AndyTranscribe/tests/Feature/RecordingOwnershipTest.php

<?php

namespace Tests\Feature;

use App\Models\Recording;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class RecordingOwnershipTest extends TestCase
{
    use RefreshDatabase;

    public function test_user_only_sees_their_own_recordings(): void
    {
        $owner = User::factory()->create();
        $other = User::factory()->create();

        Recording::query()->create([
            'user_id' => $owner->id,
            'title' => 'Mine',
            'original_filename' => 'mine.mp3',
            'file_path' => 'recordings/mine.mp3',
            'file_size_bytes' => 10,
            'transcription_status' => 'done',
        ]);

        Recording::query()->create([
            'user_id' => $other->id,
            'title' => 'Theirs',
            'original_filename' => 'theirs.mp3',
            'file_path' => 'recordings/theirs.mp3',
            'file_size_bytes' => 10,
            'transcription_status' => 'done',
        ]);

        $this->actingAs($owner)
            ->get(route('recordings.index'))
            ->assertOk()
            ->assertSee('Mine')
            ->assertDontSee('Theirs');
    }

    public function test_user_cannot_view_another_users_recording(): void
    {
        $owner = User::factory()->create();
        $intruder = User::factory()->create();

        $recording = Recording::query()->create([
            'user_id' => $owner->id,
            'title' => 'Private',
            'original_filename' => 'private.mp3',
            'file_path' => 'recordings/private.mp3',
            'file_size_bytes' => 10,
            'transcription_status' => 'done',
        ]);

        $this->actingAs($intruder)
            ->get(route('recordings.show', $recording))
            ->assertForbidden();
    }

    public function test_user_cannot_delete_another_users_recording(): void
    {
        $owner = User::factory()->create();
        $intruder = User::factory()->create();

        $recording = Recording::query()->create([
            'user_id' => $owner->id,
            'title' => 'Keep me',
            'original_filename' => 'keep.mp3',
            'file_path' => 'recordings/keep.mp3',
            'file_size_bytes' => 10,
            'transcription_status' => 'done',
        ]);

        $this->actingAs($intruder)
            ->delete(route('recordings.destroy', $recording))
            ->assertForbidden();

        $this->assertDatabaseHas('recordings', ['id' => $recording->id]);
    }
}