LEARN. PRACTICE. GROW.Simulated requests and prepared identity
Laravel HTTP test helpers simulate requests internally; they do not themselves traverse the public network, TLS and reverse proxy. actingAs prepares the user and, when specified, the test guard without demonstrating password verification in real login.
CSRF protection is automatically disabled in tests, so a tokenless POST returning 200 does not prove the public control is disabled. Relate each result to its observed scope before using it to accept a deployment.
Presence, absence and exact response shape
assertJson confirms that a fragment exists and permits additional properties. A profile with the correct id can still disclose internal_note. Use an absence assertion for the prohibited path or assertExactJson when the contract fixes the complete representation.
Do not confuse HTTP success with correct field selection. An extensible contract can check essential fields and prohibitions without fixing everything; a closed contract should make that choice explicit. Choose the assertion from the requirement rather than inferring more than it observes.
Persisted state and test isolation
A denied change can require two properties: a 403 response and the original value still present on the identified invoice. Checking only that some invoice exists observes neither target nor amount. Initial state also needs control: with an up-to-date schema, RefreshDatabase runs the test within a transaction instead of always rerunning migrations.
Records committed by tests without that trait may remain. Reconcile suite isolation strategy and do not attribute a result to the request without knowing which data existed beforehand.
A fake observes an attempt
Queue::fake prevents real pushes and assertPushed observes that the application attempted to dispatch a job. It does not demonstrate handle execution, production worker configuration or external provider delivery. Checking expected class, object identity and queue is useful, but each conclusion must match the assertion used.
Job logic and queue integration require separate evidence when included in acceptance criteria. In this lesson, excerpts are interpreted; they do not represent an execution performed by the platform.
Entry identity and concurrent misses
remember reuses an existing value; on a miss it executes the closure and stores the result. A dashboard key shared across accounts can return the wrong account’s data even with correct authorization before the query. Include authorized scope and value-changing dimensions in entry identity.
Two simultaneous misses can compute in parallel; remember does not promise distributed exclusion. To coordinate participants, a shared lock and a fresh read after acquisition can avoid recomputing completed work, provided duration and failures are handled.
Lock ownership and duration
A lock has an owner identity and a duration. If a request acquires it and a job should release it, pass the owner token and use restoreLock with that identity. forceRelease ignores the current owner and can remove another participant’s acquisition.
Expiry does not prove previous work ended: bound work by intended validity or define a protocol preventing effects from an executor that lost exclusion. Sharing only the name in independent local caches does not establish a distributed lock either.
Invalidate and activate with explicit scope
For one known entry, forget in the correct store provides targeted removal. flush does not respect the application prefix and can affect other applications sharing the store. optimize:clear also removes default-cache-driver keys alongside generated files, so it is not exclusively file cleanup.
After publishing code and caches, long-lived services must load the new revision; reload or restart needs a monitor to start them again and observation of effective version. A completed command does not replace that reconciliation.
<?php
// Separate test excerpts for interpretation; factories, policies and routes omitted.
// $otherUser is authenticated but cannot update $invoice.
$oldAmount = $invoice->amount;
$deniedResponse = $this->actingAs($otherUser)
->patchJson('/invoices/'.$invoice->id, ['amount' => 999]);
$deniedResponse->assertForbidden();
$this->assertDatabaseHas('invoices', [
'id' => $invoice->id,
'amount' => $oldAmount,
]);
// Separate successful public-profile response from another test, held in $publicResponse.
$publicResponse->assertJson(['id' => 7]);
$publicResponse->assertJsonMissingPath('internal_note');
// Dispatch evidence excerpt; this does not run the job or external delivery.
Queue::fake();
DeliverReceipt::dispatch($invoice->id);
Queue::assertPushed(DeliverReceipt::class);
The first fragment combines HTTP denial with preservation of the identified invoice’s amount. The next fragment belongs to a different response, a public profile: it checks a permitted field and absence of internal_note. The last observes attempted dispatch through a fake without running the job.
These are separate examples for reading contracts; the application, factories, policies and test method structure are omitted. No assessment requires executing these excerpts.
Common pitfalls
Attributing real delivery to assertPushed; inferring private-data absence from partial assertJson; treating actingAs as a password test; expecting total RefreshDatabase cleanup in every suite; using a global key for account-specific values; releasing another owner’s lock through forceRelease.
Related topics: Blade, output and API resources · Authentication, authorization and sessions · Queues, retries and scheduling
Acceptance should connect each requirement to an observation of matching scope. Internal tests and fakes are useful when their limits are clear. Cache needs explicit value identity and coordination; deployment requires confirming active consumers alongside creating files and receiving success codes.
Reference: Simulated requests and CSRF · Laravel 13.x; PHP 8.3+