seed(RolesAndPermissionsSeeder::class); }); test('accessibleBy includes a users own authored press release', function () { $user = User::factory()->create(); $pr = PressRelease::factory()->create(['user_id' => $user->id, 'company_id' => null]); $ids = PressRelease::accessibleBy($user)->pluck('id'); expect($ids)->toContain($pr->id); }); test('accessibleBy includes press releases of an assigned company', function () { $user = User::factory()->create(); $company = Company::factory()->presseecho()->create(); $user->companies()->attach($company->id, ['role' => 'owner']); $other = User::factory()->create(); $pr = PressRelease::factory()->create([ 'user_id' => $other->id, 'company_id' => $company->id, 'portal' => $company->portal->value, ]); $ids = PressRelease::accessibleBy($user)->pluck('id'); expect($ids)->toContain($pr->id); }); test('accessibleBy excludes press releases of strangers and unrelated companies', function () { $user = User::factory()->create(); $stranger = User::factory()->create(); $foreignCompany = Company::factory()->presseecho()->create(); $foreignPr = PressRelease::factory()->create([ 'user_id' => $stranger->id, 'company_id' => $foreignCompany->id, 'portal' => $foreignCompany->portal->value, ]); $ids = PressRelease::accessibleBy($user)->pluck('id'); expect($ids)->not->toContain($foreignPr->id); }); test('accessibleBy bypasses the portal global scope so own PMs are visible cross-portal', function () { $user = User::factory()->create(); $pr = PressRelease::factory()->create([ 'user_id' => $user->id, 'company_id' => null, 'portal' => Portal::Businessportal24->value, ]); // Simuliert eingeschränkten Portal-Kontext (Presseecho); der Scope muss // die eigene PM dennoch finden, weil er die GlobalScopes entfernt. CurrentPortalContext::set(Portal::Presseecho); $found = PressRelease::accessibleBy($user)->find($pr->id); expect($found)->not->toBeNull(); });