<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiCsvExcelFormulaInjectionContractTest extends FullSurfaceE2EContractCase
{
    public function test_exportable_and_importable_text_fields_handle_excel_formula_payloads(): void
    {
        $routes = array_slice($this->apiRoutesContainingAny(['export', 'import', 'students', 'parents', 'finance', 'inventory', 'reports', 'messages']), 0, 140);
        $formulas = ['=HYPERLINK("https://evil.example","click")', '+cmd|\'/C calc\'!A0', '-10+20', '@SUM(1+1)'];

        foreach ($routes as $route) {
            $method = $this->primaryMethod($route);
            $uri = $route->uri();

            foreach ($formulas as $formula) {
                $payload = $this->payloadFor($method, $uri) + [
                    'name' => $formula,
                    'firstname' => $formula,
                    'lastname' => $formula,
                    'notes' => $formula,
                    'description' => $formula,
                    'csv_value' => $formula,
                ];

                $response = $this->requestAs($this->actorFor($uri), $method, $uri, $payload);

                $this->assertControlled($response, $method, $uri);
                $this->assertNoServerError($response, 'CSV formula payload at ' . $method . ' ' . $uri);
            }
        }
    }
}
