ladill-frontdesk/tests/Feature/FrontdeskMessagingIntegrationsTest.php

<?php

namespace Tests\Feature;

use App\Http\Middleware\EnsurePlatformSession;
use App\Models\Branch;
use App\Models\Member;
use App\Models\MessagingCredential;
use App\Models\Organization;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Crypt;
use Illuminate\Support\Facades\Http;
use Tests\TestCase;

class FrontdeskMessagingIntegrationsTest extends TestCase
{
    use RefreshDatabase;

    protected User $user;

    protected Organization $organization;

    protected function setUp(): void
    {
        parent::setUp();
        $this->withoutMiddleware(EnsurePlatformSession::class);

        config(['billing.api_url' => 'https://billing.test']);

        $this->user = User::create([
            'public_id' => 'test-user-msg-001',
            'name' => 'Test User',
            'email' => 'msg@example.com',
        ]);

        $this->organization = Organization::create([
            'owner_ref' => $this->user->public_id,
            'name' => 'Test Frontdesk',
            'slug' => 'test-frontdesk-msg',
            'settings' => [
                'onboarded' => true,
                'plan' => 'pro',
                'plan_expires_at' => now()->addMonth()->toIso8601String(),
            ],
        ]);

        Member::create([
            'owner_ref' => $this->user->public_id,
            'organization_id' => $this->organization->id,
            'user_ref' => $this->user->public_id,
            'role' => 'org_admin',
        ]);

        Branch::create([
            'owner_ref' => $this->user->public_id,
            'organization_id' => $this->organization->id,
            'name' => 'Main',
            'is_active' => true,
        ]);
    }

    public function test_integrations_page_loads_messaging_cards(): void
    {
        $this->actingAs($this->user)
            ->get(route('frontdesk.integrations.edit'))
            ->assertOk()
            ->assertSee('SMS')
            ->assertSee('Email')
            ->assertDontSee('bill your')
            ->assertSee('Outbound webhooks');
    }

    public function test_saving_sms_credentials_encrypts_key(): void
    {
        Http::fake([
            '*/api/sms/me' => Http::response([
                'api_key_prefix' => 'lsk_sms_live_abcd',
                'service_id' => 1,
                'status' => 'active',
            ]),
            '*/api/sms/senders' => Http::response([
                'data' => [['id' => 1, 'sender_id' => 'FrontA', 'is_default' => true]],
                'default_sender' => 'Ladill',
            ]),
        ]);

        $plain = 'lsk_sms_live_'.str_repeat('a', 32);

        $this->actingAs($this->user)
            ->post(route('frontdesk.integrations.sms.save'), [
                'sms_api_key' => $plain,
                'sms_sender_id' => 'FrontA',
            ])
            ->assertRedirect()
            ->assertSessionHas('success');

        $row = MessagingCredential::query()->where('organization_id', $this->organization->id)->first();
        $this->assertNotNull($row);
        $this->assertNotSame($plain, $row->sms_api_key_encrypted);
        $this->assertSame($plain, Crypt::decryptString($row->sms_api_key_encrypted));
        $this->assertSame(MessagingCredential::STATUS_VALID, $row->sms_status);
        $this->assertSame('FrontA', $row->sms_sender_id);
    }

    public function test_invalid_sms_key_is_rejected(): void
    {
        Http::fake([
            '*/api/sms/me' => Http::response(['error' => 'Invalid or missing API key.'], 401),
        ]);

        $this->actingAs($this->user)
            ->post(route('frontdesk.integrations.sms.save'), [
                'sms_api_key' => 'lsk_sms_live_'.str_repeat('b', 32),
                'sms_sender_id' => 'FrontA',
            ])
            ->assertRedirect()
            ->assertSessionHas('error');
    }

    public function test_host_email_requires_bird_credentials(): void
    {
        Http::fake([
            'billing.test/*' => Http::response(['affordable' => true, 'ok' => true]),
        ]);

        $host = \App\Models\Host::create([
            'owner_ref' => $this->user->public_id,
            'organization_id' => $this->organization->id,
            'name' => 'No Bird Host',
            'email' => 'nobird@example.com',
            'is_available' => true,
        ]);

        $this->actingAs($this->user)
            ->post(route('frontdesk.visits.store'), [
                'full_name' => 'Guest',
                'host_id' => $host->id,
                'visitor_type' => 'visitor',
                'policies_accepted' => '1',
            ])
            ->assertRedirect();

        Http::assertNotSent(fn ($request) => str_contains($request->url(), '/api/smtp/send'));
    }

    public function test_host_email_uses_customer_bird_relay(): void
    {
        $plain = 'lsk_live_'.str_repeat('d', 32);
        MessagingCredential::create([
            'owner_ref' => $this->user->public_id,
            'organization_id' => $this->organization->id,
            'bird_api_key_encrypted' => Crypt::encryptString($plain),
            'bird_api_key_prefix' => substr($plain, 0, 16),
            'bird_from_email' => 'frontdesk@example.test',
            'bird_from_name' => 'Frontdesk',
            'bird_status' => MessagingCredential::STATUS_VALID,
            'bird_validated_at' => now(),
        ]);

        Http::fake([
            'billing.test/*' => Http::response(['affordable' => true, 'ok' => true]),
            '*/api/smtp/send' => Http::response(['success' => true, 'message_id' => 'x']),
        ]);

        $host = \App\Models\Host::create([
            'owner_ref' => $this->user->public_id,
            'organization_id' => $this->organization->id,
            'name' => 'Bird Host',
            'email' => 'host@example.com',
            'is_available' => true,
        ]);

        $this->actingAs($this->user)
            ->post(route('frontdesk.visits.store'), [
                'full_name' => 'Guest',
                'host_id' => $host->id,
                'visitor_type' => 'visitor',
                'policies_accepted' => '1',
            ])
            ->assertRedirect();

        Http::assertSent(function ($request) use ($plain) {
            return str_contains($request->url(), '/api/smtp/send')
                && $request->hasHeader('Authorization', 'Bearer '.$plain)
                && $request['from'] === 'frontdesk@example.test'
                && $request['from_name'] === 'Frontdesk';
        });

        Http::assertNotSent(fn ($request) => str_contains($request->url(), '/debit'));
    }

    public function test_host_sms_uses_customer_relay_key(): void
    {
        $plain = 'lsk_sms_live_'.str_repeat('c', 32);
        MessagingCredential::create([
            'owner_ref' => $this->user->public_id,
            'organization_id' => $this->organization->id,
            'sms_api_key_encrypted' => Crypt::encryptString($plain),
            'sms_api_key_prefix' => substr($plain, 0, 16),
            'sms_sender_id' => 'FrontA',
            'sms_status' => MessagingCredential::STATUS_VALID,
            'sms_validated_at' => now(),
        ]);

        $this->organization->update([
            'settings' => array_merge($this->organization->settings ?? [], [
                'notification_channels' => ['sms'],
            ]),
        ]);

        Http::fake([
            'billing.test/*' => Http::response(['affordable' => true, 'ok' => true]),
            '*/api/sms/send' => Http::response(['success' => true, 'message_id' => 1]),
        ]);

        $host = \App\Models\Host::create([
            'owner_ref' => $this->user->public_id,
            'organization_id' => $this->organization->id,
            'name' => 'SMS Host',
            'phone' => '+233201111111',
            'is_available' => true,
        ]);

        $this->actingAs($this->user)
            ->post(route('frontdesk.visits.store'), [
                'full_name' => 'Guest',
                'host_id' => $host->id,
                'visitor_type' => 'visitor',
                'policies_accepted' => '1',
            ])
            ->assertRedirect();

        Http::assertSent(function ($request) use ($plain) {
            return str_contains($request->url(), '/api/sms/send')
                && $request->hasHeader('Authorization', 'Bearer '.$plain)
                && $request['sender_id'] === 'FrontA';
        });

        Http::assertNotSent(fn ($request) => str_contains($request->url(), '/debit'));
    }
}