<?php

declare(strict_types=1);

use Steuerkram\Auth;

class SessionCookieHardeningTest extends TestCase
{
    protected string $testName = 'Test 54: Session-Cookie-Härtung (HttpOnly, SameSite, Secure)';

    public function run(): void
    {
        $httpsBackup    = $_SERVER['HTTPS'] ?? null;
        $forwardBackup  = $_SERVER['HTTP_X_FORWARDED_PROTO'] ?? null;
        unset($_SERVER['HTTPS'], $_SERVER['HTTP_X_FORWARDED_PROTO']);
        putenv('SESSION_COOKIE_SECURE');

        try {
            // Plain HTTP ohne Override: httponly/samesite immer gesetzt, secure aus
            Auth::startSession();
            $params = session_get_cookie_params();
            $this->assert($params['httponly'] === true, 'HttpOnly-Flag ist gesetzt');
            $this->assertEquals('Lax', $params['samesite'], 'SameSite steht auf Lax');
            $this->assert($params['secure'] === false, 'Secure ist bei Plain-HTTP ohne Override deaktiviert');
            session_write_close();

            // Erzwungenes Secure per Env, unabhängig vom Request
            putenv('SESSION_COOKIE_SECURE=1');
            Auth::startSession();
            $params = session_get_cookie_params();
            $this->assert($params['secure'] === true, 'SESSION_COOKIE_SECURE=1 erzwingt Secure-Flag');
            session_write_close();

            // Override hat Vorrang vor erkanntem HTTPS-Request
            putenv('SESSION_COOKIE_SECURE=0');
            $_SERVER['HTTPS'] = 'on';
            Auth::startSession();
            $params = session_get_cookie_params();
            $this->assert($params['secure'] === false, 'SESSION_COOKIE_SECURE=0 deaktiviert Secure trotz HTTPS-Request');
            session_write_close();

            // Ohne Override: Reverse-Proxy-Header aktiviert Secure automatisch
            putenv('SESSION_COOKIE_SECURE');
            unset($_SERVER['HTTPS']);
            $_SERVER['HTTP_X_FORWARDED_PROTO'] = 'https';
            Auth::startSession();
            $params = session_get_cookie_params();
            $this->assert($params['secure'] === true, 'X-Forwarded-Proto: https aktiviert Secure automatisch');
            session_write_close();
        } finally {
            putenv('SESSION_COOKIE_SECURE');
            if ($httpsBackup === null) {
                unset($_SERVER['HTTPS']);
            } else {
                $_SERVER['HTTPS'] = $httpsBackup;
            }
            if ($forwardBackup === null) {
                unset($_SERVER['HTTP_X_FORWARDED_PROTO']);
            } else {
                $_SERVER['HTTP_X_FORWARDED_PROTO'] = $forwardBackup;
            }
        }
    }
}