get('/consulta')->assertOk()->assertInertia(fn (Assert $page) => $page ->component('preview/index') ->where('auth.user', null) ->missing('suppliers')->missing('requisitions')->missing('documents')); $this->assertGuest(); }); test('preview does not expose authenticated account data or log it out', function () { $user = User::factory()->create(); $this->actingAs($user)->get('/consulta')->assertOk()->assertInertia(fn (Assert $page) => $page->where('auth.user', null)); $this->assertAuthenticatedAs($user); }); test('consultation creates no business access or mutation endpoint', function () { $this->get('/consulta')->assertOk(); foreach (['/dashboard', '/fornecedores', '/cotacoes', '/conflitos'] as $path) { $this->get($path)->assertRedirect('/login'); } $this->post('/fornecedores', ['name' => 'Tentativa pública'])->assertRedirect('/login'); $this->post('/consulta', [])->assertStatus(405); expect(User::query()->count())->toBe(0); });