<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiPaginationCursorAndOffsetAbuseContractTest extends FullSurfaceE2EContractCase
{
    public function test_list_routes_handle_cursor_offset_and_per_page_abuse_without_crashing(): void
    {
        $routes = array_slice(array_filter($this->apiRoutes(), fn ($route) => $this->primaryMethod($route) === 'GET'), 0, 180);
        $query = [
            'page' => -999999,
            'per_page' => 1000000,
            'limit' => PHP_INT_MAX,
            'offset' => -1,
            'cursor' => str_repeat('A', 2048),
            'after' => '../../../../etc/passwd',
            'before' => '<script>alert(1)</script>',
        ];

        foreach ($routes as $route) {
            $uri = $route->uri();
            $response = $this->requestAs($this->actorFor($uri), 'GET', $uri, $query);

            $this->assertControlled($response, 'GET', $uri);
            $this->assertNoServerError($response, 'pagination cursor abuse at GET ' . $uri);
        }
    }
}
