<?php

namespace Tests\Security;

use App\Models\Admin;
use Tests\TestCase;

class MassAssignmentSecurityTest extends TestCase
{
    public function test_admin_cannot_mass_assign_security_credentials_or_roles(): void
    {
        $admin = new Admin([
            'name' => 'Operator',
            'email' => 'operator@example.test',
            'two_factor_secret' => 'attacker-controlled',
            'two_factor_recovery_codes' => ['stolen'],
            'roles' => ['super-admin'],
        ]);

        $this->assertNull($admin->getAttribute('two_factor_secret'));
        $this->assertNull($admin->getAttribute('two_factor_recovery_codes'));
        $this->assertArrayNotHasKey('roles', $admin->getAttributes());
    }
}
