massive improvements to tests, streamlined and synced migrations, fixed a lot of wrong or old table field references. implemented a lot of pages in react for website frontend

tests/Feature/Auth/AuthenticationTest.php

@@ -5,6 +5,7 @@ namespace Tests\Feature\Auth;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Tests\TestCase;
+use Illuminate\Foundation\Testing\WithFaker;
 
 class AuthenticationTest extends TestCase
 {
@@ -22,7 +23,20 @@ class AuthenticationTest extends TestCase
         $user = User::factory()->create();
 
         $response = $this->post(route('login.store'), [
-            'email' => $user->email,
+            'login' => $user->email,
+            'password' => 'password',
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(route('dashboard', absolute: false));
+    }
+
+    public function test_users_can_authenticate_with_username()
+    {
+        $user = User::factory()->create(['username' => 'testuser']);
+
+        $response = $this->post(route('login.store'), [
+            'login' => 'testuser',
             'password' => 'password',
         ]);
 
@@ -34,12 +48,29 @@ class AuthenticationTest extends TestCase
     {
         $user = User::factory()->create();
 
-        $this->post(route('login.store'), [
-            'email' => $user->email,
+        $response = $this->post(route('login.store'), [
+            'login' => $user->email,
             'password' => 'wrong-password',
         ]);
 
         $this->assertGuest();
+        $response->assertRedirect(route('login', absolute: false));
+        $response->assertSessionHasErrors(['login' => 'Diese Anmeldedaten wurden nicht gefunden.']);
+    }
+
+    public function test_login_redirects_unverified_user_to_verification_notice()
+    {
+        $user = User::factory()->create([
+            'email_verified_at' => null,
+        ]);
+
+        $response = $this->post(route('login.store'), [
+            'login' => $user->email,
+            'password' => 'password',
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(route('verification.notice', absolute: false));
     }
 
     public function test_users_can_logout()
@@ -49,7 +80,7 @@ class AuthenticationTest extends TestCase
         $response = $this->actingAs($user)->post(route('logout'));
 
         $this->assertGuest();
-        $response->assertRedirect(route('home'));
+        $response->assertRedirect('/');
     }
 
     public function test_users_are_rate_limited()
@@ -57,23 +88,20 @@ class AuthenticationTest extends TestCase
         $user = User::factory()->create();
 
         for ($i = 0; $i < 5; $i++) {
-            $this->post(route('login.store'), [
-                'email' => $user->email,
+            $response = $this->post(route('login.store'), [
+                'login' => $user->email,
                 'password' => 'wrong-password',
-            ])->assertStatus(302)->assertSessionHasErrors([
-                'email' => 'These credentials do not match our records.',
             ]);
+            $response->assertStatus(302);
+            $response->assertSessionHasErrors(['login' => 'Diese Anmeldedaten wurden nicht gefunden.']);
         }
 
         $response = $this->post(route('login.store'), [
-            'email' => $user->email,
+            'login' => $user->email,
             'password' => 'wrong-password',
         ]);
 
-        $response->assertSessionHasErrors('email');
-
-        $errors = session('errors');
-
-        $this->assertStringContainsString('Too many login attempts', $errors->first('email'));
+        $response->assertStatus(302);
+        $response->assertSessionHasErrors(['login' => 'Zu viele Login-Versuche. Bitte versuche es in :seconds Sekunden erneut.']);
     }
 }

tests/Feature/Auth/LoginTest.php

@@ -0,0 +1,113 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Models\User;
+use App\Notifications\VerifyEmail;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Notification;
+use Tests\TestCase;
+use Illuminate\Support\Facades\Auth;
+
+class LoginTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_successful_login_with_valid_credentials()
+    {
+        $user = User::factory()->create([
+            'email' => 'valid@example.com',
+            'password' => bcrypt('password'),
+            'email_verified_at' => now(),
+        ]);
+
+        $response = $this->post(route('login.store'), [
+            'login' => 'valid@example.com',
+            'password' => 'password',
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(route('dashboard', absolute: false));
+        $this->assertEquals('valid@example.com', Auth::user()->email);
+    }
+
+    public function test_successful_login_with_username()
+    {
+        $user = User::factory()->create([
+            'username' => 'validuser',
+            'password' => bcrypt('password'),
+            'email_verified_at' => now(),
+        ]);
+
+        $response = $this->post(route('login.store'), [
+            'login' => 'validuser',
+            'password' => 'password',
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(route('dashboard', absolute: false));
+        $this->assertEquals('validuser', Auth::user()->username);
+    }
+
+    public function test_login_fails_with_invalid_credentials()
+    {
+        User::factory()->create([
+            'email' => 'invalid@example.com',
+            'password' => bcrypt('password'),
+        ]);
+
+        $response = $this->post(route('login.store'), [
+            'login' => 'invalid@example.com',
+            'password' => 'wrongpassword',
+        ]);
+
+        $this->assertGuest();
+        $response->assertStatus(302);
+        $response->assertRedirect(route('login', absolute: false));
+        $response->assertSessionHasErrors(['login' => 'Diese Anmeldedaten wurden nicht gefunden.']);
+    }
+
+    public function test_login_redirects_unverified_user_to_verification_notice()
+    {
+        $user = User::factory()->create([
+            'email' => 'unverified@example.com',
+            'password' => bcrypt('password'),
+            'email_verified_at' => null,
+        ]);
+
+        $response = $this->post(route('login.store'), [
+            'login' => 'unverified@example.com',
+            'password' => 'password',
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(route('verification.notice', absolute: false));
+    }
+
+    public function test_rate_limiting_on_failed_logins()
+    {
+        $user = User::factory()->create([
+            'email' => 'ratelimit@example.com',
+            'password' => bcrypt('password'),
+        ]);
+
+        // Simulate 5 failed attempts
+        for ($i = 0; $i < 5; $i++) {
+            $response = $this->post(route('login.store'), [
+                'login' => 'ratelimit@example.com',
+                'password' => 'wrongpassword',
+            ]);
+            $response->assertStatus(302);
+            $response->assertSessionHasErrors(['login' => 'Diese Anmeldedaten wurden nicht gefunden.']);
+        }
+
+        $response = $this->post(route('login.store'), [
+            'login' => 'ratelimit@example.com',
+            'password' => 'wrongpassword',
+        ]);
+
+        $this->assertGuest();
+        $response->assertStatus(302);
+        $response->assertSessionHasErrors(['login' => 'Zu viele Login-Versuche. Bitte versuche es in :seconds Sekunden erneut.']);
+    }
+}

tests/Feature/Auth/RegistrationTest.php

@@ -4,6 +4,9 @@ namespace Tests\Feature\Auth;
 
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Tests\TestCase;
+use App\Models\User;
+use App\Models\Package;
+use App\Models\Tenant;
 
 class RegistrationTest extends TestCase
 {
@@ -18,14 +21,215 @@ class RegistrationTest extends TestCase
 
     public function test_new_users_can_register()
     {
-        $response = $this->post(route('register.store'), [
+        $response = $this->post('/de/register', [
             'name' => 'Test User',
+            'username' => 'testuser',
             'email' => 'test@example.com',
-            'password' => 'password',
-            'password_confirmation' => 'password',
+            'password' => 'Password123!',
+            'password_confirmation' => 'Password123!',
+            'first_name' => 'Max',
+            'last_name' => 'Mustermann',
+            'address' => 'Musterstr. 1',
+            'phone' => '+49123456789',
+            'privacy_consent' => true,
         ]);
 
         $this->assertAuthenticated();
         $response->assertRedirect(route('dashboard', absolute: false));
+        $this->assertDatabaseHas('users', [
+            'email' => 'test@example.com',
+        ]);
+        $this->assertDatabaseHas('tenants', [
+            'user_id' => User::latest()->first()->id,
+        ]);
+    }
+
+    public function test_registration_with_free_package_assigns_tenant_package()
+    {
+        $freePackage = Package::factory()->endcustomer()->create(['price' => 0]);
+
+        $response = $this->post('/de/register', [
+            'name' => 'Test User',
+            'username' => 'testuserfree',
+            'email' => 'free@example.com',
+            'password' => 'Password123!',
+            'password_confirmation' => 'Password123!',
+            'first_name' => 'Max',
+            'last_name' => 'Mustermann',
+            'address' => 'Musterstr. 1',
+            'phone' => '+49123456789',
+            'privacy_consent' => true,
+            'package_id' => $freePackage->id,
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(route('dashboard', absolute: false));
+        $user = User::latest()->first();
+        $tenant = Tenant::where('user_id', $user->id)->first();
+        $this->assertDatabaseHas('tenant_packages', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $freePackage->id,
+            'active' => true,
+            'price' => 0,
+        ]);
+        $this->assertDatabaseHas('package_purchases', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $freePackage->id,
+            'type' => 'endcustomer_event',
+            'price' => 0,
+        ]);
+        $this->assertEquals('active', $tenant->subscription_status);
+    }
+
+    public function test_registration_with_paid_package_redirects_to_buy()
+    {
+        $paidPackage = Package::factory()->endcustomer()->create(['price' => 10]);
+
+        $response = $this->post('/de/register', [
+            'name' => 'Test User',
+            'username' => 'testuserpaid',
+            'email' => 'paid@example.com',
+            'password' => 'Password123!',
+            'password_confirmation' => 'Password123!',
+            'first_name' => 'Max',
+            'last_name' => 'Mustermann',
+            'address' => 'Musterstr. 1',
+            'phone' => '+49123456789',
+            'privacy_consent' => true,
+            'package_id' => $paidPackage->id,
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(route('buy.packages', $paidPackage->id));
+        $this->assertDatabaseHas('users', ['email' => 'paid@example.com']);
+        // Package not assigned yet
+        $this->assertDatabaseMissing('tenant_packages', ['package_id' => $paidPackage->id]);
+    }
+
+    public function test_registration_fails_with_invalid_email()
+    {
+        $response = $this->post('/de/register', [
+            'name' => 'Test User',
+            'username' => 'invaliduser',
+            'email' => 'invalid-email',
+            'password' => 'password',
+            'password_confirmation' => 'password',
+            'first_name' => 'Max',
+            'last_name' => 'Mustermann',
+            'address' => 'Musterstr. 1',
+            'phone' => '+49123456789',
+            'privacy_consent' => true,
+        ]);
+
+        $response->assertStatus(302);
+        $response->assertSessionHasErrors(['email' => 'Das E-Mail muss eine gültige E-Mail-Adresse sein.']);
+        $this->assertDatabaseMissing('users', ['email' => 'invalid-email']);
+    }
+
+    public function test_registration_fails_with_short_password()
+    {
+        $response = $this->post('/de/register', [
+            'name' => 'Test User',
+            'username' => 'shortpass',
+            'email' => 'short@example.com',
+            'password' => 'short',
+            'password_confirmation' => 'short',
+            'first_name' => 'Max',
+            'last_name' => 'Mustermann',
+            'address' => 'Musterstr. 1',
+            'phone' => '+49123456789',
+            'privacy_consent' => true,
+        ]);
+
+        $response->assertStatus(302);
+        $response->assertSessionHasErrors(['password' => 'Das Passwort muss mindestens 8 Zeichen lang sein.']);
+        $this->assertDatabaseMissing('users', ['email' => 'short@example.com']);
+    }
+
+    public function test_registration_fails_without_privacy_consent()
+    {
+        $response = $this->post('/de/register', [
+            'name' => 'Test User',
+            'username' => 'noconsent',
+            'email' => 'noconsent@example.com',
+            'password' => 'Password123!',
+            'password_confirmation' => 'Password123!',
+            'first_name' => 'Max',
+            'last_name' => 'Mustermann',
+            'address' => 'Musterstr. 1',
+            'phone' => '+49123456789',
+            'privacy_consent' => false,
+        ]);
+
+        $response->assertStatus(302);
+        $response->assertSessionHasErrors(['privacy_consent' => 'Die Datenschutzbestätigung muss akzeptiert werden.']);
+        $this->assertDatabaseMissing('users', ['email' => 'noconsent@example.com']);
+    }
+
+    public function test_registration_fails_with_duplicate_email()
+    {
+        // Create existing user
+        User::factory()->create(['email' => 'duplicate@example.com']);
+
+        $response = $this->post('/de/register', [
+            'name' => 'Duplicate User',
+            'username' => 'duplicate',
+            'email' => 'duplicate@example.com',
+            'password' => 'Password123!',
+            'password_confirmation' => 'Password123!',
+            'first_name' => 'Max',
+            'last_name' => 'Mustermann',
+            'address' => 'Musterstr. 1',
+            'phone' => '+49123456789',
+            'privacy_consent' => true,
+        ]);
+
+        $response->assertStatus(302);
+        $response->assertSessionHasErrors(['email' => 'Das E-Mail wurde bereits verwendet.']);
+    }
+
+    public function test_registration_fails_with_mismatched_passwords()
+    {
+        $response = $this->post('/de/register', [
+            'name' => 'Test User',
+            'username' => 'mismatch',
+            'email' => 'mismatch@example.com',
+            'password' => 'Password123!',
+            'password_confirmation' => 'different123!',
+            'first_name' => 'Max',
+            'last_name' => 'Mustermann',
+            'address' => 'Musterstr. 1',
+            'phone' => '+49123456789',
+            'privacy_consent' => true,
+        ]);
+
+        $response->assertStatus(302);
+        $response->assertSessionHasErrors(['password' => 'Das Passwort-Feld-Bestätigung stimmt nicht überein.']);
+        $this->assertDatabaseMissing('users', ['email' => 'mismatch@example.com']);
+    }
+
+    public function test_registration_with_invalid_package_id_uses_fallback()
+    {
+        $response = $this->post('/de/register', [
+            'name' => 'Test User',
+            'username' => 'invalidpkg',
+            'email' => 'invalidpkg@example.com',
+            'password' => 'Password123!',
+            'password_confirmation' => 'Password123!',
+            'first_name' => 'Max',
+            'last_name' => 'Mustermann',
+            'address' => 'Musterstr. 1',
+            'phone' => '+49123456789',
+            'privacy_consent' => true,
+            'package_id' => 999, // Invalid ID
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(route('dashboard', absolute: false));
+        $this->assertDatabaseHas('users', ['email' => 'invalidpkg@example.com']);
+        // No package assigned
+        $user = User::latest()->first();
+        $tenant = Tenant::where('user_id', $user->id)->first();
+        $this->assertDatabaseMissing('tenant_packages', ['tenant_id' => $tenant->id]);
     }
 }

tests/Feature/Auth/VerificationNotificationTest.php

@@ -22,7 +22,7 @@ class VerificationNotificationTest extends TestCase
 
         $this->actingAs($user)
             ->post(route('verification.send'))
-            ->assertRedirect(route('home'));
+            ->assertRedirect('/');
 
         Notification::assertSentTo($user, VerifyEmail::class);
     }

tests/Feature/FullUserFlowTest.php

@@ -0,0 +1,191 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Package;
+use App\Models\User;
+use App\Models\Tenant;
+use App\Models\PackagePurchase;
+use App\Models\TenantPackage;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Mail;
+use App\Mail\Welcome;
+use App\Mail\PurchaseConfirmation;
+use Stripe\StripeClient;
+use Mockery;
+
+class FullUserFlowTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_full_user_flow_registration_login_paid_purchase()
+    {
+        Mail::fake();
+
+        // Schritt 1: Registrierung mit Free Package
+        $freePackage = Package::factory()->endcustomer()->create(['price' => 0]);
+
+        $registrationData = [
+            'name' => 'Flow User',
+            'username' => 'flowuser',
+            'email' => 'flow@example.com',
+            'password' => 'Password123!',
+            'password_confirmation' => 'Password123!',
+            'first_name' => 'Max',
+            'last_name' => 'Mustermann',
+            'address' => 'Musterstr. 1',
+            'phone' => '+49123456789',
+            'privacy_consent' => 1,
+            'package_id' => $freePackage->id,
+        ];
+
+        $response = $this->post('/de/register', $registrationData);
+
+        $this->assertDatabaseHas('users', ['email' => 'flow@example.com']);
+        $user = User::where('email', 'flow@example.com')->first();
+        $this->assertDatabaseHas('tenants', ['user_id' => $user->id]);
+        $tenant = Tenant::where('user_id', $user->id)->first();
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(route('verification.notice', absolute: false));
+
+        $this->assertNotNull($user);
+        $this->assertNotNull($tenant);
+        $this->assertDatabaseHas('tenant_packages', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $freePackage->id,
+            'active' => true,
+        ]);
+        $this->assertDatabaseHas('package_purchases', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $freePackage->id,
+            'type' => 'endcustomer_event',
+            'price' => 0,
+        ]);
+        $this->assertEquals('active', $tenant->subscription_status);
+
+        // Für E2E-Test: Simuliere Email-Verification
+        $user->markEmailAsVerified();
+
+        // Schritt 2: Logout und Login
+        Auth::logout();
+
+        $this->assertGuest();
+
+        $loginResponse = $this->post(route('login.store'), [
+            'login' => 'flow@example.com',
+            'password' => 'Password123!',
+        ]);
+
+        $this->assertAuthenticated();
+        $loginResponse->assertRedirect(route('dashboard', absolute: false));
+
+        // Schritt 3: Paid Package Bestellung (Mock Stripe)
+        $paidPackage = Package::factory()->reseller()->create(['price' => 10]);
+
+        // Mock Stripe für Erfolg
+        $this->mock(StripeClient::class, function ($mock) use ($user, $tenant, $paidPackage) {
+            $mock->shouldReceive('checkout->sessions->create')
+                 ->andReturn((object)['url' => 'https://mock-stripe.com']);
+        });
+
+        // Simuliere Kauf (GET zu buy.packages, aber da es Redirect ist, prüfe Session oder folge)
+        // Für E2E: Angenommen, nach Mock wird Package zugewiesen (in real: Webhook, hier simuliere Success)
+        // Erstelle manuell für Test (in real: via Success-Route nach Zahlung)
+
+        // Simuliere Success nach Zahlung
+        TenantPackage::create([
+            'tenant_id' => $tenant->id,
+            'package_id' => $paidPackage->id,
+            'active' => true,
+            'price' => 10,
+            'purchased_at' => now(),
+            'expires_at' => now()->addYear(),
+        ]);
+
+        PackagePurchase::create([
+            'tenant_id' => $tenant->id,
+            'package_id' => $paidPackage->id,
+            'type' => 'reseller_subscription',
+            'provider_id' => 'stripe',
+            'price' => 10,
+            'purchased_at' => now(),
+        ]);
+
+        $tenant->update(['subscription_status' => 'active']);
+
+        // Assertions für gesamten Flow
+        $this->assertDatabaseHas('package_purchases', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $paidPackage->id,
+            'type' => 'reseller_subscription',
+        ]);
+
+        // Überprüfe, dass 2 Purchases existieren (Free + Paid)
+        $this->assertEquals(2, PackagePurchase::where('tenant_id', $tenant->id)->count());
+
+        // Mock Mails (nur Welcome, da Purchase keine dedizierte Klasse hat)
+        Mail::assertSent(Welcome::class, function ($mail) use ($user) {
+            return $mail->to[0]['address'] === $user->email;
+        });
+
+        // Finaler Redirect zu Success oder Dashboard
+        $successResponse = $this->actingAs($user)->get(route('marketing.success', $paidPackage->id));
+        $successResponse->assertRedirect('/admin');
+        $successResponse->assertStatus(302);
+    }
+
+    public function test_full_user_flow_with_errors()
+    {
+        // Schritt 1: Fehlgeschlagene Registrierung (kein Consent)
+        $response = $this->post('/de/register', [
+            'name' => 'Error User',
+            'username' => 'erroruser',
+            'email' => 'error@example.com',
+            'password' => 'Password123!',
+            'password_confirmation' => 'Password123!',
+            'first_name' => 'Max',
+            'last_name' => 'Mustermann',
+            'address' => 'Musterstr. 1',
+            'phone' => '+49123456789',
+            'privacy_consent' => false,
+        ]);
+
+        $response->assertSessionHasErrors(['privacy_consent' => 'Die Datenschutzbestätigung muss akzeptiert werden.']);
+        $this->assertGuest();
+        $this->assertDatabaseMissing('users', ['email' => 'error@example.com']);
+
+        // Schritt 2: Fehlgeschlagener Login (Rate Limit)
+        $user = User::factory()->create([
+            'email' => 'ratelimit@example.com',
+            'password' => bcrypt('password'),
+        ]);
+
+        for ($i = 0; $i < 5; $i++) {
+            $this->post(route('login.store'), [
+                'login' => 'ratelimit@example.com',
+                'password' => 'wrong',
+            ]);
+        }
+
+        $throttleResponse = $this->post(route('login.store'), [
+            'login' => 'ratelimit@example.com',
+            'password' => 'wrong',
+        ]);
+
+        $throttleResponse->assertSessionHasErrors(['login']);
+        $errors = session('errors');
+        $this->assertMatchesRegularExpression('/Zu viele Login-Versuche\. Bitte versuche es in \d+ Sekunden erneut\./', $errors->first('login'));
+        $this->assertGuest();
+
+        // Schritt 3: Bestellung ohne Auth blockiert
+        $package = Package::factory()->create(['price' => 10]);
+        $buyResponse = $this->get(route('buy.packages', $package->id));
+        $buyResponse->assertRedirect(route('register', ['package_id' => $package->id]));
+
+        // Nach Korrektur: Erfolgreicher Flow (kurz)
+        // ... (ähnlich wie oben, aber mit Error-Handling)
+    }
+}

tests/Feature/PurchaseTest.php

@@ -7,6 +7,9 @@ use App\Models\User;
 use App\Models\Tenant;
 use App\Models\TenantPackage;
 use App\Models\PackagePurchase;
+use App\Models\Event;
+use Stripe\StripeClient;
+use Stripe\Exception\CardException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Tests\TestCase;
 use Illuminate\Support\Facades\Auth;
@@ -24,7 +27,7 @@ class PurchaseTest extends TestCase
 
         $response = $this->get(route('buy.packages', $package->id));
 
-        $response->assertRedirect(route('register', ['package_id' => $package->id]));
+        $response->assertRedirect('/register?package_id=' . $package->id);
     }
 
     public function test_unverified_buy_redirects_to_verification()
@@ -41,7 +44,7 @@ class PurchaseTest extends TestCase
 
     public function test_free_package_assigns_after_auth()
     {
-        $freePackage = Package::factory()->create(['price' => 0]);
+        $freePackage = Package::factory()->create(['price' => 0, 'type' => 'endcustomer']);
         $user = User::factory()->create(['email_verified_at' => now()]);
         $tenant = Tenant::factory()->create(['user_id' => $user->id]);
         Auth::login($user);
@@ -53,12 +56,15 @@ class PurchaseTest extends TestCase
         $this->assertDatabaseHas('tenant_packages', [
             'tenant_id' => $tenant->id,
             'package_id' => $freePackage->id,
+            'price' => 0,
         ]);
 
         $this->assertDatabaseHas('package_purchases', [
-            'user_id' => $user->id,
             'tenant_id' => $tenant->id,
             'package_id' => $freePackage->id,
+            'provider_id' => 'free',
+            'price' => 0,
+            'type' => 'endcustomer_event',
         ]);
     }
 
@@ -82,11 +88,11 @@ class PurchaseTest extends TestCase
         $tenant = Tenant::factory()->create(['user_id' => $user->id]);
         Auth::login($user);
 
-        $mockClient = Mockery::mock(\PayPal\PayPalHttp\Client::class);
+        $mockClient = Mockery::mock('PayPal\PayPalHttp\Client');
         $mockOrders = Mockery::mock();
         $mockOrders->shouldReceive('createOrder')->andReturn(new \stdClass()); // Simplified mock
         $mockClient->shouldReceive('orders')->andReturn($mockOrders);
-        $this->app->instance(\PayPal\PayPalHttp\Client::class, $mockClient);
+        $this->app->instance('PayPal\PayPalHttp\Client', $mockClient);
 
         $response = $this->get(route('buy.packages', $paidPackage->id) . '?provider=paypal');
 
@@ -108,7 +114,7 @@ class PurchaseTest extends TestCase
             'type' => $paidPackage->type,
         ]);
 
-        $mockClient = Mockery::mock(\PayPal\PayPalHttp\Client::class);
+        $mockClient = Mockery::mock('PayPal\PayPalHttp\Client');
         $mockOrders = Mockery::mock();
         $mockCapture = new \stdClass();
         $mockCapture->status = 'COMPLETED';
@@ -117,7 +123,7 @@ class PurchaseTest extends TestCase
         $mockResponse->result = $mockCapture;
         $mockOrders->shouldReceive('captureOrder')->andReturn($mockResponse);
         $mockClient->shouldReceive('orders')->andReturn($mockOrders);
-        $this->app->instance(\PayPal\PayPalHttp\Client::class, $mockClient);
+        $this->app->instance('PayPal\PayPalHttp\Client', $mockClient);
 
         session(['paypal_order_id' => 'test-order-id']);
 
@@ -137,4 +143,171 @@ class PurchaseTest extends TestCase
         $this->assertNull(session('paypal_order_id'));
         $this->assertEquals('active', $tenant->fresh()->subscription_status);
     }
+
+    public function test_purchase_fails_when_package_limit_reached()
+    {
+        $package = Package::factory()->create(['price' => 0, 'max_events' => 1]); // Assume max_events field
+        $user = User::factory()->create(['email_verified_at' => now()]);
+        $tenant = Tenant::factory()->create(['user_id' => $user->id]);
+        Auth::login($user);
+
+        // Simulate limit reached: Create one event already
+        Event::factory()->create(['tenant_id' => $tenant->id]);
+
+        // Assign package first to set limit
+        TenantPackage::create([
+            'tenant_id' => $tenant->id,
+            'package_id' => $package->id,
+            'active' => true,
+        ]);
+
+        $response = $this->get(route('buy.packages', $package->id));
+
+        $response->assertStatus(403);
+        $response->assertSee('Package limit exceeded');
+        // No new purchase
+        $this->assertDatabaseMissing('package_purchases', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $package->id,
+        ]);
+    }
+
+    public function test_stripe_payment_failure_does_not_assign_package()
+    {
+        $paidPackage = Package::factory()->create(['price' => 10]);
+        $user = User::factory()->create(['email_verified_at' => now()]);
+        $tenant = Tenant::factory()->create(['user_id' => $user->id]);
+        Auth::login($user);
+
+        // Mock Stripe failure
+        $this->mock(StripeClient::class, function ($mock) {
+            $mock->shouldReceive('checkout->sessions->create')->andThrow(new CardException('Payment failed', 'card_declined', null, null));
+        });
+
+        $response = $this->get(route('buy.packages', $paidPackage->id));
+
+        $response->assertStatus(422);
+        $response->assertSee('Payment failed');
+        $this->assertDatabaseMissing('tenant_packages', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $paidPackage->id,
+        ]);
+    }
+
+    public function test_paypal_capture_failure_does_not_activate_package()
+    {
+        $paidPackage = Package::factory()->create(['price' => 10]);
+        $user = User::factory()->create(['email_verified_at' => now()]);
+        $tenant = Tenant::factory()->create(['user_id' => $user->id]);
+        Auth::login($user);
+
+        $mockClient = Mockery::mock('PayPal\PayPalHttp\Client');
+        $mockOrders = Mockery::mock();
+        $mockResponse = new \stdClass();
+        $mockResponse->statusCode = 400;
+        $mockOrders->shouldReceive('captureOrder')->andThrow(new \Exception('Capture failed'));
+        $mockClient->shouldReceive('orders')->andReturn($mockOrders);
+        $this->app->instance('PayPal\PayPalHttp\Client', $mockClient);
+
+        session(['paypal_order_id' => 'failed-order-id']);
+
+        $response = $this->get(route('marketing.success', $paidPackage->id));
+
+        $response->assertStatus(422);
+        $response->assertSee('Payment capture failed');
+        $this->assertDatabaseMissing('tenant_packages', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $paidPackage->id,
+        ]);
+    }
+
+    public function test_purchase_with_invalid_provider_redirects_to_stripe()
+    {
+        $paidPackage = Package::factory()->create(['price' => 10]);
+        $user = User::factory()->create(['email_verified_at' => now()]);
+        $tenant = Tenant::factory()->create(['user_id' => $user->id]);
+        Auth::login($user);
+
+        $response = $this->get(route('buy.packages', $paidPackage->id) . '?provider=invalid');
+
+        $response->assertRedirect(); // Defaults to Stripe
+        $this->assertStringContainsString('checkout.stripe.com', $response->headers->get('Location'));
+    }
+
+    public function test_refund_simulation_deactivates_package()
+    {
+        $paidPackage = Package::factory()->create(['price' => 10]);
+        $user = User::factory()->create(['email_verified_at' => now()]);
+        $tenant = Tenant::factory()->create(['user_id' => $user->id]);
+        Auth::login($user);
+
+        // First, simulate successful purchase
+        TenantPackage::create([
+            'tenant_id' => $tenant->id,
+            'package_id' => $paidPackage->id,
+            'active' => true,
+        ]);
+        PackagePurchase::create([
+            'user_id' => $user->id,
+            'tenant_id' => $tenant->id,
+            'package_id' => $paidPackage->id,
+            'provider_id' => 'stripe',
+            'status' => 'completed',
+        ]);
+
+        // Mock refund webhook or endpoint
+        $this->mock(\Stripe\StripeClient::class, function ($mock) use ($tenant, $paidPackage) {
+            $mock->shouldReceive('refunds->create')->andReturnSelf();
+        });
+
+        // Simulate refund call (assume route or event)
+        $response = $this->post(route('purchase.refund', $paidPackage->id), [
+            'purchase_id' => PackagePurchase::latest()->first()->id,
+        ]);
+
+        $response->assertStatus(200);
+        $this->assertDatabaseHas('tenant_packages', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $paidPackage->id,
+            'active' => false,
+        ]);
+        $this->assertDatabaseHas('package_purchases', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $paidPackage->id,
+            'status' => 'refunded',
+        ]);
+        $this->assertEquals('cancelled', $tenant->fresh()->subscription_status);
+    }
+
+    public function test_multiple_purchases_overwrite_previous_package()
+    {
+        $firstPackage = Package::factory()->create(['price' => 0]);
+        $secondPackage = Package::factory()->create(['price' => 5]);
+        $user = User::factory()->create(['email_verified_at' => now()]);
+        $tenant = Tenant::factory()->create(['user_id' => $user->id]);
+        Auth::login($user);
+
+        // First purchase
+        $this->get(route('buy.packages', $firstPackage->id));
+        $this->assertDatabaseHas('tenant_packages', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $firstPackage->id,
+            'active' => true,
+        ]);
+
+        // Second purchase
+        $this->get(route('buy.packages', $secondPackage->id));
+
+        // First deactivated, second active
+        $this->assertDatabaseHas('tenant_packages', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $firstPackage->id,
+            'active' => false,
+        ]);
+        $this->assertDatabaseHas('tenant_packages', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $secondPackage->id,
+            'active' => true,
+        ]);
+    }
 }