__gregory

$this->actingAs() is just setting the user to current guard. Auth::login() is updating the session, remembering the user by setting the token and cookie, and it is firing the events and setting the user to the guard.

Ok this makes sense now, because I have a Listener that adds data to the session when a user logs in. I have now changed a line in my test to this and it passes:

$response = $this->actingAs($user)
    ->withSession(['tenant_id' => $tenant2->id])
    ->get(route('reports.show', $report));

Also, you should not assert that the resource is not found, you should assert that it is forbidden to access that resource.

Could you please elaborate on this? I am using Laravels route model binding feature and what basically happens is that Laravel is throwing a ModelNotFoundException and rendering a view with a 404 status code. I don't have a lot of experience in writing tests so I am wondering what would be a better approach to test this kind of stuff?

Thanks!

Hello,

I'm wondering what's the difference between $this->actingAs($user) and Auth::login($user) in tests.

I want to test if Laravel shows a 404 page if a user is not allowed to see a resource. When I use Auth::login($user) it works:

    /**
     * @test
     */
    public function show_displays_404()
    {
        $tenant = Tenant::factory()->create();
        $tenant2 = Tenant::factory()->create();

        $report = Report::factory()->create(['tenant_id' => $tenant->id]);
        $user = User::factory()->create(['tenant_id' => $tenant2->id]);

        Auth::login($user);

        $response = $this->get(route('reports.show', $report));

        $response->assertNotFound();
    }

But when I use $this->actingAs($user) the test fails ("Response status code [200] is not a not found status code."), meaning the user can see the ressource he's no allowed to:

    /**
     * @test
     */
    public function show_displays_404()
    {
        $tenant = Tenant::factory()->create();
        $tenant2 = Tenant::factory()->create();

        $report = Report::factory()->create(['tenant_id' => $tenant->id]);
        $user = User::factory()->create(['tenant_id' => $tenant2->id]);

        $response = $this->actingAs($user)->get(route('reports.show', $report));

        $response->assertNotFound();
    }

So what's exactly the difference here? I expected $this->actingAs($user) to be working the same way as Auth::login($user).

Thanks!

Have a look at OctoberCMS and the Mall plugin (https://github.com/OFFLINE-GmbH/oc-mall-plugin). It makes it very easy to create a shop and it‘s built on Laravel. Building a shop from scratch is a lot of work, so be careful what you choose :)