<?php

declare(strict_types=1);

namespace Tests\Feature\Api\V1;

use Illuminate\Support\Facades\RateLimiter;
use Infra\Providers\AppServiceProvider;

covers(AppServiceProvider::class);

describe('API V1 Rate Limiting Feature Tests', function (): void {
    it('applies rate limiting partitioned by client IP', function (): void {
        // GIVEN
        /** @var \Tests\TestCase $this */
        RateLimiter::clear('api.v1:192.168.1.100');

        // WHEN: Making requests within limit
        $response = $this->withServerVariables(['REMOTE_ADDR' => '192.168.1.100'])
            ->getJson('/api/v1/health');

        // THEN
        $response->assertStatus(200);
        expect($response->headers->has('X-RateLimit-Limit'))->toBeTrue();
        expect($response->headers->has('X-RateLimit-Remaining'))->toBeTrue();
    });

    it('does not resolve rate limit key from untrusted raw X-Forwarded-For header', function (): void {
        // GIVEN
        /** @var \Tests\TestCase $this */
        $clientIp = '10.20.30.40';

        // WHEN: Making request with spoofed X-Forwarded-For header
        $response = $this->withServerVariables(['REMOTE_ADDR' => $clientIp])
            ->withHeaders(['X-Forwarded-For' => '203.0.113.195'])
            ->getJson('/api/v1/health');

        // THEN
        $response->assertStatus(200);
    });
});