<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch14AccountEnumerationAndIdentityPrivacyContractTest extends FullSurfaceE2EContractCase
{
public function test_identity_recovery_routes_do_not_reveal_whether_user_exists(): void
    {
        $routes = $this->apiRoutesContainingAny(['forgot', 'password', 'reset', 'verify', 'verification', 'recovery']);
        foreach (array_slice($routes, 0, 30) as $route) {
            $method = $this->primaryMethod($route);
            if (! in_array($method, ['POST', 'PUT', 'PATCH'], true)) { continue; }
            foreach ([$this->admin->email, 'missing-user-' . uniqid() . '@example.test'] as $email) {
                $response = $this->json($method, $this->materializePath($route->uri()), ['email' => $email, 'token' => 'invalid-token', 'password' => 'NewPassword123!', 'password_confirmation' => 'NewPassword123!']);
                $this->assertControlled($response, $method, $route->uri());
                $body = strtolower($response->getContent());
                $this->assertStringNotContainsString('no user found', $body);
                $this->assertStringNotContainsString('email does not exist', $body);
                $this->assertStringNotContainsString('unknown email', $body);
            }
        }
    }

    public function test_identity_payloads_do_not_leak_internal_auth_fields(): void
    {
        foreach (array_slice($this->apiRoutesContainingAny(['me', 'profile', 'frontend', 'identity', 'user']), 0, 35) as $route) {
            $method = $this->primaryMethod($route);
            $response = $this->requestAs($this->actorFor($route->uri()), $method, $route->uri(), $this->payloadFor($method, $route->uri()));
            $this->assertControlled($response, $method, $route->uri());
            $body = strtolower($response->getContent());
            foreach (['password', 'remember_token', 'two_factor', 'api_token', 'provider_token', 'secret'] as $forbidden) {
                $this->assertStringNotContainsString($forbidden, $body, $route->uri() . ' leaked identity internals.');
            }
        }
    }
}
