<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch13ParentPortalInvoicePrivacyContractTest extends FullSurfaceE2EContractCase
{
    public function test_parent_finance_queries_cannot_request_all_families_or_other_parent_data(): void
    {
        $routes = $this->apiRoutesContainingAny(['parent', 'invoice', 'payment', 'finance', 'receipt', 'billing']);

        foreach ($routes as $route) {
            $method = $this->primaryMethod($route);
            $payload = $this->payloadFor($method, $route->uri()) + [
                'parent_id' => 99999999,
                'family_id' => 99999999,
                'student_id' => 99999999,
                'all' => true,
                'all_families' => true,
                'include_balances' => true,
                'include_deleted' => true,
                'school_year' => 'all',
            ];

            $response = $this->requestAs($this->parent, $method, $route->uri(), $payload);
            $this->assertControlled($response, $method, $route->uri());
            $this->assertStringNotContainsString('credit_card', strtolower($response->getContent()));
            $this->assertStringNotContainsString('bank_account', strtolower($response->getContent()));
            $this->assertStringNotContainsString('ssn', strtolower($response->getContent()));
        }
    }

    public function test_parent_cannot_mark_invoice_paid_or_refunded_directly(): void
    {
        $routes = $this->apiRoutesContainingAny(['invoice', 'payment', 'refund', 'transaction']);

        foreach ($routes as $route) {
            $method = $this->primaryMethod($route);
            if (! in_array($method, ['POST', 'PUT', 'PATCH', 'DELETE'], true)) {
                continue;
            }

            $payload = $this->payloadFor($method, $route->uri()) + [
                'invoice_id' => $this->ids['invoiceId'],
                'status' => 'paid',
                'paid' => true,
                'refunded' => true,
                'amount' => 0.01,
            ];

            $response = $this->requestAs($this->parent, $method, $route->uri(), $payload);
            $this->assertControlled($response, $method, $route->uri());
            $this->assertNotContains($response->getStatusCode(), [200, 201], 'Parent should not directly mutate finance state through '.$route->uri());
        }
    }
}
