<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiReportExportPrivacyAndAggregationContractTest extends FullSurfaceE2EContractCase
{
    public function test_teacher_and_parent_report_exports_are_scoped_to_their_assignments(): void
    {
        foreach ($this->apiRoutesContainingAny(['reports', 'export', 'download', 'print', 'pdf', 'report-cards']) as $route) {
            if ($this->primaryMethod($route) !== 'GET') {
                continue;
            }

            $uri = $route->uri();

            $parentResponse = $this->requestAs($this->parent, 'GET', $uri, [
                'student_id' => 999999,
                'parent_id' => 999999,
                'class_section_id' => 999999,
            ]);
            $this->assertStatusIn($parentResponse, [200, 204, 400, 401, 403, 404, 409, 422], "Parent report/export scope {$uri}");
            $this->assertStringNotContainsString('999999', $parentResponse->getContent());

            $teacherResponse = $this->requestAs($this->teacher, 'GET', $uri, [
                'student_id' => 999999,
                'class_section_id' => 999999,
            ]);
            $this->assertStatusIn($teacherResponse, [200, 204, 400, 401, 403, 404, 409, 422], "Teacher report/export scope {$uri}");
            $this->assertStringNotContainsString('999999', $teacherResponse->getContent());
        }
    }

    public function test_aggregate_dashboard_numbers_do_not_include_other_family_details_for_parent(): void
    {
        foreach ($this->apiRoutesContainingAny(['dashboard', 'summary', 'stats', 'reports']) as $route) {
            if ($this->primaryMethod($route) !== 'GET') {
                continue;
            }

            $response = $this->requestAs($this->parent, 'GET', $route->uri());
            $this->assertStatusIn($response, [200, 204, 400, 401, 403, 404, 409, 422], "Parent aggregate {$route->uri()}");

            if ($response->getStatusCode() < 300) {
                $this->assertStringNotContainsString('other-family', strtolower($response->getContent()));
                $this->assertStringNotContainsString('all parents', strtolower($response->getContent()));
            }
        }
    }
}
