add test batches

tests/Feature/Api/V1/FullSurface/ApiOperationalEndpointExposureContractTest.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Tests\Feature\Api\V1\FullSurface;
+
+use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
+
+class ApiOperationalEndpointExposureContractTest extends FullSurfaceE2EContractCase
+{
+    public function test_operational_debug_and_maintenance_routes_are_not_publicly_exposed_with_sensitive_data(): void
+    {
+        $routes = $this->apiRoutesContainingAny(['debug', 'health', 'db-check', 'metrics', 'logs', 'cache', 'queue', 'maintenance', 'telescope', 'horizon']);
+
+        foreach ($routes as $route) {
+            $method = $this->primaryMethod($route);
+            $uri = $route->uri();
+            $response = $this->json($method, $this->materializePath($uri), $this->payloadFor($method, $uri));
+
+            $this->assertControlled($response, $method, $uri);
+            $this->assertNoServerError($response, 'operational endpoint exposure at ' . $method . ' ' . $uri);
+            $this->assertStringNotContainsStringIgnoringCase('APP_KEY', $response->getContent());
+            $this->assertStringNotContainsStringIgnoringCase('DB_PASSWORD', $response->getContent());
+            $this->assertStringNotContainsStringIgnoringCase('AWS_SECRET', $response->getContent());
+        }
+    }
+}