hado/core/tests/Feature/TelegramWebhookTest.php

<?php

namespace Tests\Feature;

use App\Enums\AfterDue;
use App\Enums\ChannelType;
use App\Enums\DeliveryResult;
use App\Enums\DueMode;
use App\Enums\EventState;
use App\Models\Channel;
use App\Models\Delivery;
use App\Models\Event;
use App\Models\Source;
use App\Models\User;
use Carbon\CarbonImmutable;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Http\Client\Request;
use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\Http;
use Tests\TestCase;

class TelegramWebhookTest extends TestCase
{
    use RefreshDatabase;

    private User $user;

    protected function setUp(): void
    {
        parent::setUp();
        Http::fake(['api.telegram.org/*' => Http::response(['ok' => true, 'result' => []])]);
        $this->user = User::create(['login' => 'n', 'tz' => 'UTC', 'quiet_start' => '22:00:00', 'quiet_end' => '09:00:00']);
    }

    private function secret(): array
    {
        return ['X-Telegram-Bot-Api-Secret-Token' => 'test-secret'];
    }

    public function test_rejects_wrong_secret(): void
    {
        $this->postJson('/hooks/telegram', ['message' => []])->assertStatus(403);
        $this->postJson('/hooks/telegram', ['message' => []], ['X-Telegram-Bot-Api-Secret-Token' => 'wrong'])->assertStatus(403);
    }

    public function test_public_route_sets_no_session_cookie(): void
    {
        $this->postJson('/hooks/telegram', ['message' => []])
            ->assertStatus(403)
            ->assertHeaderMissing('Set-Cookie');
    }

    public function test_start_with_code_links_chat(): void
    {
        Cache::put('tg:link:ABC123', $this->user->id, 900);

        $this->postJson('/hooks/telegram', ['message' => ['chat' => ['id' => 555], 'text' => '/start ABC123']], $this->secret())->assertNoContent();

        $channel = $this->user->channels()->where('type', ChannelType::Telegram->value)->sole();
        $this->assertSame(555, $channel->config['chat_id']);
        $this->assertFalse(Cache::has('tg:link:ABC123'), 'код одноразовый');
        $this->assertTrue(Cache::has('tg:seen:555'), 'взаимодействие = присутствие');
        Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/sendMessage') && $r['text'] === 'Подключено');
    }

    public function test_start_with_bad_code_replies_error(): void
    {
        $this->postJson('/hooks/telegram', ['message' => ['chat' => ['id' => 555], 'text' => '/start NOPE']], $this->secret())->assertNoContent();
        $this->assertSame(0, Channel::count());
        Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/sendMessage') && str_contains($r['text'], 'Код'));
    }

    public function test_callback_ack_and_done(): void
    {
        CarbonImmutable::setTestNow('2026-09-30T11:17:00Z');
        $source = Source::create(['name' => 'docs', 'token_hash' => hash('sha256', 'x')]);
        $channel = Channel::create(['user_id' => $this->user->id, 'type' => ChannelType::Telegram, 'config' => ['chat_id' => 555], 'enabled' => true]);
        $event = Event::create([
            'source_id' => $source->id, 'user_id' => $this->user->id, 'source_ref' => 'r', 'topic' => '',
            'due_mode' => DueMode::Local, 'due_date' => '2026-09-30', 'due_time' => '24:00:00', 'fire_on' => '2026-09-30',
            'after_due' => AfterDue::Keep, 'payload' => ['title' => 'T'], 'state' => EventState::Today,
            'quiet_until' => CarbonImmutable::parse('2000-01-01Z'),
        ]);
        Delivery::create(['event_id' => $event->id, 'channel_id' => $channel->id, 'window_start' => now(), 'action_token' => 'tok', 'result' => DeliveryResult::Ok, 'meta' => ['message_id' => 9001]]);

        $cb = fn (string $data) => ['callback_query' => ['id' => 'cb1', 'data' => $data, 'message' => ['chat' => ['id' => 555], 'message_id' => 9001]]];

        $this->postJson('/hooks/telegram', $cb('ack:tok'), $this->secret())->assertNoContent();
        $this->assertSame('2026-09-30T13:00:00+00:00', $event->fresh()->quiet_until->toIso8601String());
        Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/answerCallbackQuery') && $r['callback_query_id'] === 'cb1');

        $this->postJson('/hooks/telegram', $cb('done:tok'), $this->secret())->assertNoContent();
        $this->assertSame(EventState::Done, $event->fresh()->state);
        Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/editMessageReplyMarkup') && $r['message_id'] === 9001);

        $this->postJson('/hooks/telegram', $cb('done:tok'), $this->secret())->assertNoContent();
        Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/answerCallbackQuery') && $r['text'] === 'Уже неактуально');

        CarbonImmutable::setTestNow();
    }

    public function test_unrelated_update_is_ignored(): void
    {
        $this->postJson('/hooks/telegram', ['edited_message' => ['chat' => ['id' => 1]]], $this->secret())->assertNoContent();
    }

    public function test_malformed_callback_is_ignored(): void
    {
        $this->postJson('/hooks/telegram', ['callback_query' => ['data' => 'ack:nope']], $this->secret())->assertNoContent();

        $this->postJson('/hooks/telegram', ['callback_query' => ['id' => 'x', 'data' => 'garbage']], $this->secret())->assertNoContent();
        Http::assertSent(fn (Request $r) => str_ends_with($r->url(), '/answerCallbackQuery') && $r['text'] === 'Уже неактуально');
    }
}