<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;


class ApiBatch17PartialFailureErrorDetailRedactionContractTest extends FullSurfaceE2EContractCase
{
    public function test_bulk_partial_failure_details_are_actionable_without_leaking_database_or_secret_details(): void
    {
        $routes = $this->apiRoutesContainingAny(['bulk', 'batch', 'import', 'assign', 'sync', 'notify', 'export']);
        $payload = [
            'items' => [
                ['id' => $this->ids['studentId'], 'student_id' => $this->ids['studentId'], 'amount' => 10],
                ['id' => 999999999, 'student_id' => 999999999, 'amount' => 'NaN'],
                ['id' => '../../.env', 'student_id' => '<script>alert(1)</script>', 'amount' => -9999],
            ],
            'continue_on_error' => true,
            'return_failures' => true,
            'include_stack' => true,
        ];

        foreach (array_slice($routes, 0, 70) as $route) {
            $method = $this->primaryMethod($route);
            if ($method === 'GET') {
                continue;
            }

            $uri = $route->uri();
            $response = $this->requestAs($this->admin, $method, $uri, $this->payloadFor($method, $uri) + $payload);
            $this->assertControlled($response, $method, $uri);
            $body = strtolower($response->getContent());
            foreach (['sqlstate', 'stack trace', 'vendor/laravel', 'app_key', 'db_password'] as $forbidden) {
                $this->assertStringNotContainsString($forbidden, $body, $method.' '.$uri.' leaked '.$forbidden.' in partial failure response.');
            }
        }
    }
}
