private()->create(['path' => 'documents/scan.jpg', 'filename' => 'scan.jpg']); Storage::disk('private')->put($medium->path, 'content'); $document->media()->attach($medium->id, ['collection' => MediaCollectionEnum::Primary->value]); return $medium; } public function test_download_requires_authentication(): void { $this->get(route('dashboard.media.download', Medium::factory()->create()))->assertRedirect(route('login')); } public function test_requester_can_download_document_file(): void { $document = Document::factory()->create(); $medium = $this->privateMediumFor($document); $this->actingAs($document->requester)->get(route('dashboard.media.download', $medium)) ->assertOk() ->assertDownload('scan.jpg'); } public function test_unrelated_user_is_forbidden(): void { $document = Document::factory()->create(); $medium = $this->privateMediumFor($document); $this->actingAs(User::factory()->create())->get(route('dashboard.media.download', $medium))->assertForbidden(); } public function test_missing_file_returns_not_found(): void { Storage::fake('private'); $document = Document::factory()->create(); $medium = Medium::factory()->private()->create(['path' => 'documents/missing.jpg']); $document->media()->attach($medium->id, ['collection' => MediaCollectionEnum::Primary->value]); $this->actingAs($document->requester)->get(route('dashboard.media.download', $medium))->assertNotFound(); } }