Laravel testing and verification

Laravel Testing & Verification

Test runner and isolation

• Match the project's test framework (Pest or PHPUnit) and traits (RefreshDatabase or DatabaseTransactions). Run the smallest targeted filter first (php artisan test --compact --filter=... or vendor/bin/pest), and never run destructive database commands against an unverified database.
• Each test sets up its own data via model factories with expressive states, ->for(), ->has(), ->recycle() and ->sequence(). Freeze time with $this->travelTo() when testing expiration, schedules or rate limits.

Endpoint, authorization and validation coverage

• Test HTTP endpoints end to end (actingAs($user)->postJson(...)): assert the specific status (assertCreated(), assertOk(), assertNoContent(), assertForbidden(), assertNotFound(), assertUnprocessable()), response payload (assertJsonPath) and database state (assertDatabaseHas, assertDatabaseMissing, assertSoftDeleted).
• Cover the security boundaries: unauthenticated access (401 / redirect), unauthorized role (403), and cross-tenant or another user's resource (404 or 403, and assert the foreign record is unchanged in the database).
• Cover key 422 validation failures with assertInvalid(['field']) (use datasets for validation matrices) and assert no side effects occurred.

Fakes and side effects

• Fake only the external boundary under test (Queue::fake(), Event::fake([SpecificEvent::class]), Notification::fake(), Mail::fake(), Http::fake(), Storage::fake('s3')) rather than mocking Eloquent models or internal repositories.
• Pair positive assertions (Queue::assertPushed, Mail::assertQueued) with negative assertions (Queue::assertNothingPushed, Mail::assertNothingSent) on failure paths. Never weaken an assertion just to make a failing test pass.