<?php

namespace Tests\Feature\Api\V1\FullSurface;

use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;

class ApiBatch15RouteParameterPoisoningExpansionTest extends FullSurfaceE2EContractCase
{
    public function test_batch15_route_parameters_reject_encoded_path_script_and_type_confusion_payloads_cleanly(): void
    {
        $poisoned = ['..%2F..%2F.env', '%00', '<svg/onload=alert(1)>', '1 or 1=1', str_repeat('9', 80), '٠١٢٣', 'null', '[]'];

        foreach (array_slice($this->apiRoutes(), 0, 80) as $route) {
            if (! str_contains($route->uri(), '{')) {
                continue;
            }

            $method = $this->primaryMethod($route);
            foreach (array_slice($poisoned, 0, 4) as $value) {
                $path = '/'.preg_replace('/\{[^}]+\}/', $value, $route->uri());
                $this->actingAs($this->actorFor($route->uri()), 'api');
                $response = $this->json($method, $path, $this->payloadFor($method, $route->uri()));
                $this->assertControlled($response, $method, $route->uri());
                $this->assertStringNotContainsString('laravel.log', strtolower($response->getContent()));
            }
        }
    }
}