add test batches

2026-06-08 23:45:55 -04:00
parent c792b8be05
commit 8d4d610b82
1480 changed files with 22587 additions and 10762 deletions
@@ -0,0 +1,33 @@
+<?php
+
+namespace Tests\Feature\Api\V1\FullSurface;
+
+use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
+
+class ApiBatch14SessionCookieCsrfBoundaryContractTest extends FullSurfaceE2EContractCase
+{
+public function test_api_auth_routes_do_not_depend_on_browser_session_cookies(): void
+    {
+        foreach (array_slice($this->apiRoutesContainingAny(['auth', 'login', 'logout', 'me', 'profile', 'frontend']), 0, 40) as $route) {
+            $method = $this->primaryMethod($route);
+            $response = $this->withCookie('laravel_session', 'attacker-controlled-session')
+                ->withHeader('X-XSRF-TOKEN', 'not-a-real-xsrf-token')
+                ->actingAs($this->actorFor($route->uri()), 'api')
+                ->json($method, $this->materializePath($route->uri()), $this->payloadFor($method, $route->uri()));
+            $this->assertControlled($response, $method, $route->uri());
+            $this->assertStringNotContainsString('csrf token mismatch', strtolower($response->getContent()));
+        }
+    }
+
+    public function test_browser_only_session_headers_do_not_grant_api_privileges(): void
+    {
+        foreach (array_slice($this->apiRoutesContainingAny(['admin', 'users', 'roles', 'permissions', 'finance', 'inventory', 'attendance']), 0, 30) as $route) {
+            $method = $this->primaryMethod($route);
+            $response = $this->withCookie('laravel_session', 'fake-admin-browser-session')
+                ->withHeaders(['X-Requested-With' => 'XMLHttpRequest', 'X-CSRF-TOKEN' => 'fake-csrf', 'X-User-Id' => (string) $this->admin->id])
+                ->json($method, $this->materializePath($route->uri()), $this->payloadFor($method, $route->uri()));
+            $this->assertStatusIn($response, [401, 403, 404, 405, 419, 422], $method . ' ' . $route->uri());
+            $this->assertStringNotContainsString('sqlstate', strtolower($response->getContent()));
+        }
+    }
+}