add test batches

tests/Feature/Api/V1/FullSurface/ApiBatch12SearchEnumerationResistanceContractTest.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Tests\Feature\Api\V1\FullSurface;
+
+use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
+
+class ApiBatch12SearchEnumerationResistanceContractTest extends FullSurfaceE2EContractCase
+{
+    public function test_search_autocomplete_and_lookup_routes_resist_identifier_enumeration(): void
+    {
+        $routes = array_slice($this->apiRoutesContainingAny(['search', 'lookup', 'autocomplete', 'find', 'students', 'users', 'parents']), 0, 150);
+        $queries = ['a', '%', '_', '*', '000000', $this->admin->email, ' OR 1=1 --', '<img src=x onerror=alert(1)>'];
+
+        foreach ($routes as $route) {
+            if ($this->primaryMethod($route) !== 'GET') {
+                continue;
+            }
+
+            foreach ($queries as $query) {
+                $response = $this->requestAs($this->parent, 'GET', $route->uri(), ['search' => $query, 'q' => $query, 'email' => $query]);
+                $this->assertControlled($response, 'GET', $route->uri());
+                $this->assertNoServerError($response, 'enumeration resistant search '.$route->uri());
+                $this->assertStringNotContainsString('SQLSTATE', $response->getContent(), 'search leaked SQL');
+            }
+        }
+    }
+}