<?php

namespace Tests\Feature;

use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class AdminPlatformLeadIndexFilterFormDropsUnsafeBackTest extends TestCase
{
    use RefreshDatabase;

    protected function loginAsPlatformAdmin(): void
    {
        $this->seed();

        $this->post('/admin/login', [
            'email' => 'platform.admin@demo.local',
            'password' => 'Platform@123456',
        ])->assertRedirect('/admin');
    }

    public function test_index_filter_form_should_not_keep_back_when_back_is_unsafe(): void
    {
        $this->loginAsPlatformAdmin();

        $unsafeBack = '/admin/platform-orders?status=pending&back=/admin/plans';

        $res = $this->get('/admin/platform-leads?back=' . urlencode($unsafeBack));
        $res->assertOk();

        // unsafe back 不应被写入隐藏字段（避免 nested back 膨胀/绕过）
        $res->assertDontSee('name="back"', false);
        $res->assertDontSee($unsafeBack, false);
    }
}
