Level 14
not sure what you want to achieve? did you create tests like: TestPendingUsersCanVerifyEmail, TestDisabledUsersCanContactSupport?
May 15, 2025
4
Level 1
How to test middleware restrictions for user status (active, pending, disabled) in Laravel API
Hi all,
I’m working on a Laravel API and I’m writing PHPUnit feature tests to validate access control via middleware based on the authenticated user’s status.
In my case, users can have only 3 possible statuses:
- active → full access to all routes
- pending_verification → restricted access, only a few routes allowed
- disabled → almost everything blocked
Now, I want to make sure that:
- pending users can only access 4 specific routes (e.g. /verify, /resend, etc.)
- disabled users are basically blocked from everything (except maybe one route like /support)
- active users can access all routes without issues
Thanks in advance! Open to ideas, best practices, or even packages that could help!
Level 1
@krisi_gjika I’m trying to write tests for each user status (active, pending_verification, disabled) to make sure they can only access the routes they’re allowed to. For example, a pending user should be able to access /verify or /resend, but should be blocked from all other routes.
My issue is: I’m not sure how to write a test that automatically checks all the other routes the user is not allowed to access, without having to manually list them all. Any suggestions on how to structure this kind of test?
Level 14
@a.verrecchia I think rather than trying to check every route in one test, you should test the rest as normal. Example when testing if user can make posts, also test that pending users can't make posts
1 like
Level 50
I'd just manually list all testable routes and the exception cases. You could get all routes using Route::getRoutes() and manually list only the exceptions, but that has some drawbacks.
Firstly, you have to consider routes registered by the framework or packages, like the health check route and routes from Telescope, Debugbar, Pulse, etc.
Secondly, if your app ever gets any routes with parameters or model bindings, this automation will fail. Whoever is adding the route has to stop what they're doing and rewrite this test.
I think it's better to be explicit with the test cases.
Please or to participate in this conversation.