title: How to test an authorization redirect with Laravel?
body: <p>I have manually tested the scenario I want:</p>
  
  <p>Admin Users can go to the <code>/codes</code> section of the site.
  Normal users are redirected (302) back to the <code>/dashboard</code> and have a message <code>Sorry you are not allowed there</code> when they go to <code>/qr</code>.</p>
  
  <p>Manual testing passes, yet laravel testing fails.</p>
  
  <p>I am using <code>laravel 5.1</code></p>
  
  <p><strong>Test for the admin user:</strong></p>
  
  <pre><code>public function testAdminViewCodes()
      {
          //create an admin user
          $user = factory(App\User::class, 'admin')-&gt;create();
  
          $this-&gt;actingAs($user)
              -&gt;visit('/codes')
              -&gt;seePageIs('/codes')
              -&gt;see('Codes');
      }
  </code></pre>
  
  <p><strong>Test for normal user:</strong></p>
  
  <pre><code>    public function testNormalViewCodesFail()
      {
          //create a normal user
          $normal_user = factory(App\User::class)-&gt;create();
  
          //TODO: Fix this failing test FFS
  
          $this-&gt;actingAs($normal_user)
               -&gt;visit('/qr')
               -&gt;seePageIs('/dashboard')
               -&gt;see('Sorry you are not allowed there');
  }
  </code></pre>
  
  <p><strong>test results</strong>;</p>
  
  <pre><code>There was 1 failure:
  
  1) AdminTest::testNormalViewQRCodesFail
  Did not land on expected page [http://localhost/dashboard].
  
  Failed asserting that two strings are equal.
  --- Expected
  +++ Actual
  @@ @@
  -'http://localhost/dashboard'
  +'http://localhost/codes'
  </code></pre>
  
  <p>I think there may be an issue with the factories, seems to be always creating an admin user:</p>
  
  <pre><code>$factory-&gt;define(App\User::class, function (Faker\Generator $faker) {
      return [
          'email' =&gt; $faker-&gt;email,
          'password' =&gt; bcrypt(str_random(10)),
          'remember_token' =&gt; str_random(10),
          'is_admin' =&gt; false,
      ];
  });
  
  $factory-&gt;defineAs(App\User::class, 'admin', function ($faker) use ($factory) {
      $user = $factory-&gt;raw(App\User::class);
  
      return array_merge($user, ['is_admin' =&gt; true]);
  });
  </code></pre>
  
  <p>My apologies for how long this question is, but there is another pertanent issue. I am using <code>middleware</code> to test whether the user is admin:</p>
  
  <pre><code>&lt;?php
  
  namespace RMS\Http\Middleware;
  
  use Closure;
  
  class IsAdminMiddleware
  {
      /**
       * Handle an incoming request.
       *
       * @param  \Illuminate\Http\Request  $request
       * @param  \Closure  $next
       * @return mixed
       */
      public function handle($request, Closure $next)
      {
          if (app()-&gt;env === 'testing') {
              return $next($request);
          }
  
          if (! $request-&gt;user()-&gt;isAdmin()) {
            return redirect()-&gt;route('dashboard')
                -&gt;with('message', 'Sorry you are not allowed there');
          }
  
          return $next($request);
      }
  }
  </code></pre>
  
  <p>In <code>Kernel.php</code>:</p>
  
  <pre><code>protected $routeMiddleware = [
          'auth' =&gt; \RMS\Http\Middleware\Authenticate::class,
          'auth.basic' =&gt; \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
          'guest' =&gt; \RMS\Http\Middleware\RedirectIfAuthenticated::class,
          'isadmin' =&gt; \RMS\Http\Middleware\IsAdminMiddleware::class,
      ];
  </code></pre>
  
  <p>And applied to routes:</p>
  
  <pre><code>Route::group(['middleware' =&gt; ['auth', 'isadmin']], function()
  {
      Route::resource('user', 'UserController');
  });
  </code></pre>
  
  <p>Is Middleware ignored? I was sure not to add the <code>use WithoutMiddleware;</code> statement.</p>