<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch15GlobalSearchAndDirectoryEnumerationContractTest extends FullSurfaceE2EContractCase
{

    public function test_batch15_global_search_directory_and_lookup_routes_resist_enumeration_inputs(): void
    {
        $routes = $this->apiRoutesContainingAny(['search', 'lookup', 'directory', 'autocomplete', 'users', 'students', 'parents']);
        $queries = ['a', '*', '%', '@', 'admin@example.com', $this->admin->email, ' OR 1=1 --', str_repeat('x', 2048)];

        foreach (array_slice($routes, 0, 45) as $route) {
            $method = $this->primaryMethod($route);
            foreach (array_slice($queries, 0, 4) as $query) {
                $response = $this->requestAs($this->studentUser, $method, $route->uri(), $this->payloadFor($method, $route->uri()) + [
                    'q' => $query,
                    'search' => $query,
                    'email' => $query,
                    'scope' => 'all',
                ]);

                $this->assertControlled($response, $method, $route->uri());
                $this->assertStringNotContainsString('sqlstate', strtolower($response->getContent()));
            }
        }
    }

}
