<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch12LongRunningExportJobContractTest extends FullSurfaceE2EContractCase
{
    public function test_export_report_and_generation_routes_handle_async_parameters_without_crashing(): void
    {
        $routes = array_slice($this->apiRoutesContainingAny(['export', 'download', 'print', 'generate', 'report', 'certificate', 'badge', 'receipt']), 0, 160);

        foreach ($routes as $route) {
            $method = $this->primaryMethod($route);
            $payload = $this->payloadFor($method, $route->uri()) + [
                'async' => true,
                'notify_when_ready' => true,
                'format' => 'xlsx',
                'fields' => ['*', 'password', 'remember_token'],
                'filters' => ['scope' => 'all', 'school_year' => self::E2E_SCHOOL_YEAR],
            ];

            $response = $this->requestAs($this->actorFor($route->uri()), $method, $route->uri(), $payload);
            $this->assertControlled($response, $method, $route->uri());
            $this->assertNoServerError($response, 'long running export job '.$method.' '.$route->uri());
            $this->assertStringNotContainsString('remember_token', $response->getContent(), 'export route exposed sensitive fields');
        }
    }

    public function test_low_privilege_users_cannot_request_full_school_exports(): void
    {
        $routes = array_slice($this->apiRoutesContainingAny(['export', 'download', 'report']), 0, 120);

        foreach ($routes as $route) {
            $method = $this->primaryMethod($route);
            $response = $this->requestAs($this->parent, $method, $route->uri(), ['scope' => 'all', 'include' => ['students', 'finance', 'users']]);
            $this->assertControlled($response, $method, $route->uri());
            $this->assertNoServerError($response, 'low privilege full export '.$method.' '.$route->uri());
        }
    }
}
