Add tests for cases access control and Gate setup

Ensure the 'view-all_cases' permission row exists and register a Gate in tests so the can:view-all_cases middleware is enforceable. Update the existing forbidden test to define the permission and Gate, and add two new tests: one that confirms a user can view their own cases (scoped by userId) without the global permission, and another that verifies a user cannot view another user's cases without the permission and that granting it restores access. Creates test data via factories and asserts correct response codes and payload counts.

Author: mcraeteisha

tests/Feature/Api/V1_1/CaseControllerTest.php

@@ -479,23 +479,26 @@ public function test_get_my_cases_counters_ok(): void
 
     public function test_get_all_cases_forbidden_without_view_all_cases_permission(): void
     {
-        // Seed permissions and register gates so the `can:view-all_cases`
-        // middleware on api.1.1.cases.all_cases is enforceable in tests.
-        $this->initializePermissions();
+        // Ensure the permission row exists and register it as a Laravel Gate
+        // so $user->can('view-all_cases') is enforceable in tests.
+        Permission::firstOrCreate(
+            ['name' => 'view-all_cases'],
+            ['title' => 'View All Cases'],
+        );
+        Gate::define('view-all_cases', fn ($user) => $user->hasPermission('view-all_cases'));
 
         $nonAdmin = User::factory()->create([
             'is_administrator' => false,
         ]);
 
-        // Create some cases so a permitted user would get a non-empty payload.
         self::createCasesStartedForUser($nonAdmin->id, 3);
 
-        // Without the permission, access is denied.
+        // Unscoped request (the "All cases" tab) — denied without the permission.
         $response = $this->actingAs($nonAdmin, 'api')
             ->json('GET', route('api.1.1.cases.all_cases'));
         $response->assertStatus(403);
 
-        // Granting the permission restores access.
+        // Granting the permission restores access to the unscoped query.
         $nonAdmin->giveDirectPermission('view-all_cases');
 
         $response = $this->actingAs($nonAdmin, 'api')
@@ -504,6 +507,57 @@ public function test_get_all_cases_forbidden_without_view_all_cases_permission()
         $response->assertJsonCount(3, 'data');
     }
 
+    public function test_get_all_cases_allows_user_to_view_their_own_cases_without_permission(): void
+    {
+        // The endpoint is shared by the "My cases" tab, which scopes the
+        // query to the authenticated user. That self-scoped path must work
+        // even when the user lacks `view-all_cases`.
+        $nonAdmin = User::factory()->create([
+            'is_administrator' => false,
+        ]);
+
+        $ownCases = self::createCasesStartedForUser($nonAdmin->id, 4);
+        $otherUser = self::createUser('other_user');
+        self::createCasesStartedForUser($otherUser->id, 6);
+
+        $response = $this->actingAs($nonAdmin, 'api')
+            ->json('GET', route('api.1.1.cases.all_cases', ['userId' => $nonAdmin->id]));
+
+        $response->assertStatus(200);
+        $response->assertJsonCount($ownCases->count(), 'data');
+        $response->assertJsonMissing(['user_id' => $otherUser->id]);
+    }
+
+    public function test_get_all_cases_forbids_user_from_viewing_another_users_cases_without_permission(): void
+    {
+        Permission::firstOrCreate(
+            ['name' => 'view-all_cases'],
+            ['title' => 'View All Cases'],
+        );
+        Gate::define('view-all_cases', fn ($user) => $user->hasPermission('view-all_cases'));
+
+        $nonAdmin = User::factory()->create([
+            'is_administrator' => false,
+        ]);
+        $otherUser = self::createUser('other_user');
+        self::createCasesStartedForUser($otherUser->id, 2);
+
+        // Passing another user's id must require `view-all_cases`; otherwise
+        // any authenticated user could iterate userIds to enumerate the
+        // entire platform.
+        $response = $this->actingAs($nonAdmin, 'api')
+            ->json('GET', route('api.1.1.cases.all_cases', ['userId' => $otherUser->id]));
+        $response->assertStatus(403);
+
+        // With the permission, the same request succeeds.
+        $nonAdmin->giveDirectPermission('view-all_cases');
+
+        $response = $this->actingAs($nonAdmin, 'api')
+            ->json('GET', route('api.1.1.cases.all_cases', ['userId' => $otherUser->id]));
+        $response->assertStatus(200);
+        $response->assertJsonCount(2, 'data');
+    }
+
     public function test_get_all_cases_participants(): void
     {
         $userA = $this->createUser('user_a');