<?php

namespace Tests\Feature;

use App\Models\User;
use App\Models\UserNotification;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class NotificationRedirectTest extends TestCase
{
    use RefreshDatabase;

    public function test_notification_mark_read_rejects_external_redirect_targets(): void
    {
        $user = User::factory()->create();
        $notification = UserNotification::create([
            'user_id' => $user->id,
            'type' => 'lead_submitted',
            'title' => 'Lead',
            'message' => 'New lead',
            'action_url' => '/admin/leads',
        ]);

        $response = $this
            ->actingAs($user)
            ->from('/notifications')
            ->post(route('notifications.read', $notification), [
                'redirect_to' => 'https://evil.example/phish',
            ]);

        $response->assertRedirect('/notifications');
        $this->assertNotNull($notification->fresh()->read_at);
    }

    public function test_notification_mark_read_allows_internal_redirect_targets(): void
    {
        $user = User::factory()->create();
        $notification = UserNotification::create([
            'user_id' => $user->id,
            'type' => 'lead_submitted',
            'title' => 'Lead',
            'message' => 'New lead',
            'action_url' => '/admin/leads',
        ]);

        $response = $this
            ->actingAs($user)
            ->post(route('notifications.read', $notification), [
                'redirect_to' => '/admin/leads',
            ]);

        $response->assertRedirect('/admin/leads');
        $this->assertNotNull($notification->fresh()->read_at);
    }
}
