add test batches

2026-06-08 23:45:55 -04:00
parent c792b8be05
commit 8d4d610b82
1480 changed files with 22587 additions and 10762 deletions
@@ -0,0 +1,31 @@
+<?php
+
+namespace Tests\Feature\Api\V1\FullSurface;
+
+use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
+
+class ApiRequestHeaderSpoofingContractTest extends FullSurfaceE2EContractCase
+{
+    public function test_forwarded_and_override_headers_do_not_bypass_authorization(): void
+    {
+        $routes = array_slice($this->apiRoutesContainingAny(['admin', 'users', 'finance', 'inventory', 'settings', 'school-years', 'permissions']), 0, 120);
+
+        foreach ($routes as $route) {
+            $method = $this->primaryMethod($route);
+            $uri = $route->uri();
+
+            $this->actingAs($this->parent, 'api');
+            $response = $this->withHeaders([
+                'X-Forwarded-For' => '127.0.0.1',
+                'X-Original-Method' => 'GET',
+                'X-HTTP-Method-Override' => 'GET',
+                'X-User-Role' => 'administrator',
+                'X-Admin' => 'true',
+                'X-Impersonate-User' => (string) $this->admin->id,
+            ])->json($method, $this->materializePath($uri), $this->payloadFor($method, $uri));
+
+            $this->assertStatusIn($response, [401, 403, 404, 405, 419, 422], 'spoofed headers should not authorize parent at ' . $method . ' ' . $uri);
+            $this->assertNoServerError($response, 'header spoofing at ' . $method . ' ' . $uri);
+        }
+    }
+}