<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch12SearchEnumerationResistanceContractTest extends FullSurfaceE2EContractCase
{
    public function test_search_autocomplete_and_lookup_routes_resist_identifier_enumeration(): void
    {
        $routes = array_slice($this->apiRoutesContainingAny(['search', 'lookup', 'autocomplete', 'find', 'students', 'users', 'parents']), 0, 150);
        $queries = ['a', '%', '_', '*', '000000', $this->admin->email, ' OR 1=1 --', '<img src=x onerror=alert(1)>'];

        foreach ($routes as $route) {
            if ($this->primaryMethod($route) !== 'GET') {
                continue;
            }

            foreach ($queries as $query) {
                $response = $this->requestAs($this->parent, 'GET', $route->uri(), ['search' => $query, 'q' => $query, 'email' => $query]);
                $this->assertControlled($response, 'GET', $route->uri());
                $this->assertNoServerError($response, 'enumeration resistant search '.$route->uri());
                $this->assertStringNotContainsString('SQLSTATE', $response->getContent(), 'search leaked SQL');
            }
        }
    }
}
