Files
crewli/api/tests/Feature/Api/V1/VolunteerRegistrationTest.php
bert.hausmans 52f6380ac0 security: round 3 — token security (crypto random, hashed storage, portal middleware)
Token generation:
- Replace Str::ulid() with bin2hex(random_bytes(32)) for 256-bit entropy
- Store SHA-256 hash in database, never plaintext tokens
- Hash input before lookup on all token endpoints

Invitation tokens:
- InvitationService: generate crypto random, store hash, pass plain
  token transiently for email URL via UserInvitation::$plainToken
- InvitationController show/accept: hash input before DB lookup
- AcceptInvitationRequest: hash token before invitation lookup
- Migration: widen user_invitations.token and artists.portal_token
  from char(26) to char(64) for SHA-256 hex digests

Portal token auth:
- PortalTokenController: remove Schema::hasTable() runtime checks,
  hash token before lookup, return shaped response via PortalEventResource
  instead of raw model data
- Create PortalEventResource (name, dates, status only — no internals)
- Handle missing production_requests table gracefully via try/catch

Portal token middleware:
- Implement full token validation: extract from Bearer header or ?token=
  query param, hash, look up in artists/production_requests, verify
  event exists and is not draft/closed, set portal context on request
- Return generic 401 on any failure (no information leakage)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-14 06:52:54 +02:00

815 lines
27 KiB
PHP

<?php
declare(strict_types=1);
namespace Tests\Feature\Api\V1;
use App\Enums\PersonStatus;
use App\Mail\RegistrationConfirmationMail;
use App\Models\CrowdType;
use App\Models\Event;
use App\Models\FestivalSection;
use App\Models\Organisation;
use App\Models\Person;
use App\Models\RegistrationFormField;
use App\Models\TimeSlot;
use App\Models\User;
use Database\Seeders\RoleSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Mail;
use Laravel\Sanctum\Sanctum;
use Tests\TestCase;
class VolunteerRegistrationTest extends TestCase
{
use RefreshDatabase;
private Organisation $organisation;
private Event $event;
private CrowdType $volunteerCrowdType;
private TimeSlot $timeSlot;
private FestivalSection $section;
protected function setUp(): void
{
parent::setUp();
$this->seed(RoleSeeder::class);
$this->organisation = Organisation::factory()->create();
$this->volunteerCrowdType = CrowdType::factory()->systemType('VOLUNTEER')->create([
'organisation_id' => $this->organisation->id,
]);
$this->event = Event::factory()->create([
'organisation_id' => $this->organisation->id,
'status' => 'registration_open',
]);
$this->section = FestivalSection::factory()->create([
'event_id' => $this->event->id,
]);
$this->timeSlot = TimeSlot::factory()->create([
'event_id' => $this->event->id,
]);
}
// ─── Anonymous Registration ─────────────────────────────────────────
public function test_volunteer_can_register_with_all_fields(): void
{
Mail::fake();
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Jan',
'last_name' => 'de Vries',
'email' => 'jan@voorbeeld.nl',
'password' => 'Wachtwoord1',
'phone' => '+31612345678',
'tshirt_size' => 'L',
'motivation' => 'Ik wil graag helpen bij dit festival!',
'availabilities' => [
['time_slot_id' => $this->timeSlot->id, 'preference_level' => 5],
],
]);
$response->assertStatus(201);
$this->assertDatabaseHas('persons', [
'email' => 'jan@voorbeeld.nl',
'event_id' => $this->event->id,
'status' => PersonStatus::PENDING->value,
]);
}
public function test_volunteer_can_register_with_minimal_fields(): void
{
Mail::fake();
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Sophie',
'last_name' => 'Bakker',
'email' => 'sophie@voorbeeld.nl',
'password' => 'Wachtwoord1',
]);
$response->assertStatus(201);
$this->assertDatabaseHas('persons', [
'email' => 'sophie@voorbeeld.nl',
'first_name' => 'Sophie',
'last_name' => 'Bakker',
'event_id' => $this->event->id,
]);
}
public function test_registration_resolves_to_parent_event(): void
{
$festival = Event::factory()->festival()->create([
'organisation_id' => $this->organisation->id,
'status' => 'registration_open',
]);
$subEvent = Event::factory()->subEvent($festival)->create([
'status' => 'registration_open',
]);
TimeSlot::factory()->create(['event_id' => $festival->id]);
$response = $this->postJson("/api/v1/events/{$subEvent->id}/volunteer-register", [
'first_name' => 'Pieter',
'last_name' => 'Jansen',
'email' => 'pieter@voorbeeld.nl',
'password' => 'Wachtwoord1',
]);
$response->assertStatus(201);
$this->assertDatabaseHas('persons', [
'email' => 'pieter@voorbeeld.nl',
'event_id' => $festival->id,
]);
}
public function test_registration_syncs_availabilities(): void
{
Mail::fake();
$timeSlot2 = TimeSlot::factory()->create(['event_id' => $this->event->id]);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Fleur',
'last_name' => 'Vermeer',
'email' => 'fleur@voorbeeld.nl',
'password' => 'Wachtwoord1',
'availabilities' => [
['time_slot_id' => $this->timeSlot->id, 'preference_level' => 4],
['time_slot_id' => $timeSlot2->id, 'preference_level' => 2],
],
]);
$response->assertStatus(201);
$person = Person::where('email', 'fleur@voorbeeld.nl')->first();
$this->assertDatabaseHas('volunteer_availabilities', [
'person_id' => $person->id,
'time_slot_id' => $this->timeSlot->id,
'preference_level' => 4,
]);
$this->assertDatabaseHas('volunteer_availabilities', [
'person_id' => $person->id,
'time_slot_id' => $timeSlot2->id,
'preference_level' => 2,
]);
}
public function test_registration_stores_custom_fields(): void
{
Mail::fake();
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Daan',
'last_name' => 'Mulder',
'email' => 'daan@voorbeeld.nl',
'password' => 'Wachtwoord1',
'tshirt_size' => 'XL',
'motivation' => 'Ik vind festivals geweldig.',
'section_preferences' => [
['festival_section_id' => $this->section->id, 'priority' => 1],
],
]);
$response->assertStatus(201);
$person = Person::where('email', 'daan@voorbeeld.nl')->first();
$customFields = $person->custom_fields;
$this->assertEquals('XL', $customFields['tshirt_size']);
$this->assertEquals('Ik vind festivals geweldig.', $customFields['motivation']);
$this->assertDatabaseHas('person_section_preferences', [
'person_id' => $person->id,
'festival_section_id' => $this->section->id,
'priority' => 1,
]);
}
public function test_volunteer_can_register_with_date_of_birth(): void
{
Mail::fake();
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Mila',
'last_name' => 'de Boer',
'email' => 'mila@voorbeeld.nl',
'password' => 'Wachtwoord1',
'date_of_birth' => '1998-05-12',
]);
$response->assertStatus(201);
$person = Person::where('email', 'mila@voorbeeld.nl')->first();
$this->assertEquals('1998-05-12', $person->date_of_birth->format('Y-m-d'));
}
public function test_volunteer_can_register_without_date_of_birth(): void
{
Mail::fake();
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Sem',
'last_name' => 'van Beek',
'email' => 'sem@voorbeeld.nl',
'password' => 'Wachtwoord1',
]);
$response->assertStatus(201);
$person = Person::where('email', 'sem@voorbeeld.nl')->first();
$this->assertNull($person->date_of_birth);
}
public function test_date_of_birth_must_be_before_today(): void
{
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Tijn',
'last_name' => 'Kuiper',
'email' => 'tijn@voorbeeld.nl',
'password' => 'Wachtwoord1',
'date_of_birth' => now()->addDay()->format('Y-m-d'),
]);
$response->assertStatus(422);
$response->assertJsonValidationErrors('date_of_birth');
}
public function test_duplicate_email_rejected(): void
{
Mail::fake();
$this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Anna',
'last_name' => 'Smit',
'email' => 'anna@voorbeeld.nl',
'password' => 'Wachtwoord1',
]);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Anna',
'last_name' => 'Smit',
'email' => 'anna@voorbeeld.nl',
'password' => 'Wachtwoord1',
]);
$response->assertStatus(422);
$response->assertJsonValidationErrors('email');
}
public function test_rejected_person_can_reregister(): void
{
Mail::fake();
Person::factory()->rejected()->create([
'event_id' => $this->event->id,
'crowd_type_id' => $this->volunteerCrowdType->id,
'email' => 'herkan@voorbeeld.nl',
]);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Herkan',
'last_name' => 'Poging',
'email' => 'herkan@voorbeeld.nl',
'password' => 'Wachtwoord1',
]);
$response->assertStatus(200);
$this->assertDatabaseHas('persons', [
'email' => 'herkan@voorbeeld.nl',
'status' => PersonStatus::PENDING->value,
]);
}
public function test_event_not_registration_open(): void
{
$draftEvent = Event::factory()->create([
'organisation_id' => $this->organisation->id,
'status' => 'draft',
]);
$response = $this->postJson("/api/v1/events/{$draftEvent->id}/volunteer-register", [
'first_name' => 'Test',
'last_name' => 'Persoon',
'email' => 'test@voorbeeld.nl',
'password' => 'Wachtwoord1',
]);
$response->assertStatus(422);
}
public function test_invalid_time_slot_rejected(): void
{
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Bas',
'last_name' => 'van Dijk',
'email' => 'bas@voorbeeld.nl',
'password' => 'Wachtwoord1',
'availabilities' => [
['time_slot_id' => '01JNONEXISTENT00000000000', 'preference_level' => 3],
],
]);
$response->assertStatus(422);
$response->assertJsonValidationErrors('availabilities.0.time_slot_id');
}
// ─── Authenticated Registration ─────────────────────────────────────
public function test_authenticated_user_registration(): void
{
$user = User::factory()->create([
'first_name' => 'Lisa',
'last_name' => 'de Groot',
'email' => 'lisa@voorbeeld.nl',
]);
$this->organisation->users()->attach($user, ['role' => 'org_member']);
Sanctum::actingAs($user);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", []);
$response->assertStatus(201);
$this->assertDatabaseHas('persons', [
'email' => 'lisa@voorbeeld.nl',
'user_id' => $user->id,
'event_id' => $this->event->id,
]);
}
public function test_authenticated_ignores_request_email(): void
{
$user = User::factory()->create([
'first_name' => 'Mark',
'last_name' => 'Visser',
'email' => 'mark@voorbeeld.nl',
]);
$this->organisation->users()->attach($user, ['role' => 'org_member']);
Sanctum::actingAs($user);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'email' => 'nep@voorbeeld.nl',
]);
$response->assertStatus(201);
$person = Person::where('user_id', $user->id)->first();
$this->assertEquals('mark@voorbeeld.nl', $person->email);
}
public function test_authenticated_duplicate_rejected(): void
{
$user = User::factory()->create([
'first_name' => 'Eva',
'last_name' => 'Hendriks',
'email' => 'eva@voorbeeld.nl',
]);
$this->organisation->users()->attach($user, ['role' => 'org_member']);
Sanctum::actingAs($user);
$this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", []);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", []);
$response->assertStatus(422);
$response->assertJsonValidationErrors('email');
}
// ─── Portal Token Auth ──────────────────────────────────────────────
public function test_missing_token_returns_error(): void
{
$response = $this->postJson('/api/v1/portal/token-auth', []);
$response->assertStatus(422);
$response->assertJsonValidationErrors('token');
}
public function test_invalid_token_returns_401(): void
{
// artists table exists via migration, so an invalid token returns 401
$response = $this->postJson('/api/v1/portal/token-auth', [
'token' => 'some-random-invalid-token',
]);
$response->assertStatus(401);
$response->assertJson(['message' => 'Invalid or expired portal token']);
}
public function test_token_auth_with_empty_token_returns_422(): void
{
$response = $this->postJson('/api/v1/portal/token-auth', [
'token' => '',
]);
$response->assertStatus(422);
}
// ─── Portal Me ──────────────────────────────────────────────────────
public function test_authenticated_user_gets_person(): void
{
$user = User::factory()->create(['first_name' => 'Karin', 'last_name' => 'Bos']);
$this->organisation->users()->attach($user, ['role' => 'org_member']);
Person::factory()->create([
'event_id' => $this->event->id,
'crowd_type_id' => $this->volunteerCrowdType->id,
'user_id' => $user->id,
'email' => $user->email,
]);
Sanctum::actingAs($user);
$response = $this->getJson("/api/v1/portal/me?event_id={$this->event->id}");
$response->assertStatus(200);
$response->assertJsonPath('data.email', $user->email);
}
public function test_authenticated_user_no_person_returns_404(): void
{
$user = User::factory()->create(['first_name' => 'Tom', 'last_name' => 'Kuiper']);
Sanctum::actingAs($user);
$response = $this->getJson("/api/v1/portal/me?event_id={$this->event->id}");
$response->assertStatus(404);
$response->assertJson(['message' => 'No registration found for this event']);
}
public function test_missing_event_id_returns_422(): void
{
$user = User::factory()->create(['first_name' => 'Sanne', 'last_name' => 'Bruin']);
Sanctum::actingAs($user);
$response = $this->getJson('/api/v1/portal/me');
$response->assertStatus(422);
$response->assertJsonValidationErrors('event_id');
}
public function test_unauthenticated_returns_401(): void
{
$response = $this->getJson("/api/v1/portal/me?event_id={$this->event->id}");
$response->assertStatus(401);
}
// ─── Dynamic Field Values ──────────────────────────────────────────
public function test_volunteer_can_register_with_field_values(): void
{
Mail::fake();
$selectField = RegistrationFormField::factory()->selectField()->create([
'event_id' => $this->event->id,
'sort_order' => 0,
]);
$textField = RegistrationFormField::factory()->textareaField()->create([
'event_id' => $this->event->id,
'sort_order' => 1,
]);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Noor',
'last_name' => 'Janssen',
'email' => 'noor@voorbeeld.nl',
'password' => 'Wachtwoord1',
'field_values' => [
$selectField->slug => 'L',
$textField->slug => 'Ik ben een ervaren vrijwilliger',
],
]);
$response->assertStatus(201);
$person = Person::where('email', 'noor@voorbeeld.nl')->first();
$this->assertDatabaseHas('person_field_values', [
'person_id' => $person->id,
'registration_form_field_id' => $selectField->id,
'value' => 'L',
]);
$this->assertDatabaseHas('person_field_values', [
'person_id' => $person->id,
'registration_form_field_id' => $textField->id,
'value' => 'Ik ben een ervaren vrijwilliger',
]);
}
public function test_volunteer_can_register_with_section_preferences(): void
{
Mail::fake();
$section1 = FestivalSection::factory()->create([
'event_id' => $this->event->id,
'name' => 'Hoofdpodium Bar',
]);
$section2 = FestivalSection::factory()->create([
'event_id' => $this->event->id,
'name' => 'EHBO Post',
]);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Rick',
'last_name' => 'Peters',
'email' => 'rick@voorbeeld.nl',
'password' => 'Wachtwoord1',
'section_preferences' => [
['festival_section_id' => $section1->id, 'priority' => 1],
['festival_section_id' => $section2->id, 'priority' => 2],
],
]);
$response->assertStatus(201);
$person = Person::where('email', 'rick@voorbeeld.nl')->first();
$this->assertDatabaseHas('person_section_preferences', [
'person_id' => $person->id,
'festival_section_id' => $section1->id,
'priority' => 1,
]);
$this->assertDatabaseHas('person_section_preferences', [
'person_id' => $person->id,
'festival_section_id' => $section2->id,
'priority' => 2,
]);
}
public function test_volunteer_can_register_with_multiselect_field_values(): void
{
Mail::fake();
$multiselectField = RegistrationFormField::factory()->multiselectField()->create([
'event_id' => $this->event->id,
]);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Femke',
'last_name' => 'de Jong',
'email' => 'femke@voorbeeld.nl',
'password' => 'Wachtwoord1',
'field_values' => [
$multiselectField->slug => ['Vegetarisch', 'Glutenvrij'],
],
]);
$response->assertStatus(201);
$person = Person::where('email', 'femke@voorbeeld.nl')->first();
$this->assertDatabaseHas('person_field_values', [
'person_id' => $person->id,
'registration_form_field_id' => $multiselectField->id,
]);
$value = $person->fieldValues()
->where('registration_form_field_id', $multiselectField->id)
->first();
$this->assertEquals(['Vegetarisch', 'Glutenvrij'], $value->selected_options);
}
// ─── User Account Creation ──────────────────────────────────────────
public function test_new_volunteer_registration_creates_user_account(): void
{
Mail::fake();
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Nieuwe',
'last_name' => 'Vrijwilliger',
'email' => 'nieuw@voorbeeld.nl',
'password' => 'Wachtwoord1',
]);
$response->assertStatus(201);
$this->assertDatabaseHas('users', [
'email' => 'nieuw@voorbeeld.nl',
'first_name' => 'Nieuwe',
'last_name' => 'Vrijwilliger',
]);
$user = User::where('email', 'nieuw@voorbeeld.nl')->first();
$this->assertDatabaseHas('persons', [
'email' => 'nieuw@voorbeeld.nl',
'user_id' => $user->id,
'event_id' => $this->event->id,
]);
}
public function test_returning_volunteer_with_correct_password_creates_person(): void
{
Mail::fake();
$existingUser = User::factory()->create([
'first_name' => 'Terug',
'last_name' => 'Keerder',
'email' => 'terug@voorbeeld.nl',
'password' => Hash::make('BestaandWw1'),
]);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Terug',
'last_name' => 'Keerder',
'email' => 'terug@voorbeeld.nl',
'password' => 'BestaandWw1',
]);
$response->assertStatus(201);
$this->assertDatabaseHas('persons', [
'email' => 'terug@voorbeeld.nl',
'user_id' => $existingUser->id,
'event_id' => $this->event->id,
]);
// Should not have created a new user
$this->assertEquals(1, User::where('email', 'terug@voorbeeld.nl')->count());
}
public function test_returning_volunteer_with_wrong_password_returns_422(): void
{
User::factory()->create([
'email' => 'bestaand@voorbeeld.nl',
'password' => Hash::make('echtgeheim'),
]);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Fout',
'last_name' => 'Wachtwoord',
'email' => 'bestaand@voorbeeld.nl',
'password' => 'foutwachtwoord',
]);
$response->assertStatus(422);
$response->assertJsonValidationErrors('password');
}
public function test_registration_sends_confirmation_email(): void
{
Mail::fake();
$this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Mail',
'last_name' => 'Test',
'email' => 'mailtest@voorbeeld.nl',
'password' => 'Wachtwoord1',
]);
Mail::assertQueued(RegistrationConfirmationMail::class, function ($mail) {
return $mail->hasTo('mailtest@voorbeeld.nl');
});
}
public function test_email_is_always_stored_lowercase(): void
{
Mail::fake();
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Hoofdletter',
'last_name' => 'Email',
'email' => 'HOOFDLETTER@VOORBEELD.NL',
'password' => 'Wachtwoord1',
]);
$response->assertStatus(201);
$this->assertDatabaseHas('persons', [
'email' => 'hoofdletter@voorbeeld.nl',
]);
$this->assertDatabaseHas('users', [
'email' => 'hoofdletter@voorbeeld.nl',
]);
}
public function test_password_required_for_unauthenticated_registration(): void
{
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", [
'first_name' => 'Zonder',
'last_name' => 'Wachtwoord',
'email' => 'geenww@voorbeeld.nl',
]);
$response->assertStatus(422);
$response->assertJsonValidationErrors('password');
}
public function test_password_not_required_for_authenticated_registration(): void
{
Mail::fake();
$user = User::factory()->create([
'first_name' => 'Auth',
'last_name' => 'User',
'email' => 'authuser@voorbeeld.nl',
]);
$this->organisation->users()->attach($user, ['role' => 'org_member']);
Sanctum::actingAs($user);
$response = $this->postJson("/api/v1/events/{$this->event->id}/volunteer-register", []);
$response->assertStatus(201);
}
// ─── Registration Data Endpoint ─────────────────────────────────────
public function test_registration_data_includes_registration_fields(): void
{
$field = RegistrationFormField::factory()->selectField()->create([
'event_id' => $this->event->id,
'is_portal_visible' => true,
'is_admin_only' => false,
]);
$response = $this->getJson("/api/v1/public/events/{$this->event->slug}/registration-data");
$response->assertOk();
$response->assertJsonPath('data.registration_fields.0.slug', $field->slug);
}
public function test_registration_data_excludes_admin_only_fields(): void
{
RegistrationFormField::factory()->selectField()->create([
'event_id' => $this->event->id,
'is_portal_visible' => true,
'is_admin_only' => true,
]);
$response = $this->getJson("/api/v1/public/events/{$this->event->slug}/registration-data");
$response->assertOk();
$response->assertJsonCount(0, 'data.registration_fields');
}
public function test_registration_data_includes_form_toggles(): void
{
$response = $this->getJson("/api/v1/public/events/{$this->event->slug}/registration-data");
$response->assertOk();
$response->assertJsonStructure([
'data' => [
'event' => [
'registration_show_section_preferences',
'registration_show_availability',
],
],
]);
}
public function test_portal_me_includes_field_values_and_section_preferences(): void
{
$user = User::factory()->create(['first_name' => 'Lotte', 'last_name' => 'Vos']);
$this->organisation->users()->attach($user, ['role' => 'org_member']);
$person = Person::factory()->create([
'event_id' => $this->event->id,
'crowd_type_id' => $this->volunteerCrowdType->id,
'user_id' => $user->id,
'email' => $user->email,
]);
$field = RegistrationFormField::factory()->selectField()->create([
'event_id' => $this->event->id,
]);
\App\Models\PersonFieldValue::create([
'person_id' => $person->id,
'registration_form_field_id' => $field->id,
'value' => 'M',
]);
\App\Models\PersonSectionPreference::create([
'person_id' => $person->id,
'festival_section_id' => $this->section->id,
'priority' => 1,
]);
Sanctum::actingAs($user);
$response = $this->getJson("/api/v1/portal/me?event_id={$this->event->id}");
$response->assertStatus(200)
->assertJsonCount(1, 'data.field_values')
->assertJsonPath('data.field_values.0.field_slug', $field->slug)
->assertJsonPath('data.field_values.0.value', 'M')
->assertJsonCount(1, 'data.section_preferences')
->assertJsonPath('data.section_preferences.0.festival_section_id', $this->section->id)
->assertJsonPath('data.section_preferences.0.priority', 1);
}
}