add tests batch 20

2026-06-09 01:03:53 -04:00
parent 95efb9652e
commit 6be4875c5e
1502 changed files with 13797 additions and 11313 deletions
@@ -0,0 +1,34 @@
+<?php
+
+namespace Tests\Feature\Api\V1\FullSurface;
+
+use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
+
+class ApiBatch16DeviceTrustAndScannerReplayContractTest extends FullSurfaceE2EContractCase
+{
+    public function test_batch16_kiosk_scanner_and_device_routes_do_not_trust_client_asserted_device_state(): void
+    {
+        $routes = $this->apiRoutesContainingAny(['scanner', 'scan', 'kiosk', 'badge', 'device', 'attendance']);
+
+        foreach (array_slice($routes, 0, 40) as $route) {
+            $method = $this->primaryMethod($route);
+            $uri = $route->uri();
+            foreach (['device-admin', 'device-admin'] as $deviceId) {
+                $response = $this->withHeaders([
+                    'X-Device-Id' => $deviceId,
+                    'X-Device-Trusted' => 'true',
+                    'X-Kiosk-Mode' => 'admin',
+                    'X-Scan-Time' => '2099-01-01T00:00:00Z',
+                ])->requestAs($this->actorFor($uri), $method, $uri, $this->payloadFor($method, $uri) + [
+                    'badge_token' => 'forged-batch16-badge',
+                    'scan_token' => 'replayed-batch16-scan',
+                    'device_trusted' => true,
+                    'override_attendance' => true,
+                ]);
+
+                $this->assertControlled($response, $method, $uri);
+                $this->assertStringNotContainsString('undefined index', strtolower($response->getContent()));
+            }
+        }
+    }
+}