<?php

declare(strict_types=1);

namespace App\Tests\Security;

use App\Security\EmployeeDomainMatcher;
use PHPUnit\Framework\Attributes\DataProvider;
use PHPUnit\Framework\TestCase;

/**
 * The domain is matched exactly, never as a suffix: a suffix match would hand ROLE_EMPLOYEE to
 * anybody able to register a domain ending in the configured one.
 */
class EmployeeDomainMatcherTest extends TestCase
{
    #[DataProvider('addresses')]
    public function testRecognisesAnEmployeeAddress(?string $email, bool $expected): void
    {
        $matcher = new EmployeeDomainMatcher(['ep-reisen.de']);

        self::assertSame($expected, $matcher->isEmployee($email));
    }

    /**
     * @return iterable<string, array{0: ?string, 1: bool}>
     */
    public static function addresses(): iterable
    {
        yield 'the configured domain' => ['someone@ep-reisen.de', true];
        yield 'mixed case is still the same domain' => ['Someone@EP-Reisen.DE', true];
        yield 'plus addressing does not touch the domain' => ['someone+booking@ep-reisen.de', true];
        yield 'an at sign in the local part' => ['"odd@name"@ep-reisen.de', true];

        yield 'another domain' => ['someone@example.org', false];
        yield 'a subdomain is not the domain' => ['someone@mail.ep-reisen.de', false];
        yield 'a domain merely ending in it' => ['someone@notep-reisen.de', false];
        yield 'the domain as a prefix' => ['someone@ep-reisen.de.evil.test', false];
        yield 'no at sign at all' => ['ep-reisen.de', false];
        yield 'empty' => ['', false];
        yield 'null' => [null, false];
    }

    public function testWithoutConfiguredDomainsNobodyIsAnEmployee(): void
    {
        self::assertFalse((new EmployeeDomainMatcher([]))->isEmployee('someone@ep-reisen.de'));
    }

    public function testConfiguredDomainsAreNormalised(): void
    {
        $matcher = new EmployeeDomainMatcher([' EP-Reisen.DE ', '@example.org']);

        self::assertTrue($matcher->isEmployee('someone@ep-reisen.de'));
        self::assertTrue($matcher->isEmployee('someone@example.org'));
    }
}