create([ 'access_level' => UserAccessLevel::CUSTOMER, 'is_master' => false, ]); $uploadResponse = $this->actingAs($user) ->post('/api/files', [ 'file' => UploadedFile::fake()->create('avatar.png', 100, 'image/png'), 'category' => 'profile', ]) ->assertCreated() ->assertJsonPath('success', true) ->assertJsonPath('data.category', 'profile'); $fileId = $uploadResponse->json('data.id'); $this->actingAs($user) ->putJson('/api/me/profile', [ 'name' => $user->name, 'username' => $user->username, 'email' => $user->email, 'profile_photo_file_id' => $fileId, 'user_profile' => null, ]) ->assertOk() ->assertJsonPath('data.profile_photo.id', $fileId); $this->assertDatabaseHas('users', [ 'id' => $user->id, 'profile_photo_file_id' => $fileId, ]); $storedFile = StoredFile::findOrFail($fileId); Storage::disk('minio')->assertExists($storedFile->object_key); } public function test_user_cannot_use_another_users_file_as_profile_photo(): void { $owner = User::factory()->create(); $otherUser = User::factory()->create(); $file = StoredFile::create([ 'uuid' => fake()->uuid(), 'uploaded_by' => $owner->id, 'disk' => 'minio', 'bucket' => 'file', 'object_key' => 'profiles/test.png', 'original_name' => 'test.png', 'extension' => 'png', 'mime_type' => 'image/png', 'size' => 100, 'category' => 'profile', 'visibility' => 'private', ]); $this->actingAs($otherUser) ->putJson('/api/me/profile', [ 'name' => $otherUser->name, 'username' => $otherUser->username, 'email' => $otherUser->email, 'profile_photo_file_id' => $file->id, 'user_profile' => null, ]) ->assertUnprocessable() ->assertJsonValidationErrors('profile_photo_file_id'); } }