claudecode-omc 5.9.1 → 5.12.0

package/bundled/upstream/ecc/skills/laravel-tdd/SKILL.md

@@ -1,283 +1,675 @@
 ---
 name: laravel-tdd
-description: Test-driven development for Laravel with PHPUnit and Pest, factories, database testing, fakes, and coverage targets.
-origin: ECC
+description: Laravel testing strategies with PHPUnit, Pest, model factories, HTTP tests, Sanctum authentication testing, mocking, and coverage.
+metadata:
+  origin: ECC
 ---
 
-# Laravel TDD Workflow
+# Laravel Testing with TDD
 
-Test-driven development for Laravel applications using PHPUnit and Pest with 80%+ coverage (unit + feature).
+Test-driven development for Laravel applications using PHPUnit, Pest, Laravel factories, and testing helpers.
 
-## When to Use
+## When to Activate
 
-- New features or endpoints in Laravel
-- Bug fixes or refactors
-- Testing Eloquent models, policies, jobs, and notifications
-- Prefer Pest for new tests unless the project already standardizes on PHPUnit
+- Writing new Laravel applications or features
+- Implementing API endpoints with Sanctum or Passport authentication
+- Testing Eloquent models, relationships, scopes, and accessors
+- Setting up testing infrastructure for Laravel projects
+- Writing feature tests for HTTP controllers and form requests
+- Mocking external services (queues, mail, notifications, HTTP)
 
-## How It Works
+## TDD Workflow for Laravel
 
 ### Red-Green-Refactor Cycle
 
-1) Write a failing test
-2) Implement the minimal change to pass
-3) Refactor while keeping tests green
+```php
+// Step 1: RED — Write a failing test
+public function test_a_product_can_be_created(): void
+{
+    $product = Product::factory()->create(['name' => 'Test Product']);
+    $this->assertDatabaseHas('products', ['name' => 'Test Product']);
+}
 
-### Test Layers
+// Step 2: GREEN — Write the migration, model, and factory
+// Step 3: REFACTOR — Improve while keeping tests green
+```
 
-- **Unit**: pure PHP classes, value objects, services
-- **Feature**: HTTP endpoints, auth, validation, policies
-- **Integration**: database + queue + external boundaries
+## Setup
+
+### PHPUnit Configuration
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
+         bootstrap="vendor/autoload.php"
+         colors="true">
+    <testsuites>
+        <testsuite name="Unit">
+            <directory suffix="Test.php">tests/Unit</directory>
+        </testsuite>
+        <testsuite name="Feature">
+            <directory suffix="Test.php">tests/Feature</directory>
+        </testsuite>
+    </testsuites>
+    <php>
+        <env name="APP_ENV" value="testing"/>
+        <env name="BCRYPT_ROUNDS" value="4"/>
+        <env name="CACHE_STORE" value="array"/>
+        <env name="DB_CONNECTION" value="sqlite"/>
+        <env name="DB_DATABASE" value=":memory:"/>
+        <env name="MAIL_MAILER" value="array"/>
+        <env name="QUEUE_CONNECTION" value="sync"/>
+        <env name="SESSION_DRIVER" value="array"/>
+    </php>
+</phpunit>
+```
+
+### Base TestCase Setup
 
-Choose layers based on scope:
+```php
+namespace Tests;
 
-- Use **Unit** tests for pure business logic and services.
-- Use **Feature** tests for HTTP, auth, validation, and response shape.
-- Use **Integration** tests when validating DB/queues/external services together.
+use Illuminate\Foundation\Testing\TestCase as BaseTestCase;
 
-### Database Strategy
+abstract class TestCase extends BaseTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        // Call $this->withoutExceptionHandling() only in tests that
+        // test non-HTTP exceptions; it suppresses assertStatus() etc.
+    }
+
+    // Helper: Authenticate and return user
+    protected function actingAsUser(): mixed
+    {
+        $user = \App\Models\User::factory()->create();
+        $this->actingAs($user);
+        return $user;
+    }
 
-- `RefreshDatabase` for most feature/integration tests (runs migrations once per test run, then wraps each test in a transaction when supported; in-memory databases may re-migrate per test)
-- `DatabaseTransactions` when the schema is already migrated and you only need per-test rollback
-- `DatabaseMigrations` when you need a full migrate/fresh for every test and can afford the cost
+    protected function actingAsAdmin(): mixed
+    {
+        $admin = \App\Models\User::factory()->admin()->create();
+        $this->actingAs($admin);
+        return $admin;
+    }
+}
+```
 
-Use `RefreshDatabase` as the default for tests that touch the database: for databases with transaction support, it runs migrations once per test run (via a static flag) and wraps each test in a transaction; for `:memory:` SQLite or connections without transactions, it migrates before each test. Use `DatabaseTransactions` when the schema is already migrated and you only need per-test rollbacks.
+## Model Factories
 
-### Testing Framework Choice
+```php
+// database/factories/UserFactory.php
+class UserFactory extends Factory
+{
+    protected static ?string $password = null;
 
-- Default to **Pest** for new tests when available.
-- Use **PHPUnit** only if the project already standardizes on it or requires PHPUnit-specific tooling.
+    public function definition(): array
+    {
+        return [
+            'name' => fake()->name(),
+            'email' => fake()->unique()->safeEmail(),
+            'email_verified_at' => now(),
+            'password' => static::$password ??= Hash::make('password'),
+            'remember_token' => Str::random(10),
+            'role' => 'user',
+        ];
+    }
 
-## Examples
+    public function admin(): static
+    {
+        return $this->state(fn (array $attributes) => ['role' => 'admin']);
+    }
 
-### PHPUnit Example
+    public function unverified(): static
+    {
+        return $this->state(fn (array $attributes) => ['email_verified_at' => null]);
+    }
+}
+
+// database/factories/ProductFactory.php
+class ProductFactory extends Factory
+{
+    public function definition(): array
+    {
+        return [
+            'name' => fake()->unique()->words(3, true),
+            'slug' => fn (array $attrs) => Str::slug($attrs['name']),
+            'description' => fake()->paragraph(),
+            'price' => fake()->numberBetween(100, 100000),
+            'stock' => fake()->numberBetween(0, 100),
+            'is_active' => true,
+            'user_id' => UserFactory::new(),
+        ];
+    }
+
+    public function outOfStock(): static
+    {
+        return $this->state(fn (array $attributes) => ['stock' => 0]);
+    }
+}
+```
+
+### Using Factories
 
 ```php
+$user = User::factory()->create();
+$admin = User::factory()->admin()->create();
+$product = Product::factory()->create(['user_id' => $user->id]);
+$products = Product::factory()->count(10)->create();
+$draft = Product::factory()->make(); // Not persisted
+
+// With relationships
+$user = User::factory()->has(Product::factory()->count(3))->create();
+
+// Sequences
+User::factory()->count(3)->sequence(
+    ['role' => 'admin'], ['role' => 'editor'], ['role' => 'user'],
+)->create();
+```
+
+## Model Testing
+
+```php
+namespace Tests\Unit\Models;
+
 use App\Models\User;
+use App\Models\Product;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Tests\TestCase;
 
-final class ProjectControllerTest extends TestCase
+class UserTest extends TestCase
 {
     use RefreshDatabase;
 
-    public function test_owner_can_create_project(): void
+    public function test_it_hides_sensitive_attributes(): void
     {
         $user = User::factory()->create();
+        $this->assertArrayNotHasKey('password', $user->toArray());
+    }
 
-        $response = $this->actingAs($user)->postJson('/api/projects', [
-            'name' => 'New Project',
-        ]);
+    public function test_admin_scope_returns_only_admins(): void
+    {
+        User::factory()->admin()->create();
+        User::factory()->count(3)->create();
 
-        $response->assertCreated();
-        $this->assertDatabaseHas('projects', ['name' => 'New Project']);
+        $this->assertCount(1, User::admin()->get());
+    }
+}
+
+class ProductTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_active_scope_filters_correctly(): void
+    {
+        Product::factory()->count(3)->create(['is_active' => true]);
+        Product::factory()->count(2)->create(['is_active' => false]);
+
+        $this->assertCount(3, Product::active()->get());
+    }
+
+    public function test_it_belongs_to_a_user(): void
+    {
+        $user = User::factory()->create();
+        $product = Product::factory()->create(['user_id' => $user->id]);
+
+        $this->assertTrue($product->user->is($user));
     }
 }
 ```
 
-### Feature Test Example (HTTP Layer)
+## Feature / HTTP Testing
 
 ```php
-use App\Models\Project;
+namespace Tests\Feature\Http\Controllers;
+
+use App\Models\Product;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Tests\TestCase;
 
-final class ProjectIndexTest extends TestCase
+class ProductControllerTest extends TestCase
 {
     use RefreshDatabase;
 
-    public function test_projects_index_returns_paginated_results(): void
+    public function test_guests_are_redirected_to_login(): void
+    {
+        $this->get(route('products.create'))->assertRedirect(route('login'));
+    }
+
+    public function test_it_stores_a_new_product(): void
     {
         $user = User::factory()->create();
-        Project::factory()->count(3)->for($user)->create();
+        $this->actingAs($user);
 
-        $response = $this->actingAs($user)->getJson('/api/projects');
+        $response = $this->post(route('products.store'), [
+            'name' => 'New Product',
+            'description' => 'Description',
+            'price' => 2999,
+            'stock' => 10,
+        ]);
 
-        $response->assertOk();
-        $response->assertJsonStructure(['success', 'data', 'error', 'meta']);
+        $response->assertRedirect(route('products.index'));
+        $this->assertDatabaseHas('products', [
+            'name' => 'New Product',
+            'user_id' => $user->id,
+        ]);
+    }
+
+    public function test_it_validates_required_fields(): void
+    {
+        $this->actingAs(User::factory()->create());
+        $this->post(route('products.store'), [])
+            ->assertSessionHasErrors(['name', 'price']);
+    }
+
+    public function test_users_cannot_modify_others_products(): void
+    {
+        $owner = User::factory()->create();
+        $attacker = User::factory()->create();
+        $product = Product::factory()->create(['user_id' => $owner->id]);
+
+        $this->actingAs($attacker)
+            ->delete(route('products.destroy', $product))
+            ->assertForbidden();
     }
 }
 ```
 
-### Pest Example
+## JSON API Testing
 
 ```php
+namespace Tests\Feature\Http\Controllers\Api;
+
+use App\Models\Product;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
 
-use function Pest\Laravel\actingAs;
-use function Pest\Laravel\assertDatabaseHas;
+class ProductApiTest extends TestCase
+{
+    use RefreshDatabase;
 
-uses(RefreshDatabase::class);
+    public function test_unauthenticated_requests_are_rejected(): void
+    {
+        $this->getJson('/api/products')->assertUnauthorized();
+    }
 
-test('owner can create project', function () {
-    $user = User::factory()->create();
+    public function test_it_lists_paginated_products(): void
+    {
+        $user = User::factory()->create();
+        Product::factory()->count(5)->create(['user_id' => $user->id]);
 
-    $response = actingAs($user)->postJson('/api/projects', [
-        'name' => 'New Project',
-    ]);
+        $response = $this->actingAs($user)->getJson('/api/products');
 
-    $response->assertCreated();
-    assertDatabaseHas('projects', ['name' => 'New Project']);
-});
+        $response->assertOk();
+        $response->assertJsonCount(5, 'data');
+        $response->assertJsonStructure([
+            'data' => [['id', 'name', 'price']],
+            'meta' => ['current_page', 'last_page', 'total'],
+        ]);
+    }
+
+    public function test_it_creates_a_product(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->postJson('/api/products', [
+            'name' => 'API Product',
+            'price' => 4999,
+        ]);
+
+        $response->assertCreated();
+        $response->assertJsonPath('data.name', 'API Product');
+    }
+
+    public function test_users_cannot_delete_others_products(): void
+    {
+        $owner = User::factory()->create();
+        $attacker = User::factory()->create();
+        $product = Product::factory()->create(['user_id' => $owner->id]);
+
+        $this->actingAs($attacker)
+            ->deleteJson("/api/products/{$product->id}")
+            ->assertForbidden();
+    }
+}
 ```
 
-### Feature Test Pest Example (HTTP Layer)
+## Sanctum API Auth Testing
 
 ```php
-use App\Models\Project;
+namespace Tests\Feature\Http\Controllers\Api;
+
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+use Tests\TestCase;
 
-use function Pest\Laravel\actingAs;
+class AuthControllerTest extends TestCase
+{
+    use RefreshDatabase;
 
-uses(RefreshDatabase::class);
+    public function test_users_can_register(): void
+    {
+        $response = $this->postJson('/api/register', [
+            'name' => 'Test User',
+            'email' => 'test@example.com',
+            'password' => 'Password123!',
+            'password_confirmation' => 'Password123!',
+        ]);
 
-test('projects index returns paginated results', function () {
-    $user = User::factory()->create();
-    Project::factory()->count(3)->for($user)->create();
+        $response->assertCreated();
+        $response->assertJsonStructure(['data' => ['user', 'token']]);
+    }
 
-    $response = actingAs($user)->getJson('/api/projects');
+    public function test_users_can_login(): void
+    {
+        User::factory()->create([
+            'email' => 'test@example.com',
+            'password' => Hash::make('Password123!'),
+        ]);
 
-    $response->assertOk();
-    $response->assertJsonStructure(['success', 'data', 'error', 'meta']);
-});
-```
+        $response = $this->postJson('/api/login', [
+            'email' => 'test@example.com',
+            'password' => 'Password123!',
+        ]);
+
+        $response->assertOk();
+        $response->assertJsonStructure(['data' => ['token']]);
+    }
 
-### Factories and States
+    public function test_users_cannot_login_with_wrong_password(): void
+    {
+        User::factory()->create(['email' => 'test@example.com']);
 
-- Use factories for test data
-- Define states for edge cases (archived, admin, trial)
+        $this->postJson('/api/login', [
+            'email' => 'test@example.com',
+            'password' => 'wrong',
+        ])->assertUnprocessable();
+    }
 
-```php
-$user = User::factory()->state(['role' => 'admin'])->create();
-```
+    public function test_token_bearer_authenticates_requests(): void
+    {
+        $user = User::factory()->create();
+        $token = $user->createToken('test')->plainTextToken;
 
-### Database Testing
+        $this->withToken($token)
+            ->getJson('/api/user')
+            ->assertOk()
+            ->assertJsonPath('data.email', $user->email);
+    }
+}
+```
 
-- Use `RefreshDatabase` for clean state
-- Keep tests isolated and deterministic
-- Prefer `assertDatabaseHas` over manual queries
+## Mocking and Fakes
 
-### Persistence Test Example
+### HTTP Fake
 
 ```php
-use App\Models\Project;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Tests\TestCase;
+use Illuminate\Support\Facades\Http;
 
-final class ProjectRepositoryTest extends TestCase
+public function test_it_handles_successful_payment(): void
 {
-    use RefreshDatabase;
+    Http::fake([
+        'api.stripe.com/*' => Http::response(['id' => 'pi_123', 'status' => 'succeeded'], 200),
+    ]);
 
-    public function test_project_can_be_retrieved_by_slug(): void
-    {
-        $project = Project::factory()->create(['slug' => 'alpha']);
+    $result = (new PaymentService())->charge(2999);
+    $this->assertTrue($result->success);
+}
 
-        $found = Project::query()->where('slug', 'alpha')->firstOrFail();
+public function test_it_handles_gateway_failure(): void
+{
+    Http::fake([
+        'api.stripe.com/*' => Http::response(['error' => 'card_declined'], 402),
+    ]);
 
-        $this->assertSame($project->id, $found->id);
-    }
+    $this->expectException(PaymentFailedException::class);
+    (new PaymentService())->charge(2999);
+}
+
+public function test_it_retries_on_timeout(): void
+{
+    Http::fake([
+        'api.stripe.com/*' => Http::sequence()
+            ->pushStatus(408)
+            ->pushStatus(200),
+    ]);
+
+    $this->assertTrue((new PaymentService())->charge(2999)->success);
 }
 ```
 
-### Fakes for Side Effects
+### Mail Fake
 
-- `Bus::fake()` for jobs
-- `Queue::fake()` for queued work
-- `Mail::fake()` and `Notification::fake()` for notifications
-- `Event::fake()` for domain events
+```php
+Mail::fake();
+
+$order->sendConfirmation();
+
+Mail::assertSent(OrderConfirmation::class, function ($mail) use ($order) {
+    return $mail->hasTo($order->user->email);
+});
+```
+
+### Notification Fake
 
 ```php
-use Illuminate\Support\Facades\Queue;
+Notification::fake();
 
+$user->notify(new WelcomeUser());
+
+Notification::assertSentTo($user, WelcomeUser::class);
+```
+
+### Queue Fake
+
+```php
 Queue::fake();
 
-dispatch(new SendOrderConfirmation($order->id));
+ProcessImage::dispatch($product);
 
-Queue::assertPushed(SendOrderConfirmation::class);
+Queue::assertPushed(ProcessImage::class, function ($job) use ($product) {
+    return $job->product->id === $product->id;
+});
 ```
 
+### Storage Fake
+
 ```php
-use Illuminate\Support\Facades\Notification;
+Storage::fake('public');
 
-Notification::fake();
+$file = UploadedFile::fake()->image('photo.jpg', 200, 200);
 
-$user->notify(new InvoiceReady($invoice));
+$response = $this->actingAs($user)->post('/avatar', [
+    'avatar' => $file,
+]);
 
-Notification::assertSentTo($user, InvoiceReady::class);
+$response->assertSessionHasNoErrors();
+Storage::disk('public')->assertExists('avatars/' . $file->hashName());
 ```
 
-### Auth Testing (Sanctum)
+### Event Fake
 
 ```php
-use Laravel\Sanctum\Sanctum;
+Event::fake();
 
-Sanctum::actingAs($user);
+$order->markAsShipped();
 
-$response = $this->getJson('/api/projects');
-$response->assertOk();
+Event::assertDispatched(OrderShipped::class, function ($event) use ($order) {
+    return $event->order->id === $order->id;
+});
 ```
 
-### HTTP and External Services
+## Artisan Command Tests
 
-- Use `Http::fake()` to isolate external APIs
-- Assert outbound payloads with `Http::assertSent()`
+```php
+public function test_it_sends_newsletters(): void
+{
+    Mail::fake();
+    User::factory()->count(5)->create(['subscribed' => true]);
 
-### Coverage Targets
+    $this->artisan('newsletter:send')
+        ->expectsOutput('Sending newsletter to 5 subscribers...')
+        ->assertExitCode(0);
 
-- Enforce 80%+ coverage for unit + feature tests
-- Use `pcov` or `XDEBUG_MODE=coverage` in CI
+    Mail::assertSent(NewsletterMail::class, 5);
+}
 
-### Test Commands
+public function test_it_handles_no_subscribers(): void
+{
+    $this->artisan('newsletter:send')
+        ->expectsOutput('No subscribers found.')
+        ->assertExitCode(0);
+}
+```
 
-- `php artisan test`
-- `vendor/bin/phpunit`
-- `vendor/bin/pest`
+## Authorization Tests
 
-### Test Configuration
+```php
+public function test_users_can_update_own_posts(): void
+{
+    $user = User::factory()->create();
+    $post = Post::factory()->create(['user_id' => $user->id]);
 
-- Use `phpunit.xml` to set `DB_CONNECTION=sqlite` and `DB_DATABASE=:memory:` for fast tests
-- Keep separate env for tests to avoid touching dev/prod data
+    $this->actingAs($user)
+        ->put(route('posts.update', $post), ['title' => 'Updated'])
+        ->assertRedirect();
+}
 
-### Authorization Tests
+public function test_users_cannot_update_others_posts(): void
+{
+    $post = Post::factory()->create();
+    $this->actingAs(User::factory()->create())
+        ->put(route('posts.update', $post), ['title' => 'Hacked'])
+        ->assertForbidden();
+}
 
-```php
-use Illuminate\Support\Facades\Gate;
+public function test_gate_before_grants_super_admin_full_access(): void
+{
+    $super = User::factory()->create(['role' => 'super-admin']);
+    $post = Post::factory()->create();
 
-$this->assertTrue(Gate::forUser($user)->allows('update', $project));
-$this->assertFalse(Gate::forUser($otherUser)->allows('update', $project));
-```
+    $this->actingAs($super)
+        ->delete(route('posts.destroy', $post))
+        ->assertRedirect();
 
-### Inertia Feature Tests
+    $this->assertSoftDeleted($post);
+}
+```
 
-When using Inertia.js, assert on the component name and props with the Inertia testing helpers.
+## Pest Feature Tests
 
 ```php
+<?php
+
+use App\Models\Product;
 use App\Models\User;
-use Inertia\Testing\AssertableInertia;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Tests\TestCase;
 
-final class DashboardInertiaTest extends TestCase
-{
-    use RefreshDatabase;
+uses(\Illuminate\Foundation\Testing\RefreshDatabase::class);
 
-    public function test_dashboard_inertia_props(): void
-    {
-        $user = User::factory()->create();
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->actingAs($this->user);
+});
 
-        $response = $this->actingAs($user)->get('/dashboard');
+it('lists products', function () {
+    Product::factory()->count(3)->create(['user_id' => $this->user->id]);
 
-        $response->assertOk();
-        $response->assertInertia(fn (AssertableInertia $page) => $page
-            ->component('Dashboard')
-            ->where('user.id', $user->id)
-            ->has('projects')
-        );
-    }
-}
+    $this->get(route('products.index'))
+        ->assertOk()
+        ->assertViewHas('products');
+});
+
+it('creates a product with valid data', function () {
+    $this->post(route('products.store'), [
+        'name' => 'Test Product', 'price' => 1999,
+    ])->assertRedirect();
+
+    $this->assertDatabaseHas('products', ['name' => 'Test Product']);
+});
+
+it('fails validation without required fields', function () {
+    $this->post(route('products.store'), [])
+        ->assertSessionHasErrors(['name', 'price']);
+});
+
+it('authorizes updates', function () {
+    $other = User::factory()->create();
+    $product = Product::factory()->create(['user_id' => $other->id]);
+
+    $this->put(route('products.update', $product), ['name' => 'Hacked'])
+        ->assertForbidden();
+});
+```
+
+## Coverage
+
+```bash
+# PHPUnit (use clover output for CI threshold checks)
+vendor/bin/phpunit --coverage-html coverage --coverage-clover clover.xml
+
+# Pest (built-in threshold support)
+vendor/bin/pest --coverage --min=80
 ```
 
-Prefer `assertInertia` over raw JSON assertions to keep tests aligned with Inertia responses.
+### Coverage Goals
+
+| Component | Target |
+|-----------|--------|
+| Models | 95%+ |
+| Actions/Services | 90%+ |
+| Form Requests | 90%+ |
+| Controllers | 85%+ |
+| Policies | 95%+ |
+| Overall | 80%+ |
+
+## Testing Best Practices
+
+### DO
+
+- Use factories over manual `create()` calls
+- One logical assertion per test
+- Descriptive names: `test_guests_cannot_create_products`
+- Test edge cases and authorization boundaries
+- Mock external services with `Http::fake()`, `Mail::fake()`
+- Use `RefreshDatabase` for clean state
+
+### DON'T
+
+- Don't test Laravel internals (trust the framework)
+- Don't make tests dependent on each other
+- Don't over-mock — mock only service boundaries
+- Don't test private methods — test through the public interface
+- Don't couple tests to HTML structure
+
+## Quick Reference
+
+| Pattern | Usage |
+|---------|-------|
+| `RefreshDatabase` | Reset database between tests |
+| `$this->actingAs($user)` | Authenticate as user |
+| `$this->withToken($token)` | Bearer token auth for APIs |
+| `Model::factory()->create()` | Create model with factory |
+| `Model::factory()->count(5)->create()` | Create multiple records |
+| `Http::fake([...])` | Mock HTTP calls |
+| `Mail::fake()` | Trap sent mail |
+| `Notification::fake()` | Trap sent notifications |
+| `Queue::fake()` | Trap queued jobs |
+| `Event::fake()` | Trap dispatched events |
+| `Storage::fake('public')` | Trap file operations |
+| `assertDatabaseHas` | Assert DB row exists |
+| `assertSoftDeleted` | Assert soft-delete |
+| `assertSessionHasErrors` | Assert validation errors |
+| `assertForbidden` | Assert 403 status |
+
+## Related Skills
+
+- `laravel-patterns` — Laravel architecture, Eloquent, routing, and API patterns
+- `laravel-security` — Laravel authentication, authorization, and secure coding
+- `tdd-workflow` — The repo-wide RED -> GREEN -> REFACTOR loop
+- `backend-patterns` — General backend API and database patterns