<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;


class ApiBatch17PerResourceRateLimitIdentityContractTest extends FullSurfaceE2EContractCase
{
    public function test_repeated_sensitive_actions_are_scoped_by_actor_resource_and_operation(): void
    {
        $routes = $this->apiRoutesContainingAny(['login', 'password', 'verification', 'contact', 'support', 'scanner', 'badge', 'payment', 'refund']);

        foreach (array_slice($routes, 0, 50) as $route) {
            $method = $this->primaryMethod($route);
            $uri = $route->uri();
            $payload = $this->payloadFor($method, $uri) + [
                'client_operation_id' => 'batch17-repeat',
                'resource_id' => $this->ids['studentId'],
                'attempt' => 1,
            ];

            $first = $this->requestAs($this->actorFor($uri), $method, $uri, $payload);
            $second = $this->requestAs($this->actorFor($uri), $method, $uri, $payload + ['attempt' => 2]);

            $this->assertControlled($first, $method, $uri);
            $this->assertControlled($second, $method, $uri);
            $this->assertNotEquals(500, $second->getStatusCode(), $method.' '.$uri.' crashed on repeated sensitive action.');
        }
    }
}