<?php

declare(strict_types=1);

namespace App\Tests\Security;

use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;

class LoginEntryPointTest extends WebTestCase
{
    /**
     * A plain 302 would be followed invisibly and the login page swapped into the click's target.
     *
     * The status stays 403 -- Symfony's firewall keeps the access-denied status on this path --
     * and that is fine: htmx 2.0.10 acts on HX-Redirect before it looks at the status at all
     * (handleAjaxResponse), so it navigates rather than raising htmx:responseError.
     */
    public function testAnExpiredSessionOnAnHtmxRequestNavigatesToTheLoginPage(): void
    {
        $client = self::createClient();

        $client->request('GET', '/book/desk', server: ['HTTP_HX-Request' => 'true']);

        self::assertSame('/login', $client->getResponse()->headers->get('HX-Redirect'));
    }

    public function testAnExpiredSessionOnAnOrdinaryRequestStillRedirects(): void
    {
        $client = self::createClient();

        $client->request('GET', '/book/desk');

        self::assertResponseRedirects('/login');
    }
}