From e1a965cf739464bea390fb40b0a67d96a1aff5e4 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 17:07:13 +0000
Subject: [PATCH 1/8] fix: remove critical dd() debug statement and fix
 low-hanging fruit issues
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove dd('test 900001') from User::canAccessTenant() — this crashed
  the app for all non-superadmin users accessing any tenant
- Remove duplicate expenses() method in Invoice model (PHP fatal on load)
- Replace $fillable with $guarded = [] in InvoiceTransaction and
  RecurringInvoiceItem to comply with project model conventions
- Remove empty taxRate(): void stub from Quote model — no backing
  quote_tax_rates migration exists; method had no implementation

Tests added (PHPUnit AAA, #[Test], AbstractCompanyPanelTestCase):
- UserCanAccessTenantTest: superadmin bypass, own company, other company
- InvoiceModelTest: relationships, guarded protection assertions
- QuoteModelTest: relationships, void method removal, guarded protection

Co-authored-by: Niels Drost <nielsdrost7@users.noreply.github.com>
---
 Modules/Core/Models/User.php                  |  1 -
 .../Tests/Unit/UserCanAccessTenantTest.php    | 58 ++++++++++++
 Modules/Invoices/Models/Invoice.php           |  5 --
 .../Invoices/Models/InvoiceTransaction.php    |  6 +-
 .../Invoices/Models/RecurringInvoiceItem.php  | 17 +---
 .../Invoices/Tests/Unit/InvoiceModelTest.php  | 89 +++++++++++++++++++
 Modules/Quotes/Models/Quote.php               |  6 --
 Modules/Quotes/Tests/Unit/QuoteModelTest.php  | 71 +++++++++++++++
 8 files changed, 220 insertions(+), 33 deletions(-)
 create mode 100644 Modules/Core/Tests/Unit/UserCanAccessTenantTest.php
 create mode 100644 Modules/Invoices/Tests/Unit/InvoiceModelTest.php
 create mode 100644 Modules/Quotes/Tests/Unit/QuoteModelTest.php

diff --git a/Modules/Core/Models/User.php b/Modules/Core/Models/User.php
index e090c4594..0815d4d5b 100644
--- a/Modules/Core/Models/User.php
+++ b/Modules/Core/Models/User.php
@@ -198,7 +198,6 @@ public function canAccessTenant(Model $tenant): bool
         if ($this->isSuperAdmin()) {
             return true;
         }
-        dd('test 900001');
 
         return $this->companies()->whereKey($tenant->getKey())->exists();
     }
diff --git a/Modules/Core/Tests/Unit/UserCanAccessTenantTest.php b/Modules/Core/Tests/Unit/UserCanAccessTenantTest.php
new file mode 100644
index 000000000..2b1ba0a5a
--- /dev/null
+++ b/Modules/Core/Tests/Unit/UserCanAccessTenantTest.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace Modules\Core\Tests\Unit;
+
+use Modules\Core\Models\Company;
+use Modules\Core\Models\User;
+use Modules\Core\Tests\AbstractCompanyPanelTestCase;
+use PHPUnit\Framework\Attributes\Group;
+use PHPUnit\Framework\Attributes\Test;
+use Spatie\Permission\Models\Role;
+
+class UserCanAccessTenantTest extends AbstractCompanyPanelTestCase
+{
+    #[Test]
+    #[Group('unit')]
+    public function it_denies_access_to_a_different_company(): void
+    {
+        /* Arrange */
+        $otherCompany = Company::factory()->create();
+
+        /* Act */
+        $result = $this->user->canAccessTenant($otherCompany);
+
+        /* Assert */
+        $this->assertFalse($result);
+    }
+
+    #[Test]
+    #[Group('unit')]
+    public function it_allows_user_to_access_their_own_company(): void
+    {
+        /* Arrange */
+        // $this->user is already attached to $this->company via AbstractCompanyPanelTestCase
+
+        /* Act */
+        $result = $this->user->canAccessTenant($this->company);
+
+        /* Assert */
+        $this->assertTrue($result);
+    }
+
+    #[Test]
+    #[Group('unit')]
+    public function it_allows_superadmin_to_access_any_tenant(): void
+    {
+        /* Arrange */
+        Role::firstOrCreate(['name' => 'super_admin', 'guard_name' => 'web']);
+        $superAdmin = User::factory()->create();
+        $superAdmin->assignRole('super_admin');
+        $unrelatedCompany = Company::factory()->create();
+
+        /* Act */
+        $result = $superAdmin->canAccessTenant($unrelatedCompany);
+
+        /* Assert */
+        $this->assertTrue($result);
+    }
+}
diff --git a/Modules/Invoices/Models/Invoice.php b/Modules/Invoices/Models/Invoice.php
index 9aa1fe7c2..be67f6050 100644
--- a/Modules/Invoices/Models/Invoice.php
+++ b/Modules/Invoices/Models/Invoice.php
@@ -144,11 +144,6 @@ public function expenses(): HasMany
         return $this->hasMany(Expense::class);
     }
 
-    public function expenses(): HasMany
-    {
-        return $this->hasMany(Expense::class);
-    }
-
     // This and items() are the exact same. This is added to appease the IDE gods
     // and the fact that Laravel has a protected items property.
     public function invoiceItems(): HasMany
diff --git a/Modules/Invoices/Models/InvoiceTransaction.php b/Modules/Invoices/Models/InvoiceTransaction.php
index d56274f9f..cb407e823 100644
--- a/Modules/Invoices/Models/InvoiceTransaction.php
+++ b/Modules/Invoices/Models/InvoiceTransaction.php
@@ -24,11 +24,7 @@ class InvoiceTransaction extends Model
         'is_successful' => 'bool',
     ];
 
-    protected $fillable = [
-        'invoice_id',
-        'is_successful',
-        'transaction_reference',
-    ];
+    protected $guarded = [];
 
     public function invoice(): BelongsTo
     {
diff --git a/Modules/Invoices/Models/RecurringInvoiceItem.php b/Modules/Invoices/Models/RecurringInvoiceItem.php
index 5968a147e..6910ff1ff 100644
--- a/Modules/Invoices/Models/RecurringInvoiceItem.php
+++ b/Modules/Invoices/Models/RecurringInvoiceItem.php
@@ -42,22 +42,7 @@ class RecurringInvoiceItem extends Model
         'display_order' => 'int',
     ];
 
-    protected $fillable = [
-        'recurring_invoice_id',
-        'item_id',
-        'tax_rate_id',
-        'tax_rate_2_id',
-        'name',
-        'quantity',
-        'price',
-        'subtotal',
-        'tax_1',
-        'tax_2',
-        'tax',
-        'total',
-        'display_order',
-        'description',
-    ];
+    protected $guarded = [];
 
     /*
     |--------------------------------------------------------------------------
diff --git a/Modules/Invoices/Tests/Unit/InvoiceModelTest.php b/Modules/Invoices/Tests/Unit/InvoiceModelTest.php
new file mode 100644
index 000000000..f4f3c1ebb
--- /dev/null
+++ b/Modules/Invoices/Tests/Unit/InvoiceModelTest.php
@@ -0,0 +1,89 @@
+<?php
+
+namespace Modules\Invoices\Tests\Unit;
+
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Modules\Core\Tests\AbstractCompanyPanelTestCase;
+use Modules\Invoices\Models\Invoice;
+use Modules\Invoices\Models\InvoiceTransaction;
+use Modules\Invoices\Models\RecurringInvoiceItem;
+use PHPUnit\Framework\Attributes\Group;
+use PHPUnit\Framework\Attributes\Test;
+
+class InvoiceModelTest extends AbstractCompanyPanelTestCase
+{
+    #[Test]
+    #[Group('unit')]
+    public function it_has_a_single_expenses_relationship_returning_has_many(): void
+    {
+        /* Arrange */
+        $invoice = Invoice::factory()->for($this->company)->draft()->create();
+
+        /* Act */
+        $relation = $invoice->expenses();
+
+        /* Assert */
+        $this->assertInstanceOf(HasMany::class, $relation);
+    }
+
+    #[Test]
+    #[Group('unit')]
+    public function it_has_a_tax_rates_relationship_returning_belongs_to_many(): void
+    {
+        /* Arrange */
+        $invoice = Invoice::factory()->for($this->company)->draft()->create();
+
+        /* Act */
+        $relation = $invoice->taxRates();
+
+        /* Assert */
+        $this->assertInstanceOf(BelongsToMany::class, $relation);
+    }
+
+    #[Test]
+    #[Group('unit')]
+    public function it_expenses_relationship_returns_zero_count_on_new_invoice(): void
+    {
+        /* Arrange */
+        $invoice = Invoice::factory()->for($this->company)->draft()->create();
+
+        /* Act */
+        $count = $invoice->expenses()->count();
+
+        /* Assert */
+        $this->assertSame(0, $count);
+    }
+
+    #[Test]
+    #[Group('unit')]
+    public function it_uses_guarded_protection_on_invoice_transaction(): void
+    {
+        /* Arrange */
+        $model = new InvoiceTransaction();
+
+        /* Act */
+        $fillable = $model->getFillable();
+        $guarded  = $model->getGuarded();
+
+        /* Assert */
+        $this->assertEmpty($fillable, 'InvoiceTransaction must not use $fillable — use $guarded = [] instead.');
+        $this->assertSame([], $guarded);
+    }
+
+    #[Test]
+    #[Group('unit')]
+    public function it_uses_guarded_protection_on_recurring_invoice_item(): void
+    {
+        /* Arrange */
+        $model = new RecurringInvoiceItem();
+
+        /* Act */
+        $fillable = $model->getFillable();
+        $guarded  = $model->getGuarded();
+
+        /* Assert */
+        $this->assertEmpty($fillable, 'RecurringInvoiceItem must not use $fillable — use $guarded = [] instead.');
+        $this->assertSame([], $guarded);
+    }
+}
diff --git a/Modules/Quotes/Models/Quote.php b/Modules/Quotes/Models/Quote.php
index 666150e43..3fb8aedce 100644
--- a/Modules/Quotes/Models/Quote.php
+++ b/Modules/Quotes/Models/Quote.php
@@ -136,12 +136,6 @@ public function quoteItems(): HasMany
         return $this->hasMany(QuoteItem::class, 'quote_id');
     }
 
-    public function taxRate(): void
-    {
-        /*return $this->belongsToMany(TaxRate::class, 'quote_tax_rates')
-            ->withPivot('id', 'include_item_tax', 'tax_total');*/
-    }
-
     public function user(): BelongsTo
     {
         return $this->belongsTo(User::class, 'user_id');
diff --git a/Modules/Quotes/Tests/Unit/QuoteModelTest.php b/Modules/Quotes/Tests/Unit/QuoteModelTest.php
new file mode 100644
index 000000000..66c05715d
--- /dev/null
+++ b/Modules/Quotes/Tests/Unit/QuoteModelTest.php
@@ -0,0 +1,71 @@
+<?php
+
+namespace Modules\Quotes\Tests\Unit;
+
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Modules\Core\Tests\AbstractCompanyPanelTestCase;
+use Modules\Quotes\Models\Quote;
+use PHPUnit\Framework\Attributes\Group;
+use PHPUnit\Framework\Attributes\Test;
+
+class QuoteModelTest extends AbstractCompanyPanelTestCase
+{
+    #[Test]
+    #[Group('unit')]
+    public function it_has_a_user_relationship_returning_belongs_to(): void
+    {
+        /* Arrange */
+        $quote = Quote::factory()->for($this->company)->create();
+
+        /* Act */
+        $relation = $quote->user();
+
+        /* Assert */
+        $this->assertInstanceOf(BelongsTo::class, $relation);
+    }
+
+    #[Test]
+    #[Group('unit')]
+    public function it_has_a_quote_items_relationship_returning_has_many(): void
+    {
+        /* Arrange */
+        $quote = Quote::factory()->for($this->company)->create();
+
+        /* Act */
+        $relation = $quote->quoteItems();
+
+        /* Assert */
+        $this->assertInstanceOf(HasMany::class, $relation);
+    }
+
+    #[Test]
+    #[Group('unit')]
+    public function it_does_not_have_a_void_tax_rate_method(): void
+    {
+        /* Arrange */
+        $quote = Quote::factory()->for($this->company)->create();
+
+        /* Act */
+        $hasTaxRateMethod = method_exists($quote, 'taxRate');
+
+        /* Assert */
+        $this->assertFalse($hasTaxRateMethod, 'Quote::taxRate() with void return type was removed — it had no implementation.');
+    }
+
+    #[Test]
+    #[Group('unit')]
+    public function it_uses_guarded_protection(): void
+    {
+        /* Arrange */
+        $model = new Quote();
+
+        /* Act */
+        $fillable = $model->getFillable();
+        $guarded  = $model->getGuarded();
+
+        /* Assert */
+        $this->assertEmpty($fillable, 'Quote must not use $fillable — use $guarded = [] instead.');
+        $this->assertSame([], $guarded);
+    }
+}

From 991332bc96f837f9039251817c3aa20cebe1693d Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 17:32:20 +0000
Subject: [PATCH 2/8] refactor(tests): replace implementation-detail assertions
 with behavioral tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- InvoiceModelTest: replace assertInstanceOf(HasMany) with real relation
  data assertions; replace $guarded property checks with mass-assignment
  create/fill tests; add cross-invoice isolation assertion for expenses
- QuoteModelTest: replace assertInstanceOf(BelongsTo/HasMany) with
  identity/collection assertions; drop method_exists(taxRate) structural
  check (removed dead stub needs no test); replace $guarded check with
  mass-assignment create test; add zero-items assertion
- UserCanAccessTenantTest: add missing negative path — user with no
  company association must be denied tenant access

Co-authored-by: Niels Drost <nielsdrost7@users.noreply.github.com>
---
 .../Tests/Unit/UserCanAccessTenantTest.php    | 14 ++++
 .../Invoices/Tests/Unit/InvoiceModelTest.php  | 74 ++++++++++++-------
 Modules/Quotes/Tests/Unit/QuoteModelTest.php  | 43 ++++++-----
 3 files changed, 86 insertions(+), 45 deletions(-)

diff --git a/Modules/Core/Tests/Unit/UserCanAccessTenantTest.php b/Modules/Core/Tests/Unit/UserCanAccessTenantTest.php
index 2b1ba0a5a..18db99fd4 100644
--- a/Modules/Core/Tests/Unit/UserCanAccessTenantTest.php
+++ b/Modules/Core/Tests/Unit/UserCanAccessTenantTest.php
@@ -55,4 +55,18 @@ public function it_allows_superadmin_to_access_any_tenant(): void
         /* Assert */
         $this->assertTrue($result);
     }
+
+    #[Test]
+    #[Group('unit')]
+    public function it_denies_access_to_a_user_with_no_company_association(): void
+    {
+        /* Arrange */
+        $userWithNoCompany = User::factory()->create();
+
+        /* Act */
+        $result = $userWithNoCompany->canAccessTenant($this->company);
+
+        /* Assert */
+        $this->assertFalse($result);
+    }
 }
diff --git a/Modules/Invoices/Tests/Unit/InvoiceModelTest.php b/Modules/Invoices/Tests/Unit/InvoiceModelTest.php
index f4f3c1ebb..620a228b1 100644
--- a/Modules/Invoices/Tests/Unit/InvoiceModelTest.php
+++ b/Modules/Invoices/Tests/Unit/InvoiceModelTest.php
@@ -2,9 +2,9 @@
 
 namespace Modules\Invoices\Tests\Unit;
 
-use Illuminate\Database\Eloquent\Relations\BelongsToMany;
-use Illuminate\Database\Eloquent\Relations\HasMany;
+use Modules\Core\Models\TaxRate;
 use Modules\Core\Tests\AbstractCompanyPanelTestCase;
+use Modules\Expenses\Models\Expense;
 use Modules\Invoices\Models\Invoice;
 use Modules\Invoices\Models\InvoiceTransaction;
 use Modules\Invoices\Models\RecurringInvoiceItem;
@@ -15,75 +15,99 @@ class InvoiceModelTest extends AbstractCompanyPanelTestCase
 {
     #[Test]
     #[Group('unit')]
-    public function it_has_a_single_expenses_relationship_returning_has_many(): void
+    public function it_returns_expenses_belonging_to_the_invoice(): void
     {
         /* Arrange */
-        $invoice = Invoice::factory()->for($this->company)->draft()->create();
+        $invoice      = Invoice::factory()->for($this->company)->draft()->create();
+        $ownedExpense = Expense::factory()->for($this->company)->create(['invoice_id' => $invoice->id]);
+
+        $otherInvoice = Invoice::factory()->for($this->company)->draft()->create();
+        Expense::factory()->for($this->company)->create(['invoice_id' => $otherInvoice->id]);
 
         /* Act */
-        $relation = $invoice->expenses();
+        $result = $invoice->expenses;
 
         /* Assert */
-        $this->assertInstanceOf(HasMany::class, $relation);
+        $this->assertCount(1, $result);
+        $this->assertTrue($result->contains($ownedExpense));
     }
 
     #[Test]
     #[Group('unit')]
-    public function it_has_a_tax_rates_relationship_returning_belongs_to_many(): void
+    public function it_returns_zero_expenses_for_a_new_invoice(): void
     {
         /* Arrange */
         $invoice = Invoice::factory()->for($this->company)->draft()->create();
 
         /* Act */
-        $relation = $invoice->taxRates();
+        $count = $invoice->expenses()->count();
 
         /* Assert */
-        $this->assertInstanceOf(BelongsToMany::class, $relation);
+        $this->assertSame(0, $count);
     }
 
     #[Test]
     #[Group('unit')]
-    public function it_expenses_relationship_returns_zero_count_on_new_invoice(): void
+    public function it_returns_only_tax_rates_attached_to_the_invoice(): void
     {
         /* Arrange */
-        $invoice = Invoice::factory()->for($this->company)->draft()->create();
+        $invoice        = Invoice::factory()->for($this->company)->draft()->create();
+        $attachedRate   = TaxRate::factory()->for($this->company)->create();
+        $unattachedRate = TaxRate::factory()->for($this->company)->create();
+        $invoice->taxRates()->attach($attachedRate);
 
         /* Act */
-        $count = $invoice->expenses()->count();
+        $result = $invoice->taxRates;
 
         /* Assert */
-        $this->assertSame(0, $count);
+        $this->assertCount(1, $result);
+        $this->assertTrue($result->contains($attachedRate));
+        $this->assertFalse($result->contains($unattachedRate));
     }
 
     #[Test]
     #[Group('unit')]
-    public function it_uses_guarded_protection_on_invoice_transaction(): void
+    public function it_allows_creating_an_invoice_transaction_via_mass_assignment(): void
     {
         /* Arrange */
-        $model = new InvoiceTransaction();
+        $invoice = Invoice::factory()->for($this->company)->draft()->create();
 
         /* Act */
-        $fillable = $model->getFillable();
-        $guarded  = $model->getGuarded();
+        InvoiceTransaction::create([
+            'invoice_id'            => $invoice->id,
+            'is_successful'         => true,
+            'transaction_reference' => 'TXN-REF-001',
+        ]);
 
         /* Assert */
-        $this->assertEmpty($fillable, 'InvoiceTransaction must not use $fillable — use $guarded = [] instead.');
-        $this->assertSame([], $guarded);
+        $this->assertDatabaseHas('invoice_transactions', [
+            'invoice_id'            => $invoice->id,
+            'is_successful'         => true,
+            'transaction_reference' => 'TXN-REF-001',
+        ]);
     }
 
     #[Test]
     #[Group('unit')]
-    public function it_uses_guarded_protection_on_recurring_invoice_item(): void
+    public function it_allows_filling_all_recurring_invoice_item_fields_via_mass_assignment(): void
     {
         /* Arrange */
-        $model = new RecurringInvoiceItem();
+        $fields = [
+            'item_name'     => 'Monthly Hosting',
+            'quantity'      => 2.0,
+            'price'         => 49.99,
+            'subtotal'      => 99.98,
+            'total'         => 99.98,
+            'display_order' => 1,
+        ];
 
         /* Act */
-        $fillable = $model->getFillable();
-        $guarded  = $model->getGuarded();
+        $item = new RecurringInvoiceItem($fields);
 
         /* Assert */
-        $this->assertEmpty($fillable, 'RecurringInvoiceItem must not use $fillable — use $guarded = [] instead.');
-        $this->assertSame([], $guarded);
+        $this->assertEquals('Monthly Hosting', $item->item_name);
+        $this->assertEquals(2.0, $item->quantity);
+        $this->assertEquals(49.99, $item->price);
+        $this->assertEquals(99.98, $item->subtotal);
     }
 }
diff --git a/Modules/Quotes/Tests/Unit/QuoteModelTest.php b/Modules/Quotes/Tests/Unit/QuoteModelTest.php
index 66c05715d..4d0e85e14 100644
--- a/Modules/Quotes/Tests/Unit/QuoteModelTest.php
+++ b/Modules/Quotes/Tests/Unit/QuoteModelTest.php
@@ -2,10 +2,9 @@
 
 namespace Modules\Quotes\Tests\Unit;
 
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasMany;
 use Modules\Core\Tests\AbstractCompanyPanelTestCase;
 use Modules\Quotes\Models\Quote;
+use Modules\Quotes\Models\QuoteItem;
 use PHPUnit\Framework\Attributes\Group;
 use PHPUnit\Framework\Attributes\Test;
 
@@ -13,59 +12,63 @@ class QuoteModelTest extends AbstractCompanyPanelTestCase
 {
     #[Test]
     #[Group('unit')]
-    public function it_has_a_user_relationship_returning_belongs_to(): void
+    public function it_returns_the_user_who_created_the_quote(): void
     {
         /* Arrange */
-        $quote = Quote::factory()->for($this->company)->create();
+        $quote = Quote::factory()->for($this->company)->create(['user_id' => $this->user->id]);
 
         /* Act */
-        $relation = $quote->user();
+        $result = $quote->user;
 
         /* Assert */
-        $this->assertInstanceOf(BelongsTo::class, $relation);
+        $this->assertNotNull($result);
+        $this->assertEquals($this->user->id, $result->id);
     }
 
     #[Test]
     #[Group('unit')]
-    public function it_has_a_quote_items_relationship_returning_has_many(): void
+    public function it_returns_items_belonging_to_the_quote(): void
     {
         /* Arrange */
-        $quote = Quote::factory()->for($this->company)->create();
+        $quote      = Quote::factory()->for($this->company)->create();
+        $item       = QuoteItem::factory()->for($quote)->create();
+
+        $otherQuote = Quote::factory()->for($this->company)->create();
+        QuoteItem::factory()->for($otherQuote)->create();
 
         /* Act */
-        $relation = $quote->quoteItems();
+        $result = $quote->quoteItems;
 
         /* Assert */
-        $this->assertInstanceOf(HasMany::class, $relation);
+        $this->assertCount(1, $result);
+        $this->assertTrue($result->contains($item));
     }
 
     #[Test]
     #[Group('unit')]
-    public function it_does_not_have_a_void_tax_rate_method(): void
+    public function it_returns_no_items_for_a_new_quote(): void
     {
         /* Arrange */
         $quote = Quote::factory()->for($this->company)->create();
 
         /* Act */
-        $hasTaxRateMethod = method_exists($quote, 'taxRate');
+        $count = $quote->quoteItems()->count();
 
         /* Assert */
-        $this->assertFalse($hasTaxRateMethod, 'Quote::taxRate() with void return type was removed — it had no implementation.');
+        $this->assertSame(0, $count);
     }
 
     #[Test]
     #[Group('unit')]
-    public function it_uses_guarded_protection(): void
+    public function it_allows_creating_a_quote_via_mass_assignment(): void
     {
-        /* Arrange */
-        $model = new Quote();
+        /* Arrange — only fields needed to satisfy DB constraints */
+        $quote = Quote::factory()->for($this->company)->make()->toArray();
 
         /* Act */
-        $fillable = $model->getFillable();
-        $guarded  = $model->getGuarded();
+        $created = Quote::create($quote);
 
         /* Assert */
-        $this->assertEmpty($fillable, 'Quote must not use $fillable — use $guarded = [] instead.');
-        $this->assertSame([], $guarded);
+        $this->assertDatabaseHas('quotes', ['id' => $created->id]);
     }
 }

From 46724fadf66fe1ac34b39f6236ad3d2a751e39dc Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 17:59:04 +0000
Subject: [PATCH 3/8] =?UTF-8?q?fix:=20pre-launch=20test=20suite=20?=
 =?UTF-8?q?=E2=80=94=20multi-tenancy=20isolation,=20business=20rule=20enfo?=
 =?UTF-8?q?rcement,=20fragile=20assertions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Multi-tenancy isolation (CRITICAL)
- InvoicesTest: add it_only_returns_invoices_belonging_to_the_current_tenant + list isolation test
- QuotesTest: add it_only_returns_quotes_belonging_to_the_current_tenant + list isolation test
- CustomersTest: add it_only_returns_customers_belonging_to_the_current_tenant + list isolation test
- ProductsTest: add it_only_returns_products_belonging_to_the_current_tenant + list isolation test

## Paid invoice deletion enforcement (CRITICAL)
- InvoiceService: throw InvalidArgumentException when deleting a PAID invoice
- InvoicesTable: catch InvalidArgumentException in delete action, show danger notification
- InvoicesTest: remove markTestIncomplete from it_fails_to_delete_paid_invoice (now enforced)
- Add cannot_delete_paid_invoice translation key

## Active user login test fix
- UsersTest: split misleading it_allows_active_users_to_login_after_inactive_user_fails into
  it_denies_login_to_inactive_users + it_allows_active_users_to_login
- The active user is now actually logged in and asserted authenticated

## Remove fragile translation assertions
- UsersTest: remove assertEquals on trans('ip.account_inactive') and trans('ip.account_inactive_login_denied')
  — exact translation wording is not a business rule; assertHasErrors + assertGuest are sufficient

## Quote validation markTestIncomplete
- Add explanatory comments: these are computed/disabled fields populated by QuoteCalculator;
  they cannot have standalone required validation

## Peppol group rename + behavioral rewrite
- Rename #[Group('failing')] → #[Group('peppol')] in PeppolServiceTest and SendInvoiceToPeppolActionTest
- Rewrite it_loads_invoice_relationships: assert the HTTP request sent to Peppol contains
  customer and invoice_lines data (observable outcome) instead of asserting internal plumbing

## Remove debug code
- Remove commented-out dump()/dd() from CompaniesTest (×2), UsersTest, ProductsTest (×6)

Co-authored-by: Niels Drost <nielsdrost7@users.noreply.github.com>
---
 .../Clients/Tests/Feature/CustomersTest.php   | 38 ++++++++
 Modules/Core/Tests/Feature/CompaniesTest.php  |  8 --
 Modules/Core/Tests/Feature/UsersTest.php      | 66 +++----------
 .../Invoices/Tables/InvoicesTable.php         |  9 +-
 Modules/Invoices/Services/InvoiceService.php  |  5 +
 .../Invoices/Tests/Feature/InvoicesTest.php   | 93 +++++++++++--------
 .../Actions/SendInvoiceToPeppolActionTest.php | 35 ++++---
 .../Peppol/Services/PeppolServiceTest.php     | 24 ++---
 .../Products/Tests/Feature/ProductsTest.php   | 70 +++++++-------
 Modules/Quotes/Tests/Feature/QuotesTest.php   | 65 ++++++++++++-
 resources/lang/en/ip.php                      |  1 +
 11 files changed, 251 insertions(+), 163 deletions(-)

diff --git a/Modules/Clients/Tests/Feature/CustomersTest.php b/Modules/Clients/Tests/Feature/CustomersTest.php
index beb539976..be22a3264 100644
--- a/Modules/Clients/Tests/Feature/CustomersTest.php
+++ b/Modules/Clients/Tests/Feature/CustomersTest.php
@@ -415,6 +415,44 @@ public function it_fails_to_delete_customer_when_contact_attached(): void
     # endregion
 
     # region multi-tenancy
+    #[Test]
+    #[Group('multi-tenancy')]
+    public function it_only_returns_customers_belonging_to_the_current_tenant(): void
+    {
+        /* Arrange */
+        $companyB   = \Modules\Core\Models\Company::factory()->create();
+        $customerA  = Relation::factory()->for($this->company)->customer()->create();
+        $customerB  = Relation::factory()->for($companyB)->customer()->create();
+
+        /* Act — authenticate as Company A user; global scope filters to Company A */
+        $this->actingAs($this->user);
+
+        /* Assert */
+        $this->assertDatabaseHas('relations', ['id' => $customerA->id]);
+        $this->assertDatabaseHas('relations', ['id' => $customerB->id]);    // B is in the DB...
+        $this->assertNotNull(Relation::find($customerA->id));               // A is visible to tenant A
+        $this->assertNull(Relation::find($customerB->id));                  // B is NOT visible to tenant A
+    }
+
+    #[Test]
+    #[Group('multi-tenancy')]
+    public function it_only_lists_customers_for_the_current_tenant(): void
+    {
+        /* Arrange */
+        $companyB = \Modules\Core\Models\Company::factory()->create();
+
+        $customerA = Relation::factory()->for($this->company)->customer()->create(['company_name' => 'Visible Customer']);
+        $customerB = Relation::factory()->for($companyB)->customer()->create(['company_name' => 'Hidden Customer']);
+
+        /* Act */
+        $component = Livewire::actingAs($this->user)
+            ->test(ListRelations::class, ['tenant' => Str::lower($this->company->search_code)]);
+
+        /* Assert */
+        $component->assertSuccessful();
+        $this->assertDatabaseHas('relations', ['id' => $customerB->id]);
+        $component->assertDontSeeText('Hidden Customer');
+    }
     # endregion
 
     # region spicy
diff --git a/Modules/Core/Tests/Feature/CompaniesTest.php b/Modules/Core/Tests/Feature/CompaniesTest.php
index 11ede44de..cde575d15 100644
--- a/Modules/Core/Tests/Feature/CompaniesTest.php
+++ b/Modules/Core/Tests/Feature/CompaniesTest.php
@@ -196,10 +196,6 @@ public function it_creates_a_company(): void
             ->fillForm($payload)
             ->call('create');
 
-        /*if (app()->runningUnitTests()) {
-            dump($payload);
-        }*/
-
         /* Assert */
         $component
             ->assertSuccessful()
@@ -221,10 +217,6 @@ public function it_fails_to_create_company_when_search_code_missing(): void
             ->fillForm($payload)
             ->call('create');
 
-        /*if (app()->runningUnitTests()) {
-            dump($payload);
-        }*/
-
         /* Assert */
         $component
             ->assertHasFormErrors(['search_code']);
diff --git a/Modules/Core/Tests/Feature/UsersTest.php b/Modules/Core/Tests/Feature/UsersTest.php
index 3586b971c..b007172a3 100644
--- a/Modules/Core/Tests/Feature/UsersTest.php
+++ b/Modules/Core/Tests/Feature/UsersTest.php
@@ -81,22 +81,15 @@ public function it_deletes_a_user(): void
     #[Test]
     #[Group('authentication')]
     #[Group('security')]
-    /**
-     * Test that inactive users cannot log in and receive appropriate error messages.
-     *
-     * @payload ['name' => 'Inactive User', 'email' => 'inactive@example.com', 'is_active' => false]
-     */
-    public function it_prevents_inactive_users_from_logging_in(): void
+    public function it_denies_login_to_inactive_users(): void
     {
         /* Arrange */
-        $expectedDate = Carbon::now();
-
         $inactiveUser = User::factory()->create([
             'name'              => 'Inactive User',
             'email'             => 'inactive@example.com',
             'password'          => bcrypt('password123'),
             'is_active'         => false,
-            'email_verified_at' => $expectedDate,
+            'email_verified_at' => Carbon::now(),
         ]);
 
         $inactiveUser->companies()->attach($this->company);
@@ -111,19 +104,7 @@ public function it_prevents_inactive_users_from_logging_in(): void
 
         /* Assert */
         $response->assertHasErrors();
-
-        $this->assertEquals(
-            'Your account is inactive. Please contact the administrator.',
-            trans('ip.account_inactive')
-        );
-
-        $this->assertEquals(
-            'Login denied: Your account has been deactivated.',
-            trans('ip.account_inactive_login_denied')
-        );
-
         $this->assertGuest();
-
         $this->assertDatabaseHas('users', [
             'email'     => 'inactive@example.com',
             'is_active' => false,
@@ -133,64 +114,45 @@ public function it_prevents_inactive_users_from_logging_in(): void
     #[Test]
     #[Group('authentication')]
     #[Group('security')]
-    #[Group('edge-cases')]
-    /**
-     * Test edge case: Active user can log in successfully after inactive user fails.
-     */
-    public function it_allows_active_users_to_login_after_inactive_user_fails(): void
+    public function it_allows_active_users_to_login(): void
     {
         /* Arrange */
-        $expectedDate = Carbon::now();
-
-        $inactiveUser = User::factory()->create([
-            'name'              => 'Inactive User',
-            'email'             => 'inactive@example.com',
-            'password'          => bcrypt('password123'),
-            'is_active'         => false,
-            'email_verified_at' => $expectedDate,
-        ]);
-
         $activeUser = User::factory()->create([
             'name'              => 'Active User',
             'email'             => 'active@example.com',
-            'password'          => bcrypt('password123'),
+            'password'          => bcrypt('password'),
             'is_active'         => true,
-            'email_verified_at' => $expectedDate,
+            'email_verified_at' => Carbon::now(),
         ]);
 
-        $inactiveUser->companies()->attach($this->company);
         $activeUser->companies()->attach($this->company);
 
         /* Act */
-        $inactiveResponse = Livewire::test(Login::class)
+        $response = Livewire::test(Login::class)
             ->fillForm([
-                'email'    => 'inactive@example.com',
-                'password' => 'password123',
+                'email'    => 'active@example.com',
+                'password' => 'password',
             ])
             ->call('authenticate');
 
-        $inactiveResponse->assertHasErrors();
-        $this->assertGuest();
+        /* Assert */
+        $response->assertHasNoErrors();
+        $this->assertAuthenticated();
     }
 
     #[Test]
     #[Group('authentication')]
     #[Group('security')]
     #[Group('edge-cases')]
-    /**
-     * Test edge case: User becomes inactive after being created as active.
-     */
     public function it_prevents_login_when_user_becomes_inactive_after_creation(): void
     {
         /* Arrange */
-        $expectedDate = Carbon::now();
-
         $userPayload = [
             'name'              => 'Test User',
             'email'             => 'test@example.com',
             'password'          => 'password123',
             'is_active'         => true,
-            'email_verified_at' => $expectedDate,
+            'email_verified_at' => Carbon::now(),
         ];
 
         $user = User::factory()->create($userPayload);
@@ -205,10 +167,6 @@ public function it_prevents_login_when_user_becomes_inactive_after_creation(): v
             ])
             ->call('authenticate');
 
-        /*if (app()->runningUnitTests()) {
-            dd($initialLoginResponse->errors());
-        }*/
-
         $initialLoginResponse->assertSuccessful();
         $this->assertAuthenticated();
 
diff --git a/Modules/Invoices/Filament/Company/Resources/Invoices/Tables/InvoicesTable.php b/Modules/Invoices/Filament/Company/Resources/Invoices/Tables/InvoicesTable.php
index 0622069c8..36b839a81 100644
--- a/Modules/Invoices/Filament/Company/Resources/Invoices/Tables/InvoicesTable.php
+++ b/Modules/Invoices/Filament/Company/Resources/Invoices/Tables/InvoicesTable.php
@@ -158,7 +158,14 @@ public static function configure(Table $table): Table
                         }),
                     DeleteAction::make('delete')
                         ->action(function (Invoice $record, array $data) {
-                            app(InvoiceService::class)->deleteInvoice($record);
+                            try {
+                                app(InvoiceService::class)->deleteInvoice($record);
+                            } catch (\InvalidArgumentException $e) {
+                                \Filament\Notifications\Notification::make()
+                                    ->title($e->getMessage())
+                                    ->danger()
+                                    ->send();
+                            }
                         }),
                 ]),
             ])
diff --git a/Modules/Invoices/Services/InvoiceService.php b/Modules/Invoices/Services/InvoiceService.php
index e78c71a11..cb104a088 100644
--- a/Modules/Invoices/Services/InvoiceService.php
+++ b/Modules/Invoices/Services/InvoiceService.php
@@ -6,6 +6,7 @@
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 use Modules\Core\Services\BaseService;
+use Modules\Invoices\Enums\InvoiceStatus;
 use Modules\Invoices\Models\Invoice;
 use Throwable;
 
@@ -178,6 +179,10 @@ public function updateInvoice(Invoice $invoice, array $data): Invoice
 
     public function deleteInvoice(Invoice $invoice): Invoice
     {
+        if ($invoice->invoice_status === InvoiceStatus::PAID) {
+            throw new \InvalidArgumentException(trans('ip.cannot_delete_paid_invoice'));
+        }
+
         DB::beginTransaction();
         try {
             $invoice->invoiceItems()->delete();
diff --git a/Modules/Invoices/Tests/Feature/InvoicesTest.php b/Modules/Invoices/Tests/Feature/InvoicesTest.php
index 409822041..49ff3be1f 100644
--- a/Modules/Invoices/Tests/Feature/InvoicesTest.php
+++ b/Modules/Invoices/Tests/Feature/InvoicesTest.php
@@ -640,55 +640,33 @@ public function it_deletes_an_invoice(): void
     #[Group('crud')]
     public function it_fails_to_delete_paid_invoice(): void
     {
-        $this->markTestIncomplete('Still can delete paid invoice');
-
         /* Arrange */
-        $user            = $this->user;
-        $customer        = Relation::factory()->for($this->company)->customer()->create();
-        $documentGroup   = Numbering::factory()->for($this->company)->create();
-        $taxRate         = TaxRate::factory()->for($this->company)->create();
-        $productCategory = ProductCategory::factory()->for($this->company)->create();
-        $productUnit     = ProductUnit::factory()->for($this->company)->create();
-        $product         = Product::factory()->for($this->company)->create([
-            'category_id'   => $productCategory->id,
-            'unit_id'       => $productUnit->id,
-            'tax_rate_id'   => $taxRate->id,
-            'tax_rate_2_id' => null,
-        ]);
-
-        $payload = [
-            'customer_id'              => $customer->id,
-            'numbering_id'             => $documentGroup->id,
-            'user_id'                  => $user->id,
-            'invoice_number'           => 'INV-987654',
-            'invoice_status'           => InvoiceStatus::PAID,
-            'invoice_sign'             => '1',
-            'invoiced_at'              => now()->format('Y-m-d'),
-            'invoice_due_at'           => now()->addDays(30)->format('Y-m-d'),
-            'invoice_discount_amount'  => 10,
-            'invoice_discount_percent' => 5,
-            'item_tax_total'           => 0,
-            'invoice_item_subtotal'    => 450,
-            'invoice_tax_total'        => 20,
-            'invoice_total'            => 440,
-        ];
+        $user     = $this->user;
+        $customer = Relation::factory()->for($this->company)->customer()->create();
 
         $invoice = Invoice::factory()
             ->for($this->company)
-            ->create($payload);
-
-        $payment = Payment::factory()->for($this->company)->create([
+            ->paid()
+            ->create([
+                'customer_id'  => $customer->id,
+                'user_id'      => $user->id,
+                'invoice_number' => 'INV-PAID-001',
+            ]);
+
+        Payment::factory()->for($this->company)->create([
             'customer_id'    => $customer->id,
             'invoice_id'     => $invoice->id,
-            'payment_amount' => 440,
+            'payment_amount' => $invoice->invoice_total,
             'paid_at'        => now(),
         ]);
 
-        $component = Livewire::actingAs($this->user)
+        /* Act */
+        Livewire::actingAs($this->user)
             ->test(ListInvoices::class)
             ->mountAction(TestAction::make('delete')->table($invoice))
             ->callMountedAction();
 
+        /* Assert — paid invoice must be preserved */
         $this->assertDatabaseHas('invoices', ['id' => $invoice->id]);
     }
 
@@ -696,7 +674,10 @@ public function it_fails_to_delete_paid_invoice(): void
     #[Group('crud')]
     public function it_fails_to_delete_invoice_that_was_already_deleted(): void
     {
-        $this->markTestIncomplete('record to deleteAction cannot be null');
+        $this->markTestIncomplete(
+            'Filament table actions cannot be mounted on records that no longer exist in the database. ' .
+            'Once an invoice is deleted, its absence is already verified by assertDatabaseMissing.'
+        );
 
         /* Arrange */
         $invoice = Invoice::factory()->for($this->company)->create();
@@ -716,6 +697,44 @@ public function it_fails_to_delete_invoice_that_was_already_deleted(): void
     # endregion
 
     # region multi-tenancy
+    #[Test]
+    #[Group('multi-tenancy')]
+    public function it_only_returns_invoices_belonging_to_the_current_tenant(): void
+    {
+        /* Arrange */
+        $companyB  = \Modules\Core\Models\Company::factory()->create();
+        $invoiceA  = Invoice::factory()->for($this->company)->create(['invoice_number' => 'INV-TENANT-A']);
+        $invoiceB  = Invoice::factory()->for($companyB)->create(['invoice_number' => 'INV-TENANT-B']);
+
+        /* Act — authenticate as Company A user; global scope filters to Company A */
+        $this->actingAs($this->user);
+
+        /* Assert */
+        $this->assertDatabaseHas('invoices', ['id' => $invoiceA->id]);
+        $this->assertDatabaseHas('invoices', ['id' => $invoiceB->id]);    // B is in the DB...
+        $this->assertNotNull(Invoice::find($invoiceA->id));               // A is visible to tenant A
+        $this->assertNull(Invoice::find($invoiceB->id));                  // B is NOT visible to tenant A
+    }
+
+    #[Test]
+    #[Group('multi-tenancy')]
+    public function it_only_lists_invoices_for_the_current_tenant(): void
+    {
+        /* Arrange */
+        $companyB = \Modules\Core\Models\Company::factory()->create();
+
+        Invoice::factory()->for($this->company)->create(['invoice_number' => 'INV-VISIBLE']);
+        Invoice::factory()->for($companyB)->create(['invoice_number' => 'INV-HIDDEN']);
+
+        /* Act */
+        $component = Livewire::actingAs($this->user)
+            ->test(ListInvoices::class);
+
+        /* Assert */
+        $component->assertSuccessful();
+        $this->assertDatabaseHas('invoices', ['invoice_number' => 'INV-HIDDEN']);
+        $component->assertDontSeeText('INV-HIDDEN');
+    }
     # endregion
 
     #region spicy
diff --git a/Modules/Invoices/Tests/Unit/Actions/SendInvoiceToPeppolActionTest.php b/Modules/Invoices/Tests/Unit/Actions/SendInvoiceToPeppolActionTest.php
index 57dc7ffe0..0b321b0f3 100644
--- a/Modules/Invoices/Tests/Unit/Actions/SendInvoiceToPeppolActionTest.php
+++ b/Modules/Invoices/Tests/Unit/Actions/SendInvoiceToPeppolActionTest.php
@@ -54,7 +54,7 @@ protected function setUp(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_executes_successfully_with_valid_invoice(): void
     {
         $invoice = $this->createMockInvoice('sent');
@@ -69,22 +69,29 @@ public function it_executes_successfully_with_valid_invoice(): void
     }
 
     #[Test]
-    #[Group('failing')]
-    public function it_loads_invoice_relationships(): void
+    #[Group('peppol')]
+    public function it_transmits_invoice_data_including_customer_and_line_items_to_peppol(): void
     {
+        /* Arrange */
         $invoice = $this->createMockInvoice('sent');
 
+        /* Act */
         $this->action->execute($invoice, [
             'customer_peppol_id' => 'BE:0123456789',
         ]);
 
-        // Verify the invoice had its relationships loaded
-        $this->assertNotNull($invoice->customer);
-        $this->assertNotEmpty($invoice->invoiceItems);
+        /* Assert — the HTTP request sent to Peppol includes customer and line-item data */
+        Http::assertSent(function ($request) {
+            $data = $request->data();
+
+            return isset($data['customer'])
+                && isset($data['invoice_lines'])
+                && count($data['invoice_lines']) > 0;
+        });
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_rejects_draft_invoices(): void
     {
         $invoice = $this->createMockInvoice('draft');
@@ -96,7 +103,7 @@ public function it_rejects_draft_invoices(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_passes_additional_data_to_service(): void
     {
         $invoice        = $this->createMockInvoice('sent');
@@ -146,7 +153,7 @@ public function it_cancels_document(): void
     // Failing tests
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_handles_validation_errors_from_peppol(): void
     {
         Http::fake([
@@ -167,7 +174,7 @@ public function it_handles_validation_errors_from_peppol(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_handles_network_failures(): void
     {
         Http::fake([
@@ -184,7 +191,7 @@ public function it_handles_network_failures(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_validates_invoice_has_required_data(): void
     {
         /** @var Invoice $invoice */
@@ -202,7 +209,7 @@ public function it_validates_invoice_has_required_data(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_fails_when_status_check_fails(): void
     {
         Http::fake([
@@ -221,7 +228,7 @@ public function it_fails_when_status_check_fails(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_fails_when_cancellation_not_allowed(): void
     {
         Http::fake([
@@ -240,7 +247,7 @@ public function it_fails_when_cancellation_not_allowed(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_sends_invoice(): void
     {
         /* Arrange */
diff --git a/Modules/Invoices/Tests/Unit/Peppol/Services/PeppolServiceTest.php b/Modules/Invoices/Tests/Unit/Peppol/Services/PeppolServiceTest.php
index 90724a021..de91d5688 100644
--- a/Modules/Invoices/Tests/Unit/Peppol/Services/PeppolServiceTest.php
+++ b/Modules/Invoices/Tests/Unit/Peppol/Services/PeppolServiceTest.php
@@ -52,7 +52,7 @@ protected function setUp(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_sends_invoice_to_peppol_successfully(): void
     {
         $invoice = $this->createMockInvoice();
@@ -68,7 +68,7 @@ public function it_sends_invoice_to_peppol_successfully(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_validates_invoice_has_customer(): void
     {
         $invoice = Invoice::factory()->make(['customer_id' => null]);
@@ -82,7 +82,7 @@ public function it_validates_invoice_has_customer(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_validates_invoice_has_invoice_number(): void
     {
         $invoice = Invoice::factory()->make(['invoice_number' => null]);
@@ -96,7 +96,7 @@ public function it_validates_invoice_has_invoice_number(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_validates_invoice_has_items(): void
     {
         $invoice = Invoice::factory()->make([
@@ -112,7 +112,7 @@ public function it_validates_invoice_has_items(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_handles_api_errors_gracefully(): void
     {
         Http::fake([
@@ -129,7 +129,7 @@ public function it_handles_api_errors_gracefully(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_gets_document_status(): void
     {
         Http::fake([
@@ -146,7 +146,7 @@ public function it_gets_document_status(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_cancels_document(): void
     {
         Http::fake([
@@ -159,7 +159,7 @@ public function it_cancels_document(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_prepares_document_data_correctly(): void
     {
         $invoice = $this->createMockInvoice();
@@ -178,7 +178,7 @@ public function it_prepares_document_data_correctly(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_includes_customer_peppol_id_in_request(): void
     {
         $invoice = $this->createMockInvoice();
@@ -198,7 +198,7 @@ public function it_includes_customer_peppol_id_in_request(): void
     // Failing tests for edge cases
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_handles_connection_timeout(): void
     {
         Http::fake([
@@ -215,7 +215,7 @@ public function it_handles_connection_timeout(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_handles_unauthorized_access(): void
     {
         Http::fake([
@@ -232,7 +232,7 @@ public function it_handles_unauthorized_access(): void
     }
 
     #[Test]
-    #[Group('failing')]
+    #[Group('peppol')]
     public function it_handles_server_errors(): void
     {
         Http::fake([
diff --git a/Modules/Products/Tests/Feature/ProductsTest.php b/Modules/Products/Tests/Feature/ProductsTest.php
index 3a9e8c0a6..be6f1df3e 100644
--- a/Modules/Products/Tests/Feature/ProductsTest.php
+++ b/Modules/Products/Tests/Feature/ProductsTest.php
@@ -116,10 +116,6 @@ public function it_creates_a_product_through_a_modal(): void
             ->fillForm($payload)
             ->callMountedAction();
 
-        /*if (app()->runningUnitTests()) {
-            dd($payload);
-        }*/
-
         /* Assert */
         $component
             ->assertHasNoFormErrors();
@@ -180,10 +176,6 @@ public function it_fails_to_create_product_through_a_modal_without_required_code
             ->fillForm($payload)
             ->callMountedAction();
 
-        /*if (app()->runningUnitTests()) {
-            dump($payload);
-        }*/
-
         /* Assert */
         $component
             ->assertHasFormErrors(['code']);
@@ -242,10 +234,6 @@ public function it_fails_to_create_product_through_a_modal_without_required_prod
             ->fillForm($payload)
             ->callMountedAction();
 
-        /*if (app()->runningUnitTests()) {
-            dump($payload);
-        }*/
-
         /* Assert */
         $component
             ->assertHasFormErrors(['product_name']);
@@ -301,10 +289,6 @@ public function it_fails_to_create_product_through_a_modal_without_required_pric
             ->fillForm($payload)
             ->callMountedAction();
 
-        /*if (app()->runningUnitTests()) {
-            dump($payload);
-        }*/
-
         /* Assert */
         $component
             ->assertHasFormErrors(['price']);
@@ -409,10 +393,6 @@ public function it_creates_a_product(): void
             ->fillForm($payload)
             ->call('create');
 
-        /*if (app()->runningUnitTests()) {
-            dump($payload);
-        }*/
-
         /* Assert */
         $component
             ->assertHasNoFormErrors();
@@ -472,10 +452,6 @@ public function it_fails_to_create_product_without_required_code(): void
             ->fillForm($payload)
             ->call('create');
 
-        /*if (app()->runningUnitTests()) {
-            dump($payload);
-        }*/
-
         /* Assert */
         $component
             ->assertHasFormErrors(['code']);
@@ -532,10 +508,6 @@ public function it_fails_to_create_product_without_required_product_name(): void
             ->fillForm($payload)
             ->call('create');
 
-        /*if (app()->runningUnitTests()) {
-            dump($payload);
-        }*/
-
         /* Assert */
         $component
             ->assertHasFormErrors(['product_name']);
@@ -590,10 +562,6 @@ public function it_fails_to_create_product_without_required_price(): void
             ->fillForm($payload)
             ->call('create');
 
-        /*if (app()->runningUnitTests()) {
-            dump($payload);
-        }*/
-
         /* Assert */
         $component
             ->assertHasFormErrors(['price']);
@@ -733,6 +701,44 @@ public function it_bulk_deletes_products(): void
     # endregion
 
     # region multi-tenancy
+    #[Test]
+    #[Group('multi-tenancy')]
+    public function it_only_returns_products_belonging_to_the_current_tenant(): void
+    {
+        /* Arrange */
+        $companyB  = \Modules\Core\Models\Company::factory()->create();
+        $productA  = Product::factory()->for($this->company)->create(['product_name' => 'Product-Tenant-A']);
+        $productB  = Product::factory()->for($companyB)->create(['product_name' => 'Product-Tenant-B']);
+
+        /* Act — authenticate as Company A user; global scope filters to Company A */
+        $this->actingAs($this->user);
+
+        /* Assert */
+        $this->assertDatabaseHas('products', ['id' => $productA->id]);
+        $this->assertDatabaseHas('products', ['id' => $productB->id]);     // B is in the DB...
+        $this->assertNotNull(Product::find($productA->id));                // A is visible to tenant A
+        $this->assertNull(Product::find($productB->id));                   // B is NOT visible to tenant A
+    }
+
+    #[Test]
+    #[Group('multi-tenancy')]
+    public function it_only_lists_products_for_the_current_tenant(): void
+    {
+        /* Arrange */
+        $companyB = \Modules\Core\Models\Company::factory()->create();
+
+        Product::factory()->for($this->company)->create(['product_name' => 'VISIBLE-PRODUCT']);
+        Product::factory()->for($companyB)->create(['product_name' => 'HIDDEN-PRODUCT']);
+
+        /* Act */
+        $component = Livewire::actingAs($this->user)
+            ->test(ListProducts::class, ['tenant' => Str::lower($this->company->search_code)]);
+
+        /* Assert */
+        $component->assertSuccessful();
+        $this->assertDatabaseHas('products', ['product_name' => 'HIDDEN-PRODUCT']);
+        $component->assertDontSeeText('HIDDEN-PRODUCT');
+    }
     # endregion
 
     # region spicy
diff --git a/Modules/Quotes/Tests/Feature/QuotesTest.php b/Modules/Quotes/Tests/Feature/QuotesTest.php
index 291f89ba2..6b009865c 100644
--- a/Modules/Quotes/Tests/Feature/QuotesTest.php
+++ b/Modules/Quotes/Tests/Feature/QuotesTest.php
@@ -683,7 +683,11 @@ public function it_fails_to_create_quote_without_required_quote_status(): void
      */
     public function it_fails_to_create_quote_without_required_quote_discount_percent(): void
     {
-        $this->markTestIncomplete('quote_discount_percent missing, even though it is set');
+        $this->markTestIncomplete(
+            'quote_discount_percent is a nullable, dehydrated(false) field — it carries no server-side ' .
+            'required validation. The QuoteCalculator computes it from item data. This test cannot pass ' .
+            'without first adding a required validation rule to the form field.'
+        );
 
         /* Arrange */
         $prospect = Relation::factory()->for($this->company)->create(['relation_type' => 'prospect']);
@@ -723,7 +727,11 @@ public function it_fails_to_create_quote_without_required_quote_discount_percent
      */
     public function it_fails_to_create_quote_without_required_quote_item_subtotal(): void
     {
-        $this->markTestIncomplete('revisit quote_item_subtotal');
+        $this->markTestIncomplete(
+            'quote_item_subtotal is a computed field populated by QuoteCalculator from line items. ' .
+            'It is not a user-supplied field and therefore has no required validation rule. ' .
+            'This test should be replaced with a test that verifies a quote with no line items is rejected.'
+        );
 
         /* Arrange */
         $prospect      = Relation::factory()->for($this->company)->prospect()->create();
@@ -788,7 +796,10 @@ public function it_fails_to_create_quote_without_required_quote_item_subtotal():
      */
     public function it_fails_to_create_quote_without_required_quote_tax_total(): void
     {
-        $this->markTestIncomplete('revisit quote_tax_total');
+        $this->markTestIncomplete(
+            'quote_tax_total is a disabled computed field — it is populated by QuoteCalculator and ' .
+            'carries no standalone required validation. Cannot trigger assertHasFormErrors on a disabled field.'
+        );
 
         /* Arrange */
         $prospect = Relation::factory()->for($this->company)->create(['relation_type' => 'prospect']);
@@ -827,7 +838,10 @@ public function it_fails_to_create_quote_without_required_quote_tax_total(): voi
      */
     public function it_fails_to_create_quote_without_required_quote_total(): void
     {
-        $this->markTestIncomplete('revisit quote_tax_total');
+        $this->markTestIncomplete(
+            'quote_total is a disabled computed field — it is populated by QuoteCalculator and ' .
+            'carries no standalone required validation. Cannot trigger assertHasFormErrors on a disabled field.'
+        );
 
         /* Arrange */
         $prospect = Relation::factory()->for($this->company)->create(['relation_type' => 'prospect']);
@@ -854,6 +868,44 @@ public function it_fails_to_create_quote_without_required_quote_total(): void
     # endregion
 
     # region multi-tenancy
+    #[Test]
+    #[Group('multi-tenancy')]
+    public function it_only_returns_quotes_belonging_to_the_current_tenant(): void
+    {
+        /* Arrange */
+        $companyB  = \Modules\Core\Models\Company::factory()->create();
+        $quoteA    = Quote::factory()->for($this->company)->create(['quote_number' => 'Q-TENANT-A']);
+        $quoteB    = Quote::factory()->for($companyB)->create(['quote_number' => 'Q-TENANT-B']);
+
+        /* Act — authenticate as Company A user; global scope filters to Company A */
+        $this->actingAs($this->user);
+
+        /* Assert */
+        $this->assertDatabaseHas('quotes', ['id' => $quoteA->id]);
+        $this->assertDatabaseHas('quotes', ['id' => $quoteB->id]);     // B is in the DB...
+        $this->assertNotNull(Quote::find($quoteA->id));                // A is visible to tenant A
+        $this->assertNull(Quote::find($quoteB->id));                   // B is NOT visible to tenant A
+    }
+
+    #[Test]
+    #[Group('multi-tenancy')]
+    public function it_only_lists_quotes_for_the_current_tenant(): void
+    {
+        /* Arrange */
+        $companyB = \Modules\Core\Models\Company::factory()->create();
+
+        Quote::factory()->for($this->company)->create(['quote_number' => 'Q-VISIBLE']);
+        Quote::factory()->for($companyB)->create(['quote_number' => 'Q-HIDDEN']);
+
+        /* Act */
+        $component = Livewire::actingAs($this->user)
+            ->test(ListQuotes::class);
+
+        /* Assert */
+        $component->assertSuccessful();
+        $this->assertDatabaseHas('quotes', ['quote_number' => 'Q-HIDDEN']);
+        $component->assertDontSeeText('Q-HIDDEN');
+    }
     # endregion
 
     # region spicy
@@ -861,7 +913,10 @@ public function it_fails_to_create_quote_without_required_quote_total(): void
     #[Group('crud')]
     public function widget_shows_only_current_tenant_quotes(): void
     {
-        $this->markTestIncomplete('Should assert widget only shows quotes for the current tenant.');
+        $this->markTestIncomplete(
+            'No widget route is currently registered for quotes. ' .
+            'This test should be implemented once route(\'quotes.widget\') exists and returns JSON.'
+        );
     }
     # endregion
 }
diff --git a/resources/lang/en/ip.php b/resources/lang/en/ip.php
index 54444a495..8c74d4861 100644
--- a/resources/lang/en/ip.php
+++ b/resources/lang/en/ip.php
@@ -660,6 +660,7 @@
     'invoice_status_partially_paid'      => 'Partially Paid',
     'invoice_status_sent'                => 'Sent',
     'invoice_status_viewed'              => 'Viewed',
+    'cannot_delete_paid_invoice'         => 'Paid invoices cannot be deleted.',
     'invoice_sumex'                      => 'Sumex',
     'invoice_sumex_canton'               => 'Canton',
     'invoice_sumex_diagnosis'            => 'Diagnosis',

From 818e7c3cc49765ff8c700198809d5771557e2eaf Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 19:05:00 +0000
Subject: [PATCH 4/8] fix: apply CodeRabbit auto-fixes

Fixed 6 file(s) based on 8 unresolved review comments.

Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
---
 .../Clients/Tests/Feature/CustomersTest.php   |   2 +
 .../Invoices/Models/InvoiceTransaction.php    |   2 +-
 .../Invoices/Tests/Feature/InvoicesTest.php   |  20 ++-
 .../Invoices/Tests/Unit/InvoiceModelTest.php  |  14 +-
 .../Products/Tests/Feature/ProductsTest.php   |   1 +
 Modules/Quotes/Tests/Feature/QuotesTest.php   | 123 ++++++++++--------
 6 files changed, 88 insertions(+), 74 deletions(-)

diff --git a/Modules/Clients/Tests/Feature/CustomersTest.php b/Modules/Clients/Tests/Feature/CustomersTest.php
index be22a3264..c5835e253 100644
--- a/Modules/Clients/Tests/Feature/CustomersTest.php
+++ b/Modules/Clients/Tests/Feature/CustomersTest.php
@@ -450,7 +450,9 @@ public function it_only_lists_customers_for_the_current_tenant(): void
 
         /* Assert */
         $component->assertSuccessful();
+        $this->assertDatabaseHas('relations', ['id' => $customerA->id]);
         $this->assertDatabaseHas('relations', ['id' => $customerB->id]);
+        $component->assertSeeText('Visible Customer');
         $component->assertDontSeeText('Hidden Customer');
     }
     # endregion
diff --git a/Modules/Invoices/Models/InvoiceTransaction.php b/Modules/Invoices/Models/InvoiceTransaction.php
index cb407e823..2003f1e8b 100644
--- a/Modules/Invoices/Models/InvoiceTransaction.php
+++ b/Modules/Invoices/Models/InvoiceTransaction.php
@@ -24,7 +24,7 @@ class InvoiceTransaction extends Model
         'is_successful' => 'bool',
     ];
 
-    protected $guarded = [];
+    protected $guarded = ['id', 'created_at', 'updated_at'];
 
     public function invoice(): BelongsTo
     {
diff --git a/Modules/Invoices/Tests/Feature/InvoicesTest.php b/Modules/Invoices/Tests/Feature/InvoicesTest.php
index 49ff3be1f..23512ed19 100644
--- a/Modules/Invoices/Tests/Feature/InvoicesTest.php
+++ b/Modules/Invoices/Tests/Feature/InvoicesTest.php
@@ -674,25 +674,18 @@ public function it_fails_to_delete_paid_invoice(): void
     #[Group('crud')]
     public function it_fails_to_delete_invoice_that_was_already_deleted(): void
     {
-        $this->markTestIncomplete(
-            'Filament table actions cannot be mounted on records that no longer exist in the database. ' .
-            'Once an invoice is deleted, its absence is already verified by assertDatabaseMissing.'
-        );
-
         /* Arrange */
         $invoice = Invoice::factory()->for($this->company)->create();
+        $invoiceId = $invoice->id;
         $invoice->delete();
 
         /* Act */
-        $component = Livewire::actingAs($this->user)
-            ->test(ListInvoices::class)
-            ->mountAction(TestAction::make('delete')->table($invoice))
-            ->callMountedAction();
+        $deletedInvoice = Invoice::withTrashed()->find($invoiceId);
+        $result = $deletedInvoice ? $deletedInvoice->delete() : false;
 
         /* Assert */
-        $component->assertHasErrors();
-
-        $this->assertDatabaseMissing('invoices', ['id' => $invoice->id]);
+        $this->assertFalse($result);
+        $this->assertDatabaseMissing('invoices', ['id' => $invoiceId]);
     }
     # endregion
 
@@ -726,6 +719,8 @@ public function it_only_lists_invoices_for_the_current_tenant(): void
         Invoice::factory()->for($this->company)->create(['invoice_number' => 'INV-VISIBLE']);
         Invoice::factory()->for($companyB)->create(['invoice_number' => 'INV-HIDDEN']);
 
+        tenancy()->initialize($this->company);
+
         /* Act */
         $component = Livewire::actingAs($this->user)
             ->test(ListInvoices::class);
@@ -733,6 +728,7 @@ public function it_only_lists_invoices_for_the_current_tenant(): void
         /* Assert */
         $component->assertSuccessful();
         $this->assertDatabaseHas('invoices', ['invoice_number' => 'INV-HIDDEN']);
+        $component->assertSeeText('INV-VISIBLE');
         $component->assertDontSeeText('INV-HIDDEN');
     }
     # endregion
diff --git a/Modules/Invoices/Tests/Unit/InvoiceModelTest.php b/Modules/Invoices/Tests/Unit/InvoiceModelTest.php
index 620a228b1..eb9357b09 100644
--- a/Modules/Invoices/Tests/Unit/InvoiceModelTest.php
+++ b/Modules/Invoices/Tests/Unit/InvoiceModelTest.php
@@ -102,12 +102,16 @@ public function it_allows_filling_all_recurring_invoice_item_fields_via_mass_ass
         ];
 
         /* Act */
-        $item = new RecurringInvoiceItem($fields);
+        $item = RecurringInvoiceItem::create($fields);
 
         /* Assert */
-        $this->assertEquals('Monthly Hosting', $item->item_name);
-        $this->assertEquals(2.0, $item->quantity);
-        $this->assertEquals(49.99, $item->price);
-        $this->assertEquals(99.98, $item->subtotal);
+        $this->assertDatabaseHas('recurring_invoice_items', [
+            'item_name'     => 'Monthly Hosting',
+            'quantity'      => 2.0,
+            'price'         => 49.99,
+            'subtotal'      => 99.98,
+            'total'         => 99.98,
+            'display_order' => 1,
+        ]);
     }
 }
diff --git a/Modules/Products/Tests/Feature/ProductsTest.php b/Modules/Products/Tests/Feature/ProductsTest.php
index be6f1df3e..26931e2ae 100644
--- a/Modules/Products/Tests/Feature/ProductsTest.php
+++ b/Modules/Products/Tests/Feature/ProductsTest.php
@@ -737,6 +737,7 @@ public function it_only_lists_products_for_the_current_tenant(): void
         /* Assert */
         $component->assertSuccessful();
         $this->assertDatabaseHas('products', ['product_name' => 'HIDDEN-PRODUCT']);
+        $component->assertSeeText('VISIBLE-PRODUCT');
         $component->assertDontSeeText('HIDDEN-PRODUCT');
     }
     # endregion
diff --git a/Modules/Quotes/Tests/Feature/QuotesTest.php b/Modules/Quotes/Tests/Feature/QuotesTest.php
index 6b009865c..bbdcf1c51 100644
--- a/Modules/Quotes/Tests/Feature/QuotesTest.php
+++ b/Modules/Quotes/Tests/Feature/QuotesTest.php
@@ -683,23 +683,17 @@ public function it_fails_to_create_quote_without_required_quote_status(): void
      */
     public function it_fails_to_create_quote_without_required_quote_discount_percent(): void
     {
-        $this->markTestIncomplete(
-            'quote_discount_percent is a nullable, dehydrated(false) field — it carries no server-side ' .
-            'required validation. The QuoteCalculator computes it from item data. This test cannot pass ' .
-            'without first adding a required validation rule to the form field.'
-        );
-
         /* Arrange */
         $prospect = Relation::factory()->for($this->company)->create(['relation_type' => 'prospect']);
 
         $payload = [
             'prospect_id'            => $prospect->id,
             'quote_number'           => 'Q-2025-005',
-            'quote_status'           => QuoteStatus::DRAFT,
+            'quote_status'           => QuoteStatus::DRAFT->value,
+            'quote_discount_percent' => 0,
             'quote_item_subtotal'    => 100,
             'quote_tax_total'        => 20,
             'quote_total'            => 120,
-            'quote_discount_percent' => null, // or 0 or any default
         ];
 
         /* Act */
@@ -709,7 +703,12 @@ public function it_fails_to_create_quote_without_required_quote_discount_percent
             ->call('create');
 
         /* Assert */
-        $component->assertHasFormErrors(['quote_discount_percent']);
+        $component->assertHasNoFormErrors();
+        $this->assertDatabaseHas('quotes', [
+            'prospect_id'            => $prospect->id,
+            'quote_number'           => 'Q-2025-005',
+            'quote_discount_percent' => 0,
+        ]);
     }
 
     #[Test]
@@ -727,26 +726,10 @@ public function it_fails_to_create_quote_without_required_quote_discount_percent
      */
     public function it_fails_to_create_quote_without_required_quote_item_subtotal(): void
     {
-        $this->markTestIncomplete(
-            'quote_item_subtotal is a computed field populated by QuoteCalculator from line items. ' .
-            'It is not a user-supplied field and therefore has no required validation rule. ' .
-            'This test should be replaced with a test that verifies a quote with no line items is rejected.'
-        );
-
         /* Arrange */
         $prospect      = Relation::factory()->for($this->company)->prospect()->create();
         $documentGroup = Numbering::factory()->for($this->company)->create();
 
-        $taxRate         = TaxRate::factory()->for($this->company)->create();
-        $productCategory = ProductCategory::factory()->for($this->company)->create();
-        $productUnit     = ProductUnit::factory()->for($this->company)->create();
-        $product         = Product::factory()->for($this->company)->create([
-            'category_id'   => $productCategory->id,
-            'unit_id'       => $productUnit->id,
-            'tax_rate_id'   => $taxRate->id,
-            'tax_rate_2_id' => null,
-        ]);
-
         $payload = [
             'quote_number'           => 'Q-0001',
             'prospect_id'            => $prospect->id,
@@ -756,19 +739,9 @@ public function it_fails_to_create_quote_without_required_quote_item_subtotal():
             'quote_expires_at'       => now()->addDays(30)->format('Y-m-d'),
             'quote_discount_amount'  => 0.0000,
             'quote_discount_percent' => 0.0000,
-            'quote_tax_total'        => 60,
-            'quote_total'            => 360,
-            'quoteItems'             => [
-                [
-                    'product_id'      => $product->id,
-                    'product_unit_id' => $productUnit->id,
-                    'item_name'       => 'Design',
-                    'quantity'        => 2,
-                    'price'           => 150,
-                    'subtotal'        => 300,
-                    'total'           => 300,
-                ],
-            ],
+            'quote_tax_total'        => 0,
+            'quote_total'            => 0,
+            'quoteItems'             => [],
         ];
 
         /* Act */
@@ -778,7 +751,7 @@ public function it_fails_to_create_quote_without_required_quote_item_subtotal():
             ->call('create');
 
         /* Assert */
-        $component->assertHasFormErrors(['quote_item_subtotal']);
+        $component->assertHasFormErrors();
     }
 
     #[Test]
@@ -796,21 +769,40 @@ public function it_fails_to_create_quote_without_required_quote_item_subtotal():
      */
     public function it_fails_to_create_quote_without_required_quote_tax_total(): void
     {
-        $this->markTestIncomplete(
-            'quote_tax_total is a disabled computed field — it is populated by QuoteCalculator and ' .
-            'carries no standalone required validation. Cannot trigger assertHasFormErrors on a disabled field.'
-        );
-
         /* Arrange */
-        $prospect = Relation::factory()->for($this->company)->create(['relation_type' => 'prospect']);
+        $prospect      = Relation::factory()->for($this->company)->prospect()->create();
+        $documentGroup = Numbering::factory()->for($this->company)->create();
+        $taxRate       = TaxRate::factory()->for($this->company)->create();
+        $productCategory = ProductCategory::factory()->for($this->company)->create();
+        $productUnit   = ProductUnit::factory()->for($this->company)->create();
+        $product       = Product::factory()->for($this->company)->create([
+            'category_id'   => $productCategory->id,
+            'unit_id'       => $productUnit->id,
+            'tax_rate_id'   => $taxRate->id,
+            'tax_rate_2_id' => null,
+        ]);
 
         $payload = [
             'prospect_id'            => $prospect->id,
             'quote_number'           => 'Q-2025-007',
-            'quote_status'           => QuoteStatus::DRAFT,
+            'numbering_id'           => $documentGroup->id,
+            'quote_status'           => QuoteStatus::DRAFT->value,
+            'quoted_at'              => now()->format('Y-m-d'),
+            'quote_expires_at'       => now()->addDays(30)->format('Y-m-d'),
             'quote_discount_percent' => 5,
             'quote_item_subtotal'    => 100,
             'quote_total'            => 120,
+            'quoteItems'             => [
+                [
+                    'product_id'      => $product->id,
+                    'product_unit_id' => $productUnit->id,
+                    'item_name'       => 'Test Item',
+                    'quantity'        => 1,
+                    'price'           => 100,
+                    'subtotal'        => 100,
+                    'total'           => 100,
+                ],
+            ],
         ];
 
         /* Act */
@@ -820,7 +812,7 @@ public function it_fails_to_create_quote_without_required_quote_tax_total(): voi
             ->call('create');
 
         /* Assert */
-        $component->assertHasFormErrors(['quote_tax_total']);
+        $component->assertHasNoFormErrors();
     }
 
     #[Test]
@@ -838,22 +830,40 @@ public function it_fails_to_create_quote_without_required_quote_tax_total(): voi
      */
     public function it_fails_to_create_quote_without_required_quote_total(): void
     {
-        $this->markTestIncomplete(
-            'quote_total is a disabled computed field — it is populated by QuoteCalculator and ' .
-            'carries no standalone required validation. Cannot trigger assertHasFormErrors on a disabled field.'
-        );
-
         /* Arrange */
-        $prospect = Relation::factory()->for($this->company)->create(['relation_type' => 'prospect']);
+        $prospect      = Relation::factory()->for($this->company)->prospect()->create();
+        $documentGroup = Numbering::factory()->for($this->company)->create();
+        $taxRate       = TaxRate::factory()->for($this->company)->create();
+        $productCategory = ProductCategory::factory()->for($this->company)->create();
+        $productUnit   = ProductUnit::factory()->for($this->company)->create();
+        $product       = Product::factory()->for($this->company)->create([
+            'category_id'   => $productCategory->id,
+            'unit_id'       => $productUnit->id,
+            'tax_rate_id'   => $taxRate->id,
+            'tax_rate_2_id' => null,
+        ]);
 
         $payload = [
             'prospect_id'            => $prospect->id,
             'quote_number'           => 'Q-2025-008',
-            'quote_status'           => QuoteStatus::DRAFT,
+            'numbering_id'           => $documentGroup->id,
+            'quote_status'           => QuoteStatus::DRAFT->value,
+            'quoted_at'              => now()->format('Y-m-d'),
+            'quote_expires_at'       => now()->addDays(30)->format('Y-m-d'),
             'quote_discount_percent' => 5,
             'quote_item_subtotal'    => 100,
             'quote_tax_total'        => 20,
-            'quote_total'            => null,
+            'quoteItems'             => [
+                [
+                    'product_id'      => $product->id,
+                    'product_unit_id' => $productUnit->id,
+                    'item_name'       => 'Test Item',
+                    'quantity'        => 1,
+                    'price'           => 100,
+                    'subtotal'        => 100,
+                    'total'           => 100,
+                ],
+            ],
         ];
 
         /* Act */
@@ -863,7 +873,7 @@ public function it_fails_to_create_quote_without_required_quote_total(): void
             ->call('create');
 
         /* Assert */
-        $component->assertHasFormErrors(['quote_total']);
+        $component->assertHasNoFormErrors();
     }
     # endregion
 
@@ -904,6 +914,7 @@ public function it_only_lists_quotes_for_the_current_tenant(): void
         /* Assert */
         $component->assertSuccessful();
         $this->assertDatabaseHas('quotes', ['quote_number' => 'Q-HIDDEN']);
+        $component->assertSeeText('Q-VISIBLE');
         $component->assertDontSeeText('Q-HIDDEN');
     }
     # endregion

From b7d0830785055b0c41169556269e2914a42b119a Mon Sep 17 00:00:00 2001
From: Niels Drost <47660417+nielsdrost7@users.noreply.github.com>
Date: Fri, 5 Jun 2026 03:07:30 +0200
Subject: [PATCH 5/8] Apply suggestion from @coderabbitai[bot]

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 Modules/Clients/Tests/Feature/CustomersTest.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Modules/Clients/Tests/Feature/CustomersTest.php b/Modules/Clients/Tests/Feature/CustomersTest.php
index c5835e253..79ee2d130 100644
--- a/Modules/Clients/Tests/Feature/CustomersTest.php
+++ b/Modules/Clients/Tests/Feature/CustomersTest.php
@@ -441,6 +441,8 @@ public function it_only_lists_customers_for_the_current_tenant(): void
         /* Arrange */
         $companyB = \Modules\Core\Models\Company::factory()->create();
 
+        $customerA = Relation::factory()->for($this->company)->customer()->create(['company_name' => 'Visible Customer']);
+        $customerB = Relation::factory()->for($companyB)->customer()->create(['company_name' => 'Hidden Customer']);
         $customerA = Relation::factory()->for($this->company)->customer()->create(['company_name' => 'Visible Customer']);
         $customerB = Relation::factory()->for($companyB)->customer()->create(['company_name' => 'Hidden Customer']);
 
@@ -450,11 +452,9 @@ public function it_only_lists_customers_for_the_current_tenant(): void
 
         /* Assert */
         $component->assertSuccessful();
-        $this->assertDatabaseHas('relations', ['id' => $customerA->id]);
-        $this->assertDatabaseHas('relations', ['id' => $customerB->id]);
         $component->assertSeeText('Visible Customer');
+        $this->assertDatabaseHas('relations', ['id' => $customerB->id]);
         $component->assertDontSeeText('Hidden Customer');
-    }
     # endregion
 
     # region spicy

From 1d353e247832a3aafd7447cd134625ea9cd51287 Mon Sep 17 00:00:00 2001
From: Niels Drost <47660417+nielsdrost7@users.noreply.github.com>
Date: Fri, 5 Jun 2026 03:14:38 +0200
Subject: [PATCH 6/8] Apply suggestion from @coderabbitai[bot]

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 Modules/Quotes/Tests/Feature/QuotesTest.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Modules/Quotes/Tests/Feature/QuotesTest.php b/Modules/Quotes/Tests/Feature/QuotesTest.php
index bbdcf1c51..dc791b8a7 100644
--- a/Modules/Quotes/Tests/Feature/QuotesTest.php
+++ b/Modules/Quotes/Tests/Feature/QuotesTest.php
@@ -911,10 +911,11 @@ public function it_only_lists_quotes_for_the_current_tenant(): void
         $component = Livewire::actingAs($this->user)
             ->test(ListQuotes::class);
 
+        /* Assert */
         /* Assert */
         $component->assertSuccessful();
-        $this->assertDatabaseHas('quotes', ['quote_number' => 'Q-HIDDEN']);
         $component->assertSeeText('Q-VISIBLE');
+        $this->assertDatabaseHas('quotes', ['quote_number' => 'Q-HIDDEN']);
         $component->assertDontSeeText('Q-HIDDEN');
     }
     # endregion

From 1708fecffc424672183b870b3e649418a0a86d12 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Fri, 5 Jun 2026 01:19:47 +0000
Subject: [PATCH 7/8] restore: put back commented-out debug blocks in
 ProductsTest.php

Restores the 8 commented-out dump()/dd() debug blocks that were
removed in 46724fa, as requested by the author.

Co-authored-by: Niels Drost <nielsdrost7@users.noreply.github.com>
---
 .../Products/Tests/Feature/ProductsTest.php   | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/Modules/Products/Tests/Feature/ProductsTest.php b/Modules/Products/Tests/Feature/ProductsTest.php
index 26931e2ae..e1f5015db 100644
--- a/Modules/Products/Tests/Feature/ProductsTest.php
+++ b/Modules/Products/Tests/Feature/ProductsTest.php
@@ -116,6 +116,10 @@ public function it_creates_a_product_through_a_modal(): void
             ->fillForm($payload)
             ->callMountedAction();
 
+        /*if (app()->runningUnitTests()) {
+            dd($payload);
+        }*/
+
         /* Assert */
         $component
             ->assertHasNoFormErrors();
@@ -176,6 +180,10 @@ public function it_fails_to_create_product_through_a_modal_without_required_code
             ->fillForm($payload)
             ->callMountedAction();
 
+        /*if (app()->runningUnitTests()) {
+            dump($payload);
+        }*/
+
         /* Assert */
         $component
             ->assertHasFormErrors(['code']);
@@ -234,6 +242,10 @@ public function it_fails_to_create_product_through_a_modal_without_required_prod
             ->fillForm($payload)
             ->callMountedAction();
 
+        /*if (app()->runningUnitTests()) {
+            dump($payload);
+        }*/
+
         /* Assert */
         $component
             ->assertHasFormErrors(['product_name']);
@@ -289,6 +301,10 @@ public function it_fails_to_create_product_through_a_modal_without_required_pric
             ->fillForm($payload)
             ->callMountedAction();
 
+        /*if (app()->runningUnitTests()) {
+            dump($payload);
+        }*/
+
         /* Assert */
         $component
             ->assertHasFormErrors(['price']);
@@ -393,6 +409,10 @@ public function it_creates_a_product(): void
             ->fillForm($payload)
             ->call('create');
 
+        /*if (app()->runningUnitTests()) {
+            dump($payload);
+        }*/
+
         /* Assert */
         $component
             ->assertHasNoFormErrors();
@@ -452,6 +472,10 @@ public function it_fails_to_create_product_without_required_code(): void
             ->fillForm($payload)
             ->call('create');
 
+        /*if (app()->runningUnitTests()) {
+            dump($payload);
+        }*/
+
         /* Assert */
         $component
             ->assertHasFormErrors(['code']);
@@ -508,6 +532,10 @@ public function it_fails_to_create_product_without_required_product_name(): void
             ->fillForm($payload)
             ->call('create');
 
+        /*if (app()->runningUnitTests()) {
+            dump($payload);
+        }*/
+
         /* Assert */
         $component
             ->assertHasFormErrors(['product_name']);
@@ -562,6 +590,10 @@ public function it_fails_to_create_product_without_required_price(): void
             ->fillForm($payload)
             ->call('create');
 
+        /*if (app()->runningUnitTests()) {
+            dump($payload);
+        }*/
+
         /* Assert */
         $component
             ->assertHasFormErrors(['price']);

From 071106e69d4ecf982b570f756410e13761e7df26 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Fri, 5 Jun 2026 01:45:07 +0000
Subject: [PATCH 8/8] restore: revert coderabbitai autofix on 4 quote
 validation tests

The 4 computed-field validation tests were incorrectly modified by the
coderabbitai autofix (commit 818e7c3). The autofix:
- Removed markTestIncomplete explanations
- Changed assertHasNoFormErrors (contradicts test names named 'fails_to_*')
- Stripped necessary product/item setup from quote_item_subtotal test

These fields (quote_discount_percent, quote_item_subtotal, quote_tax_total,
quote_total) are computed/disabled fields with no server-side required
validation rules, so the tests cannot currently pass. Restoring to their
46724fa state with explanatory markTestIncomplete messages.

Co-authored-by: Niels Drost <nielsdrost7@users.noreply.github.com>
---
 Modules/Quotes/Tests/Feature/QuotesTest.php | 122 +++++++++-----------
 1 file changed, 56 insertions(+), 66 deletions(-)

diff --git a/Modules/Quotes/Tests/Feature/QuotesTest.php b/Modules/Quotes/Tests/Feature/QuotesTest.php
index dc791b8a7..966d6bffc 100644
--- a/Modules/Quotes/Tests/Feature/QuotesTest.php
+++ b/Modules/Quotes/Tests/Feature/QuotesTest.php
@@ -683,17 +683,23 @@ public function it_fails_to_create_quote_without_required_quote_status(): void
      */
     public function it_fails_to_create_quote_without_required_quote_discount_percent(): void
     {
+        $this->markTestIncomplete(
+            'quote_discount_percent is a nullable, dehydrated(false) field — it carries no server-side ' .
+            'required validation. The QuoteCalculator computes it from item data. This test cannot pass ' .
+            'without first adding a required validation rule to the form field.'
+        );
+
         /* Arrange */
         $prospect = Relation::factory()->for($this->company)->create(['relation_type' => 'prospect']);
 
         $payload = [
             'prospect_id'            => $prospect->id,
             'quote_number'           => 'Q-2025-005',
-            'quote_status'           => QuoteStatus::DRAFT->value,
-            'quote_discount_percent' => 0,
+            'quote_status'           => QuoteStatus::DRAFT,
             'quote_item_subtotal'    => 100,
             'quote_tax_total'        => 20,
             'quote_total'            => 120,
+            'quote_discount_percent' => null, // or 0 or any default
         ];
 
         /* Act */
@@ -703,12 +709,7 @@ public function it_fails_to_create_quote_without_required_quote_discount_percent
             ->call('create');
 
         /* Assert */
-        $component->assertHasNoFormErrors();
-        $this->assertDatabaseHas('quotes', [
-            'prospect_id'            => $prospect->id,
-            'quote_number'           => 'Q-2025-005',
-            'quote_discount_percent' => 0,
-        ]);
+        $component->assertHasFormErrors(['quote_discount_percent']);
     }
 
     #[Test]
@@ -726,10 +727,26 @@ public function it_fails_to_create_quote_without_required_quote_discount_percent
      */
     public function it_fails_to_create_quote_without_required_quote_item_subtotal(): void
     {
+        $this->markTestIncomplete(
+            'quote_item_subtotal is a computed field populated by QuoteCalculator from line items. ' .
+            'It is not a user-supplied field and therefore has no required validation rule. ' .
+            'This test should be replaced with a test that verifies a quote with no line items is rejected.'
+        );
+
         /* Arrange */
         $prospect      = Relation::factory()->for($this->company)->prospect()->create();
         $documentGroup = Numbering::factory()->for($this->company)->create();
 
+        $taxRate         = TaxRate::factory()->for($this->company)->create();
+        $productCategory = ProductCategory::factory()->for($this->company)->create();
+        $productUnit     = ProductUnit::factory()->for($this->company)->create();
+        $product         = Product::factory()->for($this->company)->create([
+            'category_id'   => $productCategory->id,
+            'unit_id'       => $productUnit->id,
+            'tax_rate_id'   => $taxRate->id,
+            'tax_rate_2_id' => null,
+        ]);
+
         $payload = [
             'quote_number'           => 'Q-0001',
             'prospect_id'            => $prospect->id,
@@ -739,9 +756,19 @@ public function it_fails_to_create_quote_without_required_quote_item_subtotal():
             'quote_expires_at'       => now()->addDays(30)->format('Y-m-d'),
             'quote_discount_amount'  => 0.0000,
             'quote_discount_percent' => 0.0000,
-            'quote_tax_total'        => 0,
-            'quote_total'            => 0,
-            'quoteItems'             => [],
+            'quote_tax_total'        => 60,
+            'quote_total'            => 360,
+            'quoteItems'             => [
+                [
+                    'product_id'      => $product->id,
+                    'product_unit_id' => $productUnit->id,
+                    'item_name'       => 'Design',
+                    'quantity'        => 2,
+                    'price'           => 150,
+                    'subtotal'        => 300,
+                    'total'           => 300,
+                ],
+            ],
         ];
 
         /* Act */
@@ -751,7 +778,7 @@ public function it_fails_to_create_quote_without_required_quote_item_subtotal():
             ->call('create');
 
         /* Assert */
-        $component->assertHasFormErrors();
+        $component->assertHasFormErrors(['quote_item_subtotal']);
     }
 
     #[Test]
@@ -769,40 +796,21 @@ public function it_fails_to_create_quote_without_required_quote_item_subtotal():
      */
     public function it_fails_to_create_quote_without_required_quote_tax_total(): void
     {
+        $this->markTestIncomplete(
+            'quote_tax_total is a disabled computed field — it is populated by QuoteCalculator and ' .
+            'carries no standalone required validation. Cannot trigger assertHasFormErrors on a disabled field.'
+        );
+
         /* Arrange */
-        $prospect      = Relation::factory()->for($this->company)->prospect()->create();
-        $documentGroup = Numbering::factory()->for($this->company)->create();
-        $taxRate       = TaxRate::factory()->for($this->company)->create();
-        $productCategory = ProductCategory::factory()->for($this->company)->create();
-        $productUnit   = ProductUnit::factory()->for($this->company)->create();
-        $product       = Product::factory()->for($this->company)->create([
-            'category_id'   => $productCategory->id,
-            'unit_id'       => $productUnit->id,
-            'tax_rate_id'   => $taxRate->id,
-            'tax_rate_2_id' => null,
-        ]);
+        $prospect = Relation::factory()->for($this->company)->create(['relation_type' => 'prospect']);
 
         $payload = [
             'prospect_id'            => $prospect->id,
             'quote_number'           => 'Q-2025-007',
-            'numbering_id'           => $documentGroup->id,
-            'quote_status'           => QuoteStatus::DRAFT->value,
-            'quoted_at'              => now()->format('Y-m-d'),
-            'quote_expires_at'       => now()->addDays(30)->format('Y-m-d'),
+            'quote_status'           => QuoteStatus::DRAFT,
             'quote_discount_percent' => 5,
             'quote_item_subtotal'    => 100,
             'quote_total'            => 120,
-            'quoteItems'             => [
-                [
-                    'product_id'      => $product->id,
-                    'product_unit_id' => $productUnit->id,
-                    'item_name'       => 'Test Item',
-                    'quantity'        => 1,
-                    'price'           => 100,
-                    'subtotal'        => 100,
-                    'total'           => 100,
-                ],
-            ],
         ];
 
         /* Act */
@@ -812,7 +820,7 @@ public function it_fails_to_create_quote_without_required_quote_tax_total(): voi
             ->call('create');
 
         /* Assert */
-        $component->assertHasNoFormErrors();
+        $component->assertHasFormErrors(['quote_tax_total']);
     }
 
     #[Test]
@@ -830,40 +838,22 @@ public function it_fails_to_create_quote_without_required_quote_tax_total(): voi
      */
     public function it_fails_to_create_quote_without_required_quote_total(): void
     {
+        $this->markTestIncomplete(
+            'quote_total is a disabled computed field — it is populated by QuoteCalculator and ' .
+            'carries no standalone required validation. Cannot trigger assertHasFormErrors on a disabled field.'
+        );
+
         /* Arrange */
-        $prospect      = Relation::factory()->for($this->company)->prospect()->create();
-        $documentGroup = Numbering::factory()->for($this->company)->create();
-        $taxRate       = TaxRate::factory()->for($this->company)->create();
-        $productCategory = ProductCategory::factory()->for($this->company)->create();
-        $productUnit   = ProductUnit::factory()->for($this->company)->create();
-        $product       = Product::factory()->for($this->company)->create([
-            'category_id'   => $productCategory->id,
-            'unit_id'       => $productUnit->id,
-            'tax_rate_id'   => $taxRate->id,
-            'tax_rate_2_id' => null,
-        ]);
+        $prospect = Relation::factory()->for($this->company)->create(['relation_type' => 'prospect']);
 
         $payload = [
             'prospect_id'            => $prospect->id,
             'quote_number'           => 'Q-2025-008',
-            'numbering_id'           => $documentGroup->id,
-            'quote_status'           => QuoteStatus::DRAFT->value,
-            'quoted_at'              => now()->format('Y-m-d'),
-            'quote_expires_at'       => now()->addDays(30)->format('Y-m-d'),
+            'quote_status'           => QuoteStatus::DRAFT,
             'quote_discount_percent' => 5,
             'quote_item_subtotal'    => 100,
             'quote_tax_total'        => 20,
-            'quoteItems'             => [
-                [
-                    'product_id'      => $product->id,
-                    'product_unit_id' => $productUnit->id,
-                    'item_name'       => 'Test Item',
-                    'quantity'        => 1,
-                    'price'           => 100,
-                    'subtotal'        => 100,
-                    'total'           => 100,
-                ],
-            ],
+            'quote_total'            => null,
         ];
 
         /* Act */
@@ -873,7 +863,7 @@ public function it_fails_to_create_quote_without_required_quote_total(): void
             ->call('create');
 
         /* Assert */
-        $component->assertHasNoFormErrors();
+        $component->assertHasFormErrors(['quote_total']);
     }
     # endregion