<?php

namespace Tests\Feature\Api\V1;

use App\Models\Appointment;
use App\Models\User;
use Database\Seeders\ClinicDemoSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Laravel\Sanctum\Sanctum;
use Tests\TestCase;

class AuthorizationTest extends TestCase
{
    use RefreshDatabase;

    public function test_doctor_cannot_read_another_doctors_appointment(): void
    {
        $this->seed(ClinicDemoSeeder::class);

        $doctorTwo = User::where('email', 'dr.sara@smartclinic.test')->firstOrFail();
        Sanctum::actingAs($doctorTwo);

        $doctorOneAppointment = Appointment::query()
            ->whereHas('doctor.user', fn ($q) => $q->where('email', 'dr.ali@smartclinic.test'))
            ->firstOrFail();

        $this->getJson("/api/v1/appointments/{$doctorOneAppointment->id}")
            ->assertForbidden()
            ->assertJsonPath('error.code', 'FORBIDDEN');
    }
}
