<?php

namespace Tests\Feature;

use Illuminate\Foundation\Testing\RefreshDatabase;
use PHPUnit\Framework\Attributes\DataProvider;
use Tests\TestCase;

class AdminSiteSubscriptionIndexUnsafeBackShouldBeDroppedForLinksTest extends TestCase
{
    use RefreshDatabase;

    protected function loginAsPlatformAdmin(): void
    {
        $this->seed();

        $this->post('/admin/login', [
            'email' => 'platform.admin@demo.local',
            'password' => 'Platform@123456',
        ])->assertRedirect('/admin');
    }

    public static function invalidBackProvider(): array
    {
        return [
            'contains quote' => ['/' . 'admin/site-subscriptions?x="y"'],
            'contains angle bracket' => ['/admin/site-subscriptions?x=<script>'],
            'nested back param' => ['/admin/site-subscriptions?status=active&back=/admin/platform-orders'],
            'absolute url' => ['https://evil.example.com'],
        ];
    }

    #[DataProvider('invalidBackProvider')]
    public function test_index_should_drop_unsafe_back_for_links(string $back): void
    {
        $this->loginAsPlatformAdmin();

        $res = $this->get('/admin/site-subscriptions?back=' . urlencode($back));
        $res->assertOk();

        // 不应渲染 back 回退入口
        $res->assertDontSee('返回上一页（保留上下文）');

        // 快捷筛选/全部链接不应透传 unsafe back
        $res->assertDontSee('back=' . $back, false);
    }
}
