<?php
use PHPUnit\Framework\TestCase;
require_once __DIR__ . '/../src/session.php';
final class SessionTest extends TestCase {
    public function testDemarrerSessionDurcitLeCookie(): void {
        $this->assertSame(PHP_SESSION_NONE, session_status());
        demarrer_session_publique();
        $this->assertSame(PHP_SESSION_ACTIVE, session_status());
        $p = session_get_cookie_params();
        $this->assertTrue($p['httponly']);
        $this->assertSame('Lax', $p['samesite']);
        $this->assertFalse($p['secure'], 'secure ne doit pas être forcé hors HTTPS (dev local en http)');
    }
    public function testDemarrerSessionTolereUneSessionDejaActive(): void {
        demarrer_session_publique();
        demarrer_session_publique(); // second appel : ne doit produire ni warning ni erreur
        $this->assertSame(PHP_SESSION_ACTIVE, session_status());
    }
    public function testCookieSecureActiveEnHttps(): void {
        if (session_status() === PHP_SESSION_ACTIVE) {
            session_write_close(); // les params de cookie ne s'appliquent qu'à une session non démarrée
        }
        $_SERVER['HTTPS'] = 'on';
        try {
            demarrer_session_publique();
        } finally {
            unset($_SERVER['HTTPS']);
        }
        $this->assertTrue(session_get_cookie_params()['secure']);
    }
}