endcustomer()->create([ 'max_photos' => 100, 'max_guests' => 50, 'gallery_days' => 7, ]); $event = Event::factory()->for($this->tenant)->create([ 'slug' => 'summer-party', 'name' => ['de' => 'Sommerparty', 'en' => 'Summer Party'], ]); $eventPackage = EventPackage::create([ 'event_id' => $event->id, 'package_id' => $package->id, 'purchased_price' => $package->price, 'purchased_at' => now()->subDay(), 'used_photos' => 0, 'used_guests' => 0, 'gallery_expires_at' => now()->addDays(7), ]); $addon = EventPackageAddon::create([ 'event_package_id' => $eventPackage->id, 'event_id' => $event->id, 'tenant_id' => $this->tenant->id, 'addon_key' => 'extra_photos_500', 'quantity' => 1, 'extra_photos' => 500, 'extra_guests' => 0, 'extra_gallery_days' => 0, 'checkout_id' => 'ORDER-ADDON-123', 'transaction_id' => 'TX-ABC', 'status' => 'completed', 'amount' => 12.00, 'currency' => 'EUR', 'metadata' => [ 'label' => 'Extra photos 500', 'addon_intent' => 'intent_123', ], 'purchased_at' => now(), 'receipt_payload' => ['receipt_url' => 'https://receipt.test/addon'], ]); $response = $this->authenticatedRequest('GET', "/api/v1/tenant/events/{$event->slug}/addons/purchase?addon_intent=intent_123"); $response->assertOk(); $response->assertJsonPath('data.id', $addon->id); $response->assertJsonPath('data.addon_key', 'extra_photos_500'); $response->assertJsonPath('data.label', 'Extra photos 500'); $response->assertJsonPath('data.checkout_id', 'ORDER-ADDON-123'); $response->assertJsonPath('data.transaction_id', 'TX-ABC'); $response->assertJsonPath('data.status', 'completed'); $response->assertJsonPath('data.amount', 12); $response->assertJsonPath('data.currency', 'EUR'); $response->assertJsonPath('data.extra_photos', 500); $response->assertJsonPath('data.receipt_url', 'https://receipt.test/addon'); $response->assertJsonPath('data.addon_intent', 'intent_123'); $response->assertJsonPath('data.event.slug', 'summer-party'); } public function test_tenant_cannot_load_purchase_for_event_of_other_tenant(): void { $otherTenant = Tenant::factory()->create(); $otherEvent = Event::factory()->for($otherTenant)->create([ 'slug' => 'foreign-event', ]); $response = $this->authenticatedRequest('GET', "/api/v1/tenant/events/{$otherEvent->slug}/addons/purchase?addon_key=extra_photos_500"); $response->assertStatus(404); $response->assertJsonPath('error.code', 'event_not_found'); } }