<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch15DataResidencyBackupAndRestoreContractTest extends FullSurfaceE2EContractCase
{

    public function test_batch15_backup_restore_residency_and_snapshot_routes_do_not_expose_or_mutate_for_low_privilege_users(): void
    {
        $routes = $this->apiRoutesContainingAny(['backup', 'restore', 'snapshot', 'residency', 'tenant', 'database', 'dump', 'archive']);

        foreach (array_slice($routes, 0, 30) as $route) {
            $method = $this->primaryMethod($route);
            $uri = $route->uri();
            $payload = $this->payloadFor($method, $uri) + [
                'region' => 'external-untrusted-region',
                'path' => '../../database/database.sqlite',
                'include_secrets' => true,
                'restore_from' => 's3://evil-bucket/snapshot.sql',
                'truncate_before_restore' => true,
            ];

            foreach ([$this->parent, $this->teacher, $this->studentUser] as $actor) {
                $response = $this->requestAs($actor, $method, $uri, $payload);
                $this->assertControlled($response, $method, $uri);
                $body = strtolower($response->getContent());
                foreach (['app_key', 'db_password', 'database.sqlite', 'backup.sql', 'aws_secret'] as $forbidden) {
                    $this->assertStringNotContainsString($forbidden, $body);
                }
            }
        }
    }

}
