<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;


class ApiBatch17ExportColumnLevelSecurityContractTest extends FullSurfaceE2EContractCase
{
    public function test_export_field_selection_cannot_request_secrets_or_cross_scope_columns(): void
    {
        $routes = $this->apiRoutesContainingAny(['export', 'download', 'report', 'print', 'receipt', 'certificate', 'transcript']);
        $payload = [
            'fields' => ['*', 'password', 'remember_token', 'api_token', 'ssn', 'medical_notes', 'admin_notes'],
            'columns' => '*,password,remember_token,api_token,db_password,app_key',
            'include' => 'users,secrets,deleted,archived,audit,all_families',
            'format' => 'csv',
            'scope' => 'global',
            'all_school' => true,
        ];

        foreach (array_slice($routes, 0, 90) as $route) {
            $method = $this->primaryMethod($route);
            $uri = $route->uri();
            $response = $this->requestAs($this->parent, $method, $uri, $this->payloadFor($method, $uri) + $payload);
            $this->assertControlled($response, $method, $uri);

            $body = strtolower($response->getContent());
            foreach (['app_key', 'db_password', 'remember_token', 'api_token'] as $secret) {
                $this->assertStringNotContainsString($secret, $body, $method.' '.$uri.' leaked '.$secret.' through export fields.');
            }
        }
    }
}
