create(); $event = Event::factory()->for($tenant)->create(['status' => 'published']); $photo = Photo::factory()->for($event)->create([ 'status' => 'approved', ]); $token = app(EventJoinTokenService::class)->createToken($event)->plain_token; $response = $this->withHeaders([ 'X-Device-Id' => 'device-share', 'Accept' => 'application/json', ])->postJson("/api/v1/events/{$token}/photos/{$photo->id}/share"); $response->assertOk(); $response->assertJsonStructure(['slug', 'url', 'expires_at']); $this->assertDatabaseHas('photo_share_links', [ 'photo_id' => $photo->id, 'slug' => $response->json('slug'), ]); } public function test_share_link_cannot_be_created_for_unrelated_photo(): void { $event = Event::factory()->create(['status' => 'published']); $otherEvent = Event::factory()->create(['status' => 'published']); $photo = Photo::factory()->for($otherEvent)->create(['status' => 'approved']); $token = app(EventJoinTokenService::class)->createToken($event)->plain_token; $response = $this->withHeaders([ 'X-Device-Id' => 'device-share', 'Accept' => 'application/json', ])->postJson("/api/v1/events/{$token}/photos/{$photo->id}/share"); $response->assertNotFound(); } public function test_share_payload_exposes_public_photo_data(): void { $tenant = Tenant::factory()->create(); $event = Event::factory()->for($tenant)->create(['status' => 'published']); $task = Task::factory()->for($tenant)->create(); $photo = Photo::factory()->for($event)->create([ 'status' => 'approved', 'task_id' => $task->id, ]); $share = PhotoShareLink::factory()->for($photo)->create([ 'expires_at' => now()->addDay(), ]); $response = $this->getJson("/api/v1/photo-shares/{$share->slug}"); $response->assertOk(); $response->assertJsonPath('photo.id', $photo->id); $response->assertJsonPath('photo.image_urls.full', fn ($value) => str_contains($value, '/photo-shares/')); $response->assertJsonPath('event.id', $event->id); } }