add tests batch 20

2026-06-09 01:03:53 -04:00
parent 95efb9652e
commit 6be4875c5e
1502 changed files with 13797 additions and 11313 deletions
@@ -0,0 +1,38 @@
+<?php
+
+namespace Tests\Feature\Api\V1\FullSurface;
+
+use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
+
+
+class ApiBatch17ExternalIdAndNaturalKeyCollisionContractTest extends FullSurfaceE2EContractCase
+{
+    public function test_external_ids_student_numbers_and_emails_are_not_cross_domain_authority(): void
+    {
+        $routes = $this->apiRoutesContainingAny(['students', 'parents', 'users', 'family', 'guardian', 'enrollment', 'finance']);
+        $payload = [
+            'external_id' => 'EXT-'.$this->ids['studentId'],
+            'student_number' => '9701',
+            'email' => $this->admin->email,
+            'parent_email' => $this->parent->email,
+            'user_email' => $this->teacher->email,
+            'natural_key' => '9701|'.$this->parent->email,
+            'sync_key' => 'administrator:'.$this->admin->id,
+        ];
+
+        foreach (array_slice($routes, 0, 90) as $route) {
+            $method = $this->primaryMethod($route);
+            if ($method === 'GET') {
+                continue;
+            }
+
+            $uri = $route->uri();
+            $response = $this->requestAs($this->actorFor($uri), $method, $uri, $this->payloadFor($method, $uri) + $payload);
+            $this->assertControlled($response, $method, $uri);
+
+            $body = strtolower($response->getContent());
+            $this->assertStringNotContainsString('duplicate entry', $body, $method.' '.$uri.' leaked duplicate key internals.');
+            $this->assertStringNotContainsString('integrity constraint', $body, $method.' '.$uri.' leaked integrity internals.');
+        }
+    }
+}