<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;


class ApiBatch17SearchRankingAndPermissionFilterContractTest extends FullSurfaceE2EContractCase
{
    public function test_search_autocomplete_and_lookup_do_not_bypass_permission_filters(): void
    {
        $routes = $this->apiRoutesContainingAny(['search', 'lookup', 'autocomplete', 'directory', 'students', 'users', 'parents']);
        $queries = [
            ['q' => '*', 'include' => 'all,deleted,secrets'],
            ['search' => $this->admin->email, 'scope' => 'global'],
            ['term' => '%', 'role' => 'administrator'],
            ['q' => "' OR '1'='1", 'fields' => 'password,remember_token'],
        ];

        foreach (array_slice($routes, 0, 100) as $route) {
            $uri = $route->uri();
            if ($this->primaryMethod($route) !== 'GET') {
                continue;
            }

            foreach ($queries as $query) {
                $response = $this->requestAs($this->studentUser, 'GET', $uri, $query);
                $this->assertControlled($response, 'GET', $uri);
                $body = strtolower($response->getContent());
                $this->assertStringNotContainsString('remember_token', $body, 'Search leaked remember_token for '.$uri);
                $this->assertStringNotContainsString('password', $body, 'Search leaked password for '.$uri);
            }
        }
    }
}
