<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch13ObservableErrorCorrelationContractTest extends FullSurfaceE2EContractCase
{
    public function test_malformed_requests_preserve_safe_error_correlation_without_reflecting_header_injection(): void
    {
        $routes = array_slice($this->apiRoutes(), 0, 100);

        foreach ($routes as $route) {
            $method = $this->primaryMethod($route);
            $this->withHeaders([
                'X-Request-Id' => "batch13\r\nX-Injected: yes",
                'X-Correlation-Id' => '<script>correlate()</script>',
            ]);

            $response = $this->requestAs($this->actorFor($route->uri()), $method, $route->uri(), [
                'batch13_malformed' => ['unexpected' => ['deep' => ['value' => str_repeat('x', 4096)]]],
            ]);

            $this->assertControlled($response, $method, $route->uri());
            $content = $response->getContent();
            $this->assertStringNotContainsString('X-Injected: yes', $content);
            $this->assertStringNotContainsString('<script>correlate()</script>', $content);
            $this->assertStringNotContainsString('/var/www', $content);
        }
    }

    public function test_error_responses_do_not_disclose_controller_or_model_stack_details(): void
    {
        $routes = array_slice($this->apiRoutesContainingAny(['students', 'users', 'finance', 'attendance', 'settings']), 0, 60);

        foreach ($routes as $route) {
            $method = $this->primaryMethod($route);
            $response = $this->requestAs($this->actorFor($route->uri()), $method, $route->uri(), ['id' => '../invalid']);
            $this->assertControlled($response, $method, $route->uri());

            $body = strtolower($response->getContent());
            $this->assertStringNotContainsString('app\\http\\controllers', $body);
            $this->assertStringNotContainsString('illuminate\\database', $body);
            $this->assertStringNotContainsString('vendor/laravel', $body);
        }
    }
}
