Challenge 2: Test an Authenticated Route — Possible Solution
====================================================================

// tests/Feature/DashboardTest.php

namespace Tests\Feature;

use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class DashboardTest extends TestCase
{
    use RefreshDatabase;

    public function test_authenticated_user_can_view_dashboard(): void
    {
        $user = User::factory()->create();

        $response = $this->actingAs($user)->get('/dashboard');

        $response->assertStatus(200);
    }

    public function test_guest_is_redirected_from_dashboard(): void
    {
        $response = $this->get('/dashboard');

        $response->assertRedirect('/login');
    }
}

WHY THIS WORKS
--------------
- User::factory()->create() generates and saves a realistic User instance
  — this relies on the same factory pattern from this chapter, applied to
  the User model rather than Book, and works automatically because every
  new Laravel project ships with a UserFactory by default.
- $this->actingAs($user)->get('/dashboard') simulates the entire request
  as if $user were genuinely logged in — Laravel sets up the
  authentication state for the test's HTTP kernel internally, so the
  'auth' middleware from Chapter 1 sees a real authenticated user and
  allows the request through, without needing to actually submit a login
  form first.
- The second test intentionally does NOT call actingAs() — this
  represents an anonymous, unauthenticated request. assertRedirect
  ('/login') confirms the 'auth' middleware correctly intercepts the
  request and redirects it, rather than allowing it through or returning
  some other unexpected response.
- Testing BOTH the success path (test_authenticated_user_can_view_
  dashboard) and the denial path (test_guest_is_redirected_from_
  dashboard) is what actually proves the access control is working
  correctly — a test suite that only ever checks the "allowed" case could
  pass even if the middleware were accidentally removed or misconfigured
  to allow everyone through.