<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch14PrintExportTamperingContractTest extends FullSurfaceE2EContractCase
{
public function test_print_export_and_document_generation_routes_reject_tampered_scope_fields(): void
    {
        foreach (array_slice($this->apiRoutesContainingAny(['print', 'export', 'download', 'certificate', 'badge', 'receipt', 'transcript', 'report-card']), 0, 50) as $route) {
            $method = $this->primaryMethod($route);
            $response = $this->requestAs($this->actorFor($route->uri()), $method, $route->uri(), $this->payloadFor($method, $route->uri()) + [
                'parent_id' => 99999999, 'class_section_id' => 99999999, 'include_private_notes' => true, 'include_deleted' => true, 'include_financials' => true, 'signed_by' => 'Forged Principal', 'signature' => 'data:image/png;base64,forged', 'format' => '../../storage/logs/laravel.log',
            ]);
            $this->assertControlled($response, $method, $route->uri());
            $body = strtolower($response->getContent());
            foreach (['app_key', 'laravel.log', 'password', 'remember_token', 'sqlstate'] as $forbidden) { $this->assertStringNotContainsString($forbidden, $body); }
        }
    }

    public function test_low_privilege_users_cannot_generate_full_school_exports(): void
    {
        foreach (array_slice($this->apiRoutesContainingAny(['export', 'download', 'print', 'report', 'certificate']), 0, 35) as $route) {
            $method = $this->primaryMethod($route);
            foreach ([$this->parent, $this->teacher, $this->studentUser] as $actor) {
                $response = $this->requestAs($actor, $method, $route->uri(), ['scope' => 'all_school', 'all_students' => true, 'include_finance' => true, 'include_guardians' => true, 'format' => 'csv']);
                $this->assertStatusIn($response, [200, 204, 302, 400, 401, 403, 404, 405, 409, 419, 422], $method . ' ' . $route->uri());
                $this->assertStringNotContainsString('remember_token', strtolower($response->getContent()));
            }
        }
    }
}
