HTTP tests and database tests

tests/Feature/InstalmentFormTest.php · fees-app/tests/Feature/InstalmentFormTest.php

<?php

namespace Tests\Feature;

use App\Models\Instalment;
use App\Models\Student;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

// Five HTTP tests of the instalments feature: each sends one request through the whole application and reads the
// response, the session and the database.
class InstalmentFormTest extends TestCase
{
    use RefreshDatabase;

    public function test_staff_add_an_instalment(): void
    {
        $student = Student::factory()->create();
        $staff = User::factory()->create(['centre_id' => $student->batch->centre_id]);

        $response = $this->actingAs($staff)->post("/students/{$student->id}/instalments", [
            'due_on' => '2026-02-15',
            'amount_paise' => 118000,
        ]);

        $response->assertRedirect("/students/{$student->id}/instalments");
        $response->assertSessionHas('status', 'Instalment added.');
        $this->assertDatabaseHas('instalments', [
            'student_id' => $student->id,
            'amount_paise' => 118000,
            'status' => 'pending',
        ]);
    }

    public function test_an_amount_under_one_rupee_is_refused(): void
    {
        $student = Student::factory()->create();
        $staff = User::factory()->create(['centre_id' => $student->batch->centre_id]);

        $response = $this->actingAs($staff)->post("/students/{$student->id}/instalments", [
            'due_on' => '2026-02-15',
            'amount_paise' => 50,
        ]);

        $response->assertSessionHasErrors('amount_paise');
        $this->assertDatabaseCount('instalments', 0);
    }

    public function test_a_guest_is_sent_to_sign_in(): void
    {
        $student = Student::factory()->create();

        $this->get("/students/{$student->id}/instalments")->assertRedirect('/login');
    }

    public function test_the_guardian_sees_the_list(): void
    {
        $student = Student::factory()->withGuardian()->create();
        Instalment::factory()->for($student)->create(['amount_paise' => 118000]);

        $this->actingAs($student->guardian->user)
            ->get("/students/{$student->id}/instalments")
            ->assertOk()
            ->assertSeeText('1,180.00');
    }

    public function test_the_list_answers_in_json(): void
    {
        $student = Student::factory()->withGuardian()->create();
        Instalment::factory()->for($student)->create(['due_on' => '2026-02-15']);
        Instalment::factory()->for($student)->paid()->create(['due_on' => '2026-01-15']);

        $this->actingAs($student->guardian->user)
            ->getJson("/students/{$student->id}/instalments")
            ->assertOk()
            ->assertJsonPath('meta.count', 2)
            ->assertJsonPath('meta.pending_paise', 118000)
            ->assertJsonPath('data.0.status', 'paid');
    }
}

fees-app/app/Http/Controllers/InstalmentController.php

<?php

namespace App\Http\Controllers;

use App\Models\Instalment;
use App\Models\Student;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Gate;

// A student's fee instalments: the list (a page, or JSON when the request asks for it), adding one, marking one
// paid and cancelling one that is still pending. Every action asks StudentPolicy first.
class InstalmentController extends Controller
{
    public function index(Request $request, Student $student)
    {
        Gate::authorize('viewFees', $student);

        $instalments = $student->instalments()->orderBy('due_on')->get();

        if ($request->wantsJson()) {
            return response()->json([
                'data' => $instalments->map(fn (Instalment $instalment) => [
                    'id' => $instalment->id,
                    'due_on' => $instalment->due_on->toDateString(),
                    'amount_paise' => $instalment->amount_paise,
                    'status' => $instalment->status,
                ]),
                'meta' => [
                    'count' => $instalments->count(),
                    'pending_paise' => $instalments->where('status', 'pending')->sum('amount_paise'),
                ],
            ]);
        }

        return view('instalments.index', ['student' => $student, 'instalments' => $instalments]);
    }

    public function store(Request $request, Student $student)
    {
        Gate::authorize('manageFees', $student);

        $data = $request->validate([
            'due_on' => ['required', 'date'],
            'amount_paise' => ['required', 'integer', 'min:100', 'max:10000000'],
        ]);

        $student->instalments()->create($data + ['status' => 'pending']);

        return redirect("/students/{$student->id}/instalments")->with('status', 'Instalment added.');
    }

    public function markPaid(Student $student, Instalment $instalment)
    {
        Gate::authorize('manageFees', $student);

        if ($instalment->status === 'paid') {
            return redirect("/students/{$student->id}/instalments")
                ->withErrors(['instalment' => 'This instalment is already paid.']);
        }

        $instalment->update(['status' => 'paid', 'paid_on' => now()->toDateString()]);

        return redirect("/students/{$student->id}/instalments")->with('status', 'Marked as paid.');
    }

    public function destroy(Student $student, Instalment $instalment)
    {
        Gate::authorize('manageFees', $student);

        if ($instalment->status === 'paid') {
            return redirect("/students/{$student->id}/instalments")
                ->withErrors(['instalment' => 'A paid instalment cannot be cancelled.']);
        }

        $instalment->delete();

        return redirect("/students/{$student->id}/instalments")->with('status', 'Instalment cancelled.');
    }
}

fees-app/app/Policies/StudentPolicy.php

<?php

namespace App\Policies;

use App\Models\Student;
use App\Models\User;

// Who may see and change a student's fee instalments. Laravel finds this policy for App\Models\Student by its name.
class StudentPolicy
{
    /** Staff of the student's centre, or the student's own guardian, may see the instalments. */
    public function viewFees(User $user, Student $student): bool
    {
        return $this->isStaffOf($user, $student) || $student->guardian?->user_id === $user->id;
    }

    /** Only staff of the student's centre may add, cancel or mark instalments paid. */
    public function manageFees(User $user, Student $student): bool
    {
        return $this->isStaffOf($user, $student);
    }

    private function isStaffOf(User $user, Student $student): bool
    {
        return $user->centre_id !== null && $user->centre_id === $student->batch->centre_id;
    }
}

routes/web.php · fees-app/routes/web.php

<?php

use App\Http\Controllers\InstalmentController;
use Illuminate\Support\Facades\Route;

Route::get('/', function () {
    return view('welcome');
});

// The auth middleware sends a guest to the route named login; this project's sign-in page is a placeholder.
Route::get('/login', fn () => 'Sign in to Pathshala')->name('login');

// scopeBindings(): the {instalment} in a URL must belong to the {student} in the same URL, or the answer is 404.
Route::middleware('auth')->scopeBindings()->group(function () {
    Route::get('/students/{student}/instalments', [InstalmentController::class, 'index']);
    Route::post('/students/{student}/instalments', [InstalmentController::class, 'store']);
    Route::patch('/students/{student}/instalments/{instalment}/paid', [InstalmentController::class, 'markPaid']);
    Route::delete('/students/{student}/instalments/{instalment}', [InstalmentController::class, 'destroy']);
});