portal/app/tests/Feature/WebhookReceiveTest.php

<?php

declare(strict_types=1);

use App\Jobs\ProcessWebhookJob;
use App\Models\Tenant;
use Illuminate\Foundation\Testing\DatabaseTransactions;
use Illuminate\Support\Facades\Bus;

uses(DatabaseTransactions::class);

beforeEach(function () {
    $this->tenant = Tenant::factory()->create([
        'webhook_token' => 'whk_test_'.bin2hex(random_bytes(8)),
        'balance_leads' => 100,
    ]);
});

test('POST /api/webhook/{token} с валидным payload возвращает 202 + dispatch ProcessWebhookJob', function () {
    Bus::fake();

    $payload = [
        'vid' => 12345,
        'project' => 'Натяжные потолки',
        'phone' => '+7 (999) 123-45-67',
        'time' => time(),
        'tag' => 'ya_direct',
    ];

    $r = $this->postJson("/api/webhook/{$this->tenant->webhook_token}", $payload);

    $r->assertStatus(202);
    expect($r->json('status'))->toBe('accepted');
    expect($r->json('tenant_id'))->toBe($this->tenant->id);

    Bus::assertDispatched(ProcessWebhookJob::class, function ($job) use ($payload) {
        return $job->tenantId === $this->tenant->id
            && $job->data['vid'] === $payload['vid']
            && $job->data['phone'] === $payload['phone'];
    });
});

test('POST с unknown token → 404', function () {
    Bus::fake();
    $r = $this->postJson('/api/webhook/whk_nonexistent_token_12345', [
        'vid' => 1,
        'project' => 'X',
        'phone' => '+7 (999) 000-00-00',
        'time' => time(),
    ]);
    $r->assertStatus(404);
    Bus::assertNothingDispatched();
});

test('POST без обязательных полей → 422', function () {
    Bus::fake();

    $r = $this->postJson("/api/webhook/{$this->tenant->webhook_token}", [
        // Нет vid/project/phone/time
    ]);

    $r->assertStatus(422);
    $errors = $r->json('errors');
    expect($errors)->toHaveKeys(['vid', 'project', 'phone', 'time']);
    Bus::assertNothingDispatched();
});

test('POST с вредной структурой (vid=строка, time=отрицательный) → 422', function () {
    Bus::fake();

    $r = $this->postJson("/api/webhook/{$this->tenant->webhook_token}", [
        'vid' => 'не-число',
        'project' => 'X',
        'phone' => '+7 (999) 000-00-00',
        'time' => -1,
    ]);

    $r->assertStatus(422);
    Bus::assertNothingDispatched();
});

test('POST к webhook НЕ требует CSRF (внешний клиент)', function () {
    Bus::fake();
    // Симулируем запрос БЕЗ X-XSRF-TOKEN — CSRF middleware не должен проверять
    // /api/webhook/* (см. bootstrap/app.php validateCsrfTokens except).
    $r = $this->postJson("/api/webhook/{$this->tenant->webhook_token}", [
        'vid' => 1,
        'project' => 'X',
        'phone' => '+7 (999) 000-00-00',
        'time' => time(),
    ]);
    $r->assertStatus(202);
});

test('POST с `phones` array (multi-phone payload) принимается', function () {
    Bus::fake();
    $r = $this->postJson("/api/webhook/{$this->tenant->webhook_token}", [
        'vid' => 1,
        'project' => 'Окна',
        'phone' => '+7 (999) 000-00-00',
        'phones' => ['+7 (999) 000-00-01', '+7 (999) 000-00-02'],
        'time' => time(),
    ]);
    $r->assertStatus(202);
    Bus::assertDispatched(ProcessWebhookJob::class, function ($job) {
        return is_array($job->data['phones']) && count($job->data['phones']) === 2;
    });
});