如何在 Laravel 中测试未经授权的方法？

Question

我有控制器 Post 使用典型的 CRUD 方法。 我有一个 PostPolicy，其中：

public function destroy(User $user, Post $post)
{
    $user->id === $post->author_id;
}

我想为此编写测试。当我检查用户是否删除他自己的帖子时 - 一切正常。

但是当我测试其他用户是否可以删除不是他自己的帖子时，laravel 测试发送错误：

Illuminate\Auth\Access\AuthorizationException: This action is unauthorized.

如何绕过它或者哪个有另一种方法来编写这个测试？

代码

 <?php

namespace Tests\Feature;

use Tests\TestCase;
use App\Models\Feeds\Feed;
use App\Models\User;
use Tests\SphinxConnection;
use Illuminate\Foundation\Testing\DatabaseMigrations;
class PolicyTest extends TestCase
{
    use DatabaseMigrations,
        SphinxConnection;

    public function testFeedPolicy()
    {
        $this->expectException(\Illuminate\Auth\Access\AuthorizationException::class);

        $user1 = factory(User::class)->create([
            'id' => 1,
        ]);
        $user2 = factory(User::class)->create([
            'id' => 2,
        ]);

        factory(Post::class)->create([
            'id' => 27,
            'editor_id' => 2,
        ]);
        factory(Post::class)->create([
            'id' => 30,
            'editor_id' => 2,
        ]);

        $this->delete('/api/feeds/27', [], [
            'authorization' => "Bearer {$user2->api_token}",
            'accept' => 'application/json',
        ])->assertJson([

        ]);;
        $this->delete('/api/feeds/30', [], [
            'authorization' => "Bearer {$user1->api_token}",
            'accept' => 'application/json',
        ])->assertJson([

        ]);;
    }
}

Answer 1

您可以在测试方法的开头添加以下内容：

$this->expectException(\Illuminate\Auth\Access\AuthorizationException::class);

---

编辑

您的测试方法可能类似于：

/** @test */
function a_user_can_delete_their_own_post()
{
    $user = factory(User::class)->create();

    $post = factory(Post::class)->create([
        'editor_id' => $user->id,
    ]);

    $this->actingAs($user);

    $this
        ->delete("/api/feeds/{$post->id}", [], [
            'authorization' => "Bearer {$user->api_token}",
            'accept'        => 'application/json',
        ])
        ->assertResponseOk();

    $this->assertFalse(Post::where('id', $post->id)->exists());
}

/** @test */
function a_user_can_not_delete_a_post_they_do_not_own()
{
    $this->expectException(\Illuminate\Auth\Access\AuthorizationException::class);

    $user = factory(User::class)->create();

    $post = factory(Post::class)->create([
        'editor_id' => $user->id + 1,
    ]);

    $this->actingAs($user);

    $this->delete("/api/feeds/{$post->id}", [], [
        'authorization' => "Bearer {$user->api_token}",
        'accept'        => 'application/json',
    ]);
}

希望这会有所帮助！