<?php

use App\Models\Invoice;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(Tests\TestCase::class, RefreshDatabase::class);

it('prevents another user from marking an invoice paid', function () {
    $owner = User::factory()->create();
    $otherUser = User::factory()->create();
    $invoice = Invoice::factory()->for($owner, 'user')->create([
        'status' => 'draft',
    ]);

    $this->actingAs($otherUser)
        ->patchJson('/api/invoices/'.$invoice->getKey(), ['status' => 'paid'])
        ->assertForbidden();

    expect($invoice->refresh()->status)->toBe('draft');
});