<?php

use Illuminate\Support\Facades\RateLimiter;

use function Pest\Laravel\post;

test('login is rate limited after 5 failed attempts', function () {
    $email = 'admin@example.com';

    // 5 failed attempts
    foreach (range(1, 5) as $attempt) {
        post(route('login'), [
            'email' => $email,
            'password' => 'wrong-password',
        ])->assertStatus(302);
    }

    // 6th attempt should be blocked
    post(route('login'), [
        'email' => $email,
        'password' => 'wrong-password',
    ])->assertSessionHasErrors('email');

    $this->assertTrue(RateLimiter::tooManyAttempts(Str::lower($email).'|127.0.0.1', 5));
});
