<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch16ReadModelProjectionConsistencyContractTest extends FullSurfaceE2EContractCase
{
    public function test_batch16_summary_dashboard_and_projection_routes_resist_privileged_include_flags(): void
    {
        $routes = $this->apiRoutesContainingAny(['dashboard', 'summary', 'analytics', 'report', 'overview', 'statistics', 'projection']);

        foreach (array_slice($routes, 0, 50) as $route) {
            $method = $this->primaryMethod($route);
            $uri = $route->uri();
            $response = $this->requestAs($this->teacher, $method, $uri, $this->payloadFor($method, $uri) + [
                'include' => 'all,finance,parents,passwords,deleted,audit',
                'scope' => 'school',
                'class_section_id' => 999999,
                'parent_id' => 999999,
                'student_id' => 999999,
            ]);

            $this->assertControlled($response, $method, $uri);
            $body = strtolower($response->getContent());
            foreach (['remember_token', 'db_password', 'app_key', 'secret'] as $forbidden) {
                $this->assertStringNotContainsString($forbidden, $body);
            }
        }
    }
}