TenantAtlas/tests/Feature/System/Spec113/AuthorizationSemanticsTest.php

<?php

declare(strict_types=1);

use App\Models\PlatformUser;
use App\Models\User;
use App\Support\Auth\PlatformCapabilities;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

it('returns 404 when a tenant session accesses the system panel', function () {
    $user = User::factory()->create();

    $this->actingAs($user)->get('/system/login')->assertNotFound();

    // Filament may switch the active guard within the test process,
    // so ensure the tenant session is set for each request we assert.
    $this->actingAs($user)->get('/system')->assertNotFound();
});

it('returns 403 when a platform user lacks the required capability', function () {
    $platformUser = PlatformUser::factory()->create([
        'capabilities' => [],
        'is_active' => true,
    ]);

    $this->actingAs($platformUser, 'platform')
        ->get('/system')
        ->assertForbidden();
});

it('returns 200 when a platform user has the required capability', function () {
    $platformUser = PlatformUser::factory()->create([
        'capabilities' => [PlatformCapabilities::ACCESS_SYSTEM_PANEL],
        'is_active' => true,
    ]);

    $this->actingAs($platformUser, 'platform')
        ->get('/system')
        ->assertSuccessful();
});