<?php

use CodeIgniter\Test\CIUnitTestCase;
use Config\Filters;
use Config\Security;

/**
 * CSRF stays enabled for development/production. Tests skip it only because
 * ENVIRONMENT === testing (see Config\Filters::__construct).
 *
 * @internal
 */
final class CsrfConfigTest extends CIUnitTestCase
{
    public function testCsrfFilterIsConfiguredInApplicationFilters(): void
    {
        $source = (string) file_get_contents(APPPATH . 'Config/Filters.php');
        $this->assertStringContainsString("'csrf'", $source);
        $this->assertStringContainsString('ENVIRONMENT === \'testing\'', $source);

        $security = new Security();
        $this->assertSame('cookie', $security->csrfProtection);
        $this->assertNotSame('', $security->tokenName);
        $this->assertNotSame('', $security->cookieName);
    }

    public function testTestingEnvironmentSkipsGlobalCsrf(): void
    {
        $this->assertSame('testing', ENVIRONMENT);
        $filters = new Filters();
        $this->assertNotContains('csrf', $filters->globals['before']);
    }
}
