actingAs($f['receiver']);
$payload = receiptPayload($f);
$payload['items'][0]['notes'] = '';
$receipt = app(ReceiptWorkflow::class)->confirm($f['receiver'], $f['order'], $payload);
ReceiptDocument::query()->create(['tenant_id' => $f['tenant']->id, 'goods_receipt_id' => $receipt->id, 'uploaded_by' => $f['receiver']->id,
'document_type' => 'quality', 'original_name' => 'quality.png', 'path' => 'private-secret-path', 'mime_type' => 'image/png', 'size' => 40, 'sha256' => str_repeat('a', 64), 'created_at' => now()]);
$before = [];
foreach (['goods_receipts', 'goods_receipt_items', 'stock_movements', 'audit_logs', 'receipt_documents', 'approval_steps', 'budget_entries'] as $table) {
$before[$table] = DB::table($table)->orderBy('id')->get()->toArray();
}
$this->get('/recepcoes/'.$receipt->id.'/imprimir')->assertOk()
->assertHeader('Cache-Control', 'no-store, private')
->assertSee($receipt->number)->assertSee($f['order']->number)->assertSee('0,600')->assertSee('Conforme')
->assertSee('<script>alert(1)</script>', false)->assertDontSee('', false)
->assertSee('quality.png')->assertSee(str_repeat('a', 64))->assertDontSee('private-secret-path');
foreach ($before as $table => $rows) {
expect(DB::table($table)->orderBy('id')->get()->toArray())->toEqual($rows);
}
$this->actingAs($f['issuer'])->get('/recepcoes/'.$receipt->id.'/imprimir')->assertOk();
});
test('receipt print block preserves tenant isolation and native visibility', function () {
$f = receiptFixture();
$receipt = app(ReceiptWorkflow::class)->confirm($f['receiver'], $f['order'], receiptPayload($f));
$foreign = receiptFixture();
$this->actingAs($foreign['receiver'])->get('/recepcoes/'.$receipt->id.'/imprimir')->assertNotFound();
$requester = User::factory()->create(['tenant_id' => $f['tenant']->id, 'department_id' => $f['department']->id, 'purchasing_role' => PurchasingRole::Requester]);
$this->actingAs($requester);
$this->get('/recepcoes/'.$receipt->id.'/imprimir')->assertForbidden();
});
test('receipt print block remains available without the optional document table', function () {
$f = receiptFixture();
$receipt = app(ReceiptWorkflow::class)->confirm($f['receiver'], $f['order'], receiptPayload($f));
Schema::drop('receipt_documents');
$this->actingAs($f['receiver'])->get('/recepcoes/'.$receipt->id.'/imprimir')->assertOk()->assertSee('Sem referências documentais');
});