<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch13ReportCardTranscriptCertificateForgeryContractTest extends FullSurfaceE2EContractCase
{
    public function test_document_generation_rejects_forged_finalization_and_signer_payloads(): void
    {
        $routes = $this->apiRoutesContainingAny(['report-card', 'transcript', 'certificate', 'print', 'badge', 'sticker', 'slip']);

        foreach ($routes as $route) {
            $method = $this->primaryMethod($route);
            if (! in_array($method, ['POST', 'PUT', 'PATCH'], true)) {
                continue;
            }

            $payload = $this->payloadFor($method, $route->uri()) + [
                'student_id' => $this->ids['studentId'],
                'class_section_id' => $this->ids['classSectionId'],
                'finalized' => true,
                'locked' => true,
                'approved_by' => $this->parent->id,
                'principal_signature' => '<script>forge()</script>',
                'certificate_number' => '../CERT-FORGED',
                'issue_date' => '2099-12-31',
            ];

            $response = $this->requestAs($this->teacher, $method, $route->uri(), $payload);
            $this->assertControlled($response, $method, $route->uri());
            $this->assertStringNotContainsString('<script>forge()</script>', $response->getContent());
        }
    }

    public function test_students_and_parents_cannot_generate_admin_documents_for_other_students(): void
    {
        $routes = $this->apiRoutesContainingAny(['certificate', 'transcript', 'badge', 'report-card', 'print']);

        foreach ($routes as $route) {
            $method = $this->primaryMethod($route);
            $payload = ['student_id' => 99999999, 'all_students' => true, 'school_year' => 'all'];

            foreach ([$this->parent, $this->studentUser] as $actor) {
                $response = $this->requestAs($actor, $method, $route->uri(), $payload);
                $this->assertControlled($response, $method, $route->uri());
                $this->assertStringNotContainsString('private_key', strtolower($response->getContent()));
            }
        }
    }
}
