<?php

namespace Tests\Feature;

use App\Models\CrmSetting;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

/**
 * The public WhatsApp webhook-verification handshake (no auth): echoes the
 * challenge only when the mode and verify token match.
 */
class CrmWebhookTest extends TestCase
{
    use RefreshDatabase;

    public function test_webhook_verify_echoes_challenge_on_match(): void
    {
        CrmSetting::current()->update(['verify_token' => 'secret-token']);

        $this->get('/api/crm/webhook?hub_mode=subscribe&hub_verify_token=secret-token&hub_challenge=12345')
            ->assertOk()
            ->assertSee('12345');
    }

    public function test_webhook_verify_rejects_wrong_token(): void
    {
        CrmSetting::current()->update(['verify_token' => 'secret-token']);

        $this->get('/api/crm/webhook?hub_mode=subscribe&hub_verify_token=wrong&hub_challenge=12345')
            ->assertStatus(403);
    }
}
