<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch16DeviceTrustAndScannerReplayContractTest extends FullSurfaceE2EContractCase
{
    public function test_batch16_kiosk_scanner_and_device_routes_do_not_trust_client_asserted_device_state(): void
    {
        $routes = $this->apiRoutesContainingAny(['scanner', 'scan', 'kiosk', 'badge', 'device', 'attendance']);

        foreach (array_slice($routes, 0, 40) as $route) {
            $method = $this->primaryMethod($route);
            $uri = $route->uri();
            foreach (['device-admin', 'device-admin'] as $deviceId) {
                $response = $this->withHeaders([
                    'X-Device-Id' => $deviceId,
                    'X-Device-Trusted' => 'true',
                    'X-Kiosk-Mode' => 'admin',
                    'X-Scan-Time' => '2099-01-01T00:00:00Z',
                ])->requestAs($this->actorFor($uri), $method, $uri, $this->payloadFor($method, $uri) + [
                    'badge_token' => 'forged-batch16-badge',
                    'scan_token' => 'replayed-batch16-scan',
                    'device_trusted' => true,
                    'override_attendance' => true,
                ]);

                $this->assertControlled($response, $method, $uri);
                $this->assertStringNotContainsString('undefined index', strtolower($response->getContent()));
            }
        }
    }
}