<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch15MetadataFilteringAndSparseFieldsetSecurityContractTest extends FullSurfaceE2EContractCase
{

    public function test_batch15_sparse_fieldsets_metadata_and_embeds_do_not_reveal_sensitive_associations(): void
    {
        $routes = $this->apiRoutesContainingAny(['users', 'students', 'parents', 'family', 'finance', 'attendance', 'reports', 'dashboard']);

        foreach (array_slice($routes, 0, 55) as $route) {
            $method = $this->primaryMethod($route);
            if ($method !== 'GET') {
                continue;
            }

            $response = $this->requestAs($this->parent, $method, $route->uri(), [
                'fields' => '*,password,remember_token,permissions,roles,audit_logs',
                'include' => 'users,roles,permissions,finance.raw_provider_payload,deleted,archived',
                'meta' => 'debug,sql,bindings,policies',
                'debug' => true,
            ]);

            $this->assertControlled($response, $method, $route->uri());
            $body = strtolower($response->getContent());
            foreach (['remember_token', 'raw_provider_payload', 'sql', 'bindings', 'password'] as $forbidden) {
                $this->assertStringNotContainsString($forbidden, $body);
            }
        }
    }

}
