Most starter kits ship with one test: test_that_true_is_true. It's the Laravel default, and almost nobody replaces it. When I started packing my SaaS kit for other developers, I decided the test suite had to earn its place — a buyer should be able to run php artisan test, watch green, and trust that the auth layer they just bought actually works.
So the kit ships tests/Feature/AuthTest.php with eight real tests. Here's what they cover and why each one exists.
The register tests. test_register_returns_token_and_user posts to /api/auth/register and asserts a 201 with a user object (shaped through the API resource) and a token. It also asserts the database row was created with role => 'user' — because the register endpoint hardcodes the role. Which leads to the second test: test_register_cannot_self_assign_admin_role. You can POST role: admin all day; you still get created as a user. That's a security property, and security properties are exactly the things that deserve tests — they're the ones that silently regress when someone "refactors" the controller six months later.
The login tests. test_login_returns_token_and_user creates a user via the factory and asserts a 200 with the token and user. test_login_with_wrong_password_returns_401 asserts the failure shape: 401, message Invalid credentials. Testing the sad path matters more than the happy path here — frontend devs build their error UI against the exact status code this endpoint returns.
The contract tests. test_me_requires_authentication hits /api/auth/me with no token and expects a 401. test_me_without_accept_header_returns_json_401 is the sneaky one: it checks that even without an Accept: application/json header, you get JSON back, not a redirect to a login page that doesn't exist. If you've ever debugged a SPA that got HTML back from an API and choked, you know why this test exists. It's a one-line regression test for a bug I hit on a real client project.
The authorization tests. test_non_admin_cannot_list_users and test_admin_can_list_users — a regular user gets 403 on the user index, an admin gets 200. Two tests, the entire role system proven end to end.
And here's the deliberate part: I stop at 8. There is no test for password reset, no test for email verification, no test for Stripe webhooks — because the kit doesn't ship those features. I won't write tests for code that doesn't exist to make the suite look bigger. A starter kit is a foundation, not a framework, and its tests should mirror its actual scope. What it does ship, it proves.
All eight run against a fresh database (RefreshDatabase), take a couple of seconds, and are written against the public API of the app — routes and JSON — not internals. That means a buyer can refactor my controllers freely and the tests still guard the contract their frontend depends on.
If you want the whole thing — Sanctum auth, role middleware, the admin user management loop, and these 8 tests proving it all works — I packed it into the Laravel + React SaaS Starter Kit, $19 one-time. Skip the three days of wiring and start on the part that's actually yours.
Top comments (0)