How do I test complex authorization logic in Laravel controllers

1. Unit Tests for Authorization Logic:
- Create a test class for your authorization logic, such as `AuthorizationTest`.
- Use mocking libraries like Mockery or Prophecy to create mock instances of the necessary dependencies, such as the `Gate` facade or your custom Policy classes.
- Test the authorization methods in your controller, such as `authorize()` or `authorizeForUser()`, by providing the mocked dependencies.

Example:

php
   namespace Tests\Unit;

   use Illuminate\Auth\Access\Gate;
   use Illuminate\Contracts\Auth\Access\Gate as GateContract;
   use Mockery;
   use Tests\TestCase;

   class AuthorizationTest extends TestCase
   {
       public function testUpdatePostAuthorization()
       {
           // Mock the Gate instance
           $gate = Mockery::mock(GateContract::class);
           $gate->shouldReceive('allows')
                ->with('update', Mockery::any())
                ->andReturn(true);

           // Bind the mocked Gate instance to the application
           $this->app->instance(GateContract::class, $gate);

           // Call the controller method that checks the authorization
           $controller = new \App\Http\Controllers\PostController();
           $controller->authorize('update', new \App\Models\Post());

           // No exception thrown, test passes
       }

       public function testUpdatePostAuthorizationFailure()
       {
           // Mock the Gate instance
           $gate = Mockery::mock(GateContract::class);
           $gate->shouldReceive('allows')
                ->with('update', Mockery::any())
                ->andReturn(false);

           // Bind the mocked Gate instance to the application
           $this->app->instance(GateContract::class, $gate);

           // Call the controller method that checks the authorization
           $this->expectException(\Illuminate\Auth\Access\AuthorizationException::class);
           $controller = new \App\Http\Controllers\PostController();
           $controller->authorize('update', new \App\Models\Post());
       }

       public function tearDown(): void
       {
           Mockery::close();
       }
   }
   

2. Feature Tests for Authorization Behavior:
- Create a feature test class for your application's controllers, such as `PostControllerTest`.
- Use the `actingAs()` method to authenticate a user with specific permissions or roles.
- Verify the authorization behavior by asserting the appropriate HTTP status codes and responses.

Example:

php
   namespace Tests\Feature;

   use App\Models\User;
   use Illuminate\Foundation\Testing\RefreshDatabase;
   use Tests\TestCase;

   class PostControllerTest extends TestCase
   {
       use RefreshDatabase;

       public function testUpdatePostWithPermission()
       {
           $user = User::factory()->create();
           $user->givePermissionTo('update-post');

           $this->actingAs($user)
               ->put('/posts/1', ['title' => 'Updated Post'])
               ->assertStatus(302);
       }

       public function testUpdatePostWithoutPermission()
       {
           $user = User::factory()->create();

           $this->actingAs($user)
               ->put('/posts/1', ['title' => 'Updated Post'])
               ->assertStatus(403);
       }
   }
   

In the unit tests, you can mock the necessary dependencies, such as the `Gate` facade or your custom Policy classes, and test the authorization logic directly in the controller. This allows you to isolate the authorization logic and ensure it works as expected.

In the feature tests, you can create users with specific permissions or roles and assert the appropriate HTTP responses based on the user's authorization. This helps you test the end-to-end behavior of your application, including the integration between the controller and the authorization logic.

By combining these two approaches, you can thoroughly test complex authorization logic in your Laravel controllers, ensuring that the access control is working as expected, even in edge cases and complex scenarios.

Remember to also test scenarios where permissions or roles might change during a user's session, and consider using tools like Mockery or Prophecy to create more sophisticated mocks and stubs.