unsupervised-scheduler/tests/Unit/Auth/RegistrationPageTest.php

<?php
declare(strict_types=1);

namespace Unsupervised\Schedular\Tests\Unit\Auth;

use Brain\Monkey\Functions;
use Mockery;
use Unsupervised\Schedular\Auth\Invite;
use Unsupervised\Schedular\Auth\InviteRepository;
use Unsupervised\Schedular\Auth\RegistrationMailer;
use Unsupervised\Schedular\Auth\RegistrationPage;
use Unsupervised\Schedular\Payment\StudioSettings;
use Unsupervised\Schedular\Policy\AcceptanceRepository;
use Unsupervised\Schedular\Policy\Policy;
use Unsupervised\Schedular\Policy\PolicyRepository;
use Unsupervised\Schedular\Policy\PolicyVersion;
use Unsupervised\Schedular\Policy\PolicyVersionRepository;
use Unsupervised\Schedular\Tests\Unit\TestCase;

class RegistrationPageTest extends TestCase
{
    /** @var array<string, mixed> */
    private array $ctx;

    protected function setUp(): void
    {
        parent::setUp();

        Functions\when('wp_unslash')->alias(static fn ($v) => $v);
        Functions\when('sanitize_text_field')->alias(static fn ($v) => $v);
        Functions\when('sanitize_email')->alias(static fn ($v) => $v);
        Functions\when('current_time')->justReturn('2024-01-01 00:00:00');

        $invites  = Mockery::mock(InviteRepository::class);
        $policies = Mockery::mock(PolicyRepository::class);
        $policies->shouldReceive('findForScope')->andReturn([])->byDefault();

        $this->ctx = [
            'invites'  => $invites,
            'policies' => $policies,
            'mailer'   => Mockery::mock(RegistrationMailer::class),
            'settings' => Mockery::mock(StudioSettings::class),
        ];

        $this->ctx['page'] = new RegistrationPage(
            $invites,
            $policies,
            Mockery::mock(PolicyVersionRepository::class),
            Mockery::mock(AcceptanceRepository::class),
            $this->ctx['settings'],
            $this->ctx['mailer'],
        );

        $_POST = [];
    }

    protected function tearDown(): void
    {
        $_POST    = [];
        $_GET     = [];
        $_REQUEST = [];
        parent::tearDown();
    }

    /** Stub everything render() needs on a logged-out GET request. */
    private function stubRenderContext(): void
    {
        Functions\when('is_user_logged_in')->justReturn(false);
        Functions\when('sanitize_key')->alias(static fn ($v) => strtolower((string) $v));
        Functions\when('wp_login_url')->justReturn('http://home.test/wp-login.php');
        Functions\when('wp_nonce_field')->justReturn('');
        $this->ctx['settings']->shouldReceive('openRegistrationEnabled')->andReturn(true);
    }

    private function submit(?Invite $invite, bool $open): string
    {
        $method = new \ReflectionMethod(RegistrationPage::class, 'handleSubmit');

        return (string) $method->invoke($this->ctx['page'], $invite, $open);
    }

    public function testInviteBranchCreatesAndLogsInTheStudent(): void
    {
        $_POST = [ 'password' => 'password123', 'display_name' => 'Ada' ];

        Functions\when('email_exists')->justReturn(false);
        Functions\when('wp_insert_user')->justReturn(42);
        Functions\when('is_wp_error')->justReturn(false);

        $this->ctx['invites']->shouldReceive('markAccepted')->once();
        Functions\expect('wp_set_current_user')->once()->with(42);
        Functions\expect('wp_set_auth_cookie')->once()->with(42);

        $invite = new Invite(email: '[email protected]', token: 'hash');

        self::assertSame('invite', $this->submit($invite, false));
    }

    public function testOpenBranchCreatesPendingWithoutLoginAndEmails(): void
    {
        $_POST = [ 'password' => 'password123', 'display_name' => 'Ada', 'email' => '[email protected]' ];

        Functions\when('is_email')->justReturn(true);
        Functions\when('email_exists')->justReturn(false);
        Functions\when('wp_insert_user')->justReturn(42);
        Functions\when('is_wp_error')->justReturn(false);
        // markPending internals
        Functions\when('wp_generate_password')->justReturn('rawtok');
        Functions\when('update_user_meta')->justReturn(true);
        // confirmUrl internals
        Functions\when('get_option')->justReturn(0);
        Functions\when('home_url')->justReturn('http://home.test/');
        Functions\when('add_query_arg')->alias(static fn (string $k, string $v, string $u): string => $u . '?' . $k . '=' . $v);

        $user = Mockery::mock(\WP_User::class);
        Functions\when('get_user_by')->justReturn($user);

        $this->ctx['mailer']->shouldReceive('sendConfirmation')->once()->with($user, Mockery::type('string'));
        // No invite acceptance and no auto-login in the open branch.
        $this->ctx['invites']->shouldReceive('markAccepted')->never();
        Functions\expect('wp_set_auth_cookie')->never();

        self::assertSame('confirm', $this->submit(null, true));
    }

    public function testGroupInviteCreatesPendingAutoApproveAccountEvenWhenClosed(): void
    {
        $_POST = [ 'password' => 'password123', 'display_name' => 'Ada', 'email' => '[email protected]' ];

        Functions\when('is_email')->justReturn(true);
        Functions\when('email_exists')->justReturn(false);
        Functions\when('wp_insert_user')->justReturn(42);
        Functions\when('is_wp_error')->justReturn(false);
        Functions\when('wp_generate_password')->justReturn('rawtok');
        // confirmUrl internals
        Functions\when('get_option')->justReturn(0);
        Functions\when('home_url')->justReturn('http://home.test/');
        Functions\when('add_query_arg')->alias(static fn (string $k, string $v, string $u): string => $u . '?' . $k . '=' . $v);

        // The auto-approve marker must be set alongside the pending metas.
        $metas = [];
        Functions\when('update_user_meta')->alias(static function (int $id, string $key, $value) use (&$metas): bool {
            $metas[$key] = $value;
            return true;
        });

        $user = Mockery::mock(\WP_User::class);
        Functions\when('get_user_by')->justReturn($user);

        $this->ctx['mailer']->shouldReceive('sendConfirmation')->once()->with($user, Mockery::type('string'));
        // The link is multi-use: never marked accepted, and no auto-login.
        $this->ctx['invites']->shouldReceive('markAccepted')->never();
        Functions\expect('wp_set_auth_cookie')->never();

        $invite = new Invite(
            email: '',
            token: 'hash',
            createdAt: '2024-01-01 00:00:00',
            kind: Invite::KIND_GROUP,
            expiresAt: '2024-02-01 23:59:59',
            id: 9
        );

        // Registration mode is invite-only (open = false): the group link still works.
        self::assertSame('confirm_group', $this->submit($invite, false));
        self::assertSame('1', $metas['us_auto_approve'] ?? null);
    }

    public function testGroupInviteRendersEditableEmailField(): void
    {
        $_REQUEST = ['us_invite' => 'raw-token'];
        Functions\when('is_user_logged_in')->justReturn(false);
        Functions\when('sanitize_key')->alias(static fn ($v) => strtolower((string) $v));
        Functions\when('wp_login_url')->justReturn('http://home.test/wp-login.php');
        Functions\when('wp_nonce_field')->justReturn('');
        // Invite-only mode: only the group link grants access to the form.
        $this->ctx['settings']->shouldReceive('openRegistrationEnabled')->andReturn(false);

        $invite = new Invite(
            email: '',
            token: 'hash',
            createdAt: '2024-01-01 00:00:00',
            kind: Invite::KIND_GROUP,
            expiresAt: '2024-02-01 23:59:59',
            id: 9
        );
        $this->ctx['invites']->shouldReceive('findByToken')
            ->once()
            ->with(Invite::hashToken('raw-token'))
            ->andReturn($invite);

        $html = $this->ctx['page']->render([]);

        self::assertStringContainsString('<form', $html);
        self::assertStringContainsString('name="email"', $html);
        self::assertStringNotContainsString('readonly', $html);
    }

    public function testClosedModeWithoutInviteReturnsError(): void
    {
        $result = $this->submit(null, false);

        self::assertNotSame('invite', $result);
        self::assertNotSame('confirm', $result);
        self::assertNotSame('', $result);
    }

    public function testConfirmedEmailShowsSignInLinkInsteadOfForm(): void
    {
        $_GET = ['us_confirmed' => '1'];
        $this->stubRenderContext();

        $html = $this->ctx['page']->render([]);

        self::assertStringContainsString('us-success', $html);
        self::assertStringContainsString('http://home.test/wp-login.php', $html);
        self::assertStringNotContainsString('<form', $html);
    }

    public function testConfirmedSignInLinkUsesConfiguredLoginPage(): void
    {
        $_GET = ['us_confirmed' => '1'];
        $this->stubRenderContext();
        Functions\expect('get_permalink')->once()->with(7)->andReturn('http://home.test/sign-in/');

        $html = $this->ctx['page']->render(['login_page_id' => 7]);

        self::assertStringContainsString('http://home.test/sign-in/', $html);
        self::assertStringNotContainsString('wp-login.php', $html);
    }

    public function testRegistrationFormRendersWithoutConfirmationFlag(): void
    {
        $this->stubRenderContext();

        $html = $this->ctx['page']->render([]);

        self::assertStringContainsString('<form', $html);
        self::assertStringNotContainsString('us-success', $html);
    }

    public function testExpiredConfirmationStillShowsForm(): void
    {
        $_GET = ['us_confirmed' => 'expired'];
        $this->stubRenderContext();

        $html = $this->ctx['page']->render([]);

        self::assertStringContainsString('us-error', $html);
        self::assertStringContainsString('<form', $html);
    }

    public function testValidInviteRendersEmailPrefilledAndLocked(): void
    {
        $_REQUEST = ['us_invite' => 'raw-token'];
        $this->stubRenderContext();

        $invite = new Invite(email: '[email protected]', token: 'hash', createdAt: '2024-01-01 00:00:00', id: 9);
        $this->ctx['invites']->shouldReceive('findByToken')
            ->once()
            ->with(Invite::hashToken('raw-token'))
            ->andReturn($invite);

        $html = $this->ctx['page']->render([]);

        // The invited address is shown read-only; there is no editable email input.
        self::assertStringContainsString('value="[email protected]" readonly', $html);
        self::assertStringNotContainsString('name="email"', $html);
    }

    public function testStaleInviteWithOpenRegistrationShowsEditableEmail(): void
    {
        $_REQUEST = ['us_invite' => 'raw-token'];
        $this->stubRenderContext();

        // Already-redeemed invite: not acceptable, so the open-registration form
        // must collect an email rather than showing the stale locked address.
        $invite = new Invite(
            email: '[email protected]',
            token: 'hash',
            status: Invite::STATUS_ACCEPTED,
            createdAt: '2024-01-01 00:00:00',
            id: 9
        );
        $this->ctx['invites']->shouldReceive('findByToken')->once()->andReturn($invite);

        $html = $this->ctx['page']->render([]);

        self::assertStringContainsString('name="email"', $html);
        self::assertStringNotContainsString('[email protected]', $html);
        self::assertStringNotContainsString('readonly', $html);
    }

    public function testRejectsWhenARequiredPolicyIsUnaccepted(): void
    {
        $_POST = [ 'password' => 'password123', 'display_name' => 'Ada', 'email' => '[email protected]' ];

        Functions\when('is_email')->justReturn(true);

        $policy  = new Policy(title: 'Terms', slug: 'terms', currentVersionId: 3);
        $version = new PolicyVersion(policyId: 1, versionNumber: 1, status: PolicyVersion::STATUS_PUBLISHED, id: 3);

        $this->ctx['policies']->shouldReceive('findForScope')->andReturn([ $policy ]);
        $versionRepo = (new \ReflectionProperty(RegistrationPage::class, 'versions'))->getValue($this->ctx['page']);
        $versionRepo->shouldReceive('findById')->with(3)->andReturn($version);

        $result = $this->submit(null, true);

        self::assertNotSame('confirm', $result);
        self::assertNotSame('', $result);
    }
}