<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiSortingFieldSelectionAndIncludeContractTest extends FullSurfaceE2EContractCase
{
    /** @test */
    public function list_routes_handle_sort_fields_includes_and_sparse_fieldsets(): void
    {
        $routes = array_slice(array_filter($this->apiRoutes(), fn ($route) => $this->primaryMethod($route) === 'GET'), 0, 120);

        $querySets = [
            ['sort' => 'name', 'direction' => 'asc', 'fields' => 'id,name,created_at'],
            ['sort' => '-created_at', 'include' => 'parent,student,classSection'],
            ['sort' => 'nonexistent_column', 'direction' => 'sideways'],
            ['fields' => 'id,password,remember_token,api_token', 'include' => 'user.roles.permissions'],
            ['expand' => str_repeat('children.', 20) . 'children'],
        ];

        foreach ($routes as $route) {
            $uri = $route->uri();

            foreach ($querySets as $query) {
                $response = $this->requestAs($this->actorFor($uri), 'GET', $uri, $query);

                $this->assertControlled($response, 'GET', $uri);
                $this->assertStringNotContainsString('remember_token', $response->getContent(), "GET $uri should not expose remember_token through fields/include tricks.");
                $this->assertStringNotContainsString('api_token', $response->getContent(), "GET $uri should not expose raw api_token through fields/include tricks.");
            }
        }
    }
}
