Laravel Authorization Testing Gate Policy Ability Assertions

Definisi

Menguji otorisasi memastikan Gate, Policy, dan helper authorize()/@can benar menolak/izinkan sesuai aturan. Tanpa test, regresi akses (user lihat data orang lain) mudah lewat.

Kapan dipakai

Pakai di setiap fitur ber-otorisasi: crud resource, admin-only, ownership. Test di level unit (Policy method) dan feature (HTTP 403 vs 200).

Cara kerja

Unit policy

php

test('owner bisa edit post', function () {
    $user = User::factory()->create();
    $post = Post::factory()->for($user)->create();
    expect($user->can('update', $post))->toBeTrue();
});
 
test('bukan owner ditolak', function () {
    $user = User::factory()->create();
    $post = Post::factory()->create();
    expect($user->can('update', $post))->toBeFalse();
});

Feature HTTP

php

test('tamu tak bisa akses dashboard', function () {
    $this->get('/dashboard')->assertRedirect('/login');
});
 
test('user tak punya permission 403', function () {
    $this->actingAs(User::factory()->create())
         ->delete("/posts/1")
         ->assertForbidden();
});

Struktur alur

Catatan implementasi

• can() mengembalikan bool; authorize() throw AuthorizationException → 403.
• Untuk Gate closure, test lewat Gate::allows('ability', $arg).
• actingAs di feature test; di unit cukup panggil $user->can(...).
• Pastikan policy terdaftar (Gate::policy atau AuthServiceProvider).

Kesalahan umum

• Hanya test 200: lupa test penolakan (403) — celah akses.
• Policy tidak terdaftar: can() selalu false/acak.
• Mutasi global di test: pakai factory + RefreshDatabase.
• Soft-delete lupa withTrashed: policy lihat data hilang.

Referensi terkait

• Laravel Auth, Guards, Gates, Policies, Authorization Flow
• Laravel Observers, Resource Collections, Policy Filters, Gate::before
• Laravel HTTP Testing Lanjut: Assertions, Fake, Pest