Snapshot of main at 9f39a6e1e (2026-11-02)

tests/Feature/RegistrationTest.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class RegistrationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_registration_screen_can_be_rendered()
+    {
+        $response = $this->get(route('register'));
+
+        $response->assertStatus(200);
+    }
+
+    /**
+     * Registration runs through the Livewire Registration component. Fortify's POST /register
+     * created users with only CreateNewUser's minimal rules (e.g. a reserved name like "admin"),
+     * so it must not be reachable.
+     */
+    public function test_fortify_register_endpoint_cannot_create_users()
+    {
+        // A real client can get a CSRF token from any page
+        $this->withoutMiddleware(\App\Http\Middleware\VerifyCsrfToken::class);
+
+        $response = $this->post('/register', [
+            'name' => 'admin',
+            'email' => 'bypass@example.com',
+            'password' => 'Password-12345!',
+            'password_confirmation' => 'Password-12345!',
+        ]);
+
+        $this->assertContains($response->status(), [404, 405]);
+        $this->assertDatabaseMissing('users', ['email' => 'bypass@example.com']);
+        $this->assertGuest();
+    }
+}