require "rails_helper"

RSpec.describe "Public logout", type: :request do
  let!(:user) do
    User.create!(email: "logout-user@test.it", name: "Logout", password: "Password123", role: "coach")
  end

  def login!
    ActionController::Base.allow_forgery_protection = false
    post public_login_path, params: { email: user.email, password: "Password123" }
    ActionController::Base.allow_forgery_protection = true
  end

  around do |example|
    was = ActionController::Base.allow_forgery_protection
    example.run
  ensure
    ActionController::Base.allow_forgery_protection = was
  end

  it "disconnette anche senza authenticity_token (CSRF stale)" do
    login!
    expect(session[:user_id]).to eq(user.id)

    delete "/logout"
    expect(response).to redirect_to(public_pricing_path)
    follow_redirect!
    expect(session[:user_id]).to be_nil
  end

  it "accetta anche GET /logout come fallback" do
    login!
    get "/logout"
    expect(response).to redirect_to(public_pricing_path)
    expect(session[:user_id]).to be_nil
  end
end