency',
        ]);

        $this->getJson('/api/v1/parents/emergency-contacts')
            ->assertOk()
            ->assertJsonPath('ok', true);

        $this->getJson('/api/v1/parents/attendance?school_year=' . self::E2E_SCHOOL_YEAR)
            ->assertOk()
            ->assertJsonPath('ok', true);

        $this->getJson('/api/v1/parents/invoices?school_year=' . self::E2E_SCHOOL_YEAR)
            ->assertOk()
            ->assertJsonPath('ok', true);

        $this->getJson('/api/v1/parents/enrollments?school_year=' . self::E2E_SCHOOL_YEAR)
            ->assertOk()
            ->assertJsonPath('ok', true);
    }

    public function test_parent_cannot_mutate_another_family_student_or_emergency_contact(): void
    {
        $this->seedE2EConfiguration();
        $admin = $this->actingAsApiAdministrator();
        $parentA = $this->createApiUserWithRole('parent');
        $parentB = $this->createApiUserWithRole('parent');
        $this->actingAs($admin, 'api');
        $studentB = $this->createStudentViaApi($parentB->id, [
            'firstname' => 'Private',
            'lastname' => 'Student',
        ]);
        $foreignContactId = DB::table('emergency_contacts')->insertGetId([
            'parent_id' => $parentB->id,
            'emergency_contact_name' => 'Foreign Contact',
            'cellphone' => '5553334444',
            'email' => 'foreign.contact@example.test',
            'relation' => 'Uncle',
            'semester' => self::E2E_SEMESTER,
            'school_year' => self::E2E_SCHOOL_YEAR,
            'created_at' => now(),
            'updated_at' => now(),
        ]);

        $this->actingAs($parentA, 'api');

        $this->patchJson('/api/v1/parents/students/' . $studentB, [
            'firstname' => 'Tampered',
            'lastname' => 'Student',
            'dob' => '2015-01-01',
            'gender' => 'Male',
        ])->assertNotFound();

        $this->patchJson('/api/v1/parents/emergency-contacts/' . $foreignContactId, [
            'name' => 'Tampered Contact',
            'cellphone' => '5553334444',
            'email' => 'foreign.contact@example.test',
            'relation' => 'Uncle',
        ])->assertNotFound();

        $this->assertDatabaseHas('students', [
            'id' => $studentB,
            'firstname' => 'Private',
        ]);
        $this->assertDatabaseHas('emergency_contacts', [
            'id' => $foreignContactId,
            'emergency_contact_name' => 'Foreign Contact',
        ]);
    }
}
