<?php

declare(strict_types=1);

namespace Drupal\Tests\system\Functional\System;

use Drupal\Tests\BrowserTestBase;
use Drupal\Tests\system\Functional\Cache\AssertPageCacheContextsAndTagsTrait;
use Drupal\user\RoleInterface;
use PHPUnit\Framework\Attributes\Group;
use PHPUnit\Framework\Attributes\RunTestsInSeparateProcesses;

/**
 * Tests page access denied functionality, including custom 403 pages.
 */
#[Group('system')]
#[RunTestsInSeparateProcesses]
class AccessDeniedTest extends BrowserTestBase {

  use AssertPageCacheContextsAndTagsTrait;

  /**
   * {@inheritdoc}
   */
  protected static $modules = ['block', 'node', 'path', 'system_test'];

  /**
   * {@inheritdoc}
   */
  protected $defaultTheme = 'stark';

  /**
   * The test user.
   *
   * @var \Drupal\Core\Session\AccountInterface
   */
  protected $adminUser;

  /**
   * {@inheritdoc}
   */
  protected function setUp(): void {
    parent::setUp();

    $this->drupalPlaceBlock('page_title_block');

    // Create an administrative user.
    $this->adminUser = $this->drupalCreateUser([
      'access administration pages',
      'administer site configuration',
      'link to any page',
      'administer blocks',
    ]);
    $this->adminUser->roles[] = 'administrator';
    $this->adminUser->save();

    user_role_grant_permissions(RoleInterface::ANONYMOUS_ID, ['access user profiles']);
    user_role_grant_permissions(RoleInterface::AUTHENTICATED_ID, ['access user profiles']);
  }

  /**
   * Tests access denied functionality.
   */
  public function testAccessDenied(): void {
    $this->drupalGet('admin');
    $this->assertSession()->pageTextContains('Access denied');
    $this->assertSession()->statusCodeEquals(403);

    // Ensure that users without permission are denied access and have the
    // correct path information in drupalSettings.
    $this->drupalLogin($this->createUser([]));
    $this->drupalGet('admin', ['query' => ['foo' => 'bar']]);

    $settings = $this->getDrupalSettings();
    $this->assertEquals('admin', $settings['path']['currentPath']);
    $this->assertTrue($settings['path']['currentPathIsAdmin']);
    $this->assertEquals(['foo' => 'bar'], $settings['path']['currentQuery']);

    $this->drupalLogin($this->adminUser);

    // Set a custom 404 page without a starting slash.
    $edit = [
      'site_403' => 'user/' . $this->adminUser->id(),
    ];
    $this->drupalGet('admin/config/system/site-information');
    $this->submitForm($edit, 'Save configuration');
    $this->assertSession()->pageTextContains("The path '{$edit['site_403']}' has to start with a slash.");

    // Use a custom 403 page.
    $edit = [
      'site_403' => '/user/' . $this->adminUser->id(),
    ];
    $this->drupalGet('admin/config/system/site-information');
    $this->submitForm($edit, 'Save configuration');

    // Enable the user login block.
    $block = $this->drupalPlaceBlock('user_login_block', ['id' => 'login']);

    // Log out and check that the user login block is shown on custom 403 pages.
    $this->drupalLogout();
    $this->drupalGet('admin');
    $this->assertSession()->pageTextContains($this->adminUser->getAccountName());
    $this->assertSession()->pageTextContains('Username');

    // Log back in and remove the custom 403 page.
    $this->drupalLogin($this->adminUser);
    $edit = [
      'site_403' => '',
    ];
    $this->drupalGet('admin/config/system/site-information');
    $this->submitForm($edit, 'Save configuration');

    // Logout and check that the user login block is shown on default 403 pages.
    $this->drupalLogout();
    $this->drupalGet('admin');
    $this->assertSession()->pageTextContains('Access denied');
    $this->assertSession()->statusCodeEquals(403);
    $this->assertSession()->pageTextContains('Username');

    // Log back in, set the custom 403 page to /user/login and remove the block.
    $this->drupalLogin($this->adminUser);
    $this->config('system.site')->set('page.403', '/user/login')->save();
    $block->disable()->save();

    // Check that we can log in from the 403 page.
    $this->drupalLogout();
    $edit = [
      'name' => $this->adminUser->getAccountName(),
      'pass' => $this->adminUser->pass_raw,
    ];
    $this->drupalGet('admin/config/system/site-information');
    $this->submitForm($edit, 'Log in');

    // Check that we're still on the same page.
    $this->assertSession()->pageTextContains('Basic site settings');
  }

  /**
   * Tests that an inaccessible custom 403 page falls back to the default.
   */
  public function testAccessDeniedCustomPageWithAccessDenied(): void {
    // Sets up a 403 page not accessible by the anonymous user.
    $this->config('system.site')->set('page.403', '/system-test/custom-4xx')->save();

    $this->drupalGet('/system-test/always-denied');
    $this->assertSession()->pageTextNotContains('Admin-only 4xx response');
    $this->assertSession()->pageTextContains('You are not authorized to access this page.');
    $this->assertSession()->statusCodeEquals(403);
    // Verify the access cacheability metadata for custom 403 is bubbled.
    $this->assertCacheContext('user.roles');

    $this->drupalLogin($this->adminUser);
    $this->drupalGet('/system-test/always-denied');
    $this->assertSession()->pageTextContains('Admin-only 4xx response');
    $this->assertSession()->statusCodeEquals(403);
    // Verify the access cacheability metadata for custom 403 is bubbled.
    $this->assertCacheContext('user.roles');

    // Create a custom 403 page with a path alias.
    $this->drupalCreateContentType(['type' => 'page']);
    $this->drupalCreateNode([
      'body' => "Dave, I'm afraid you can't do that.",
      'path' => '/custom-access-denied',
    ]);
    $edit = ['site_403' => '/custom-access-denied'];
    $this->drupalGet('admin/config/system/site-information');
    $this->submitForm($edit, 'Save configuration');
    $assert_session = $this->assertSession();
    $assert_session->statusMessageContains('The configuration options have been saved.');
    $this->assertSame('/custom-access-denied', $this->config('system.site')->get('page.403'));
    $this->drupalGet('/system-test/always-denied');
    $assert_session->statusCodeEquals(403);
    $assert_session->pageTextContains("Dave, I'm afraid you can't do that.");
  }

}