fixed tests

tests/TestCase.php

@@ -20,11 +20,24 @@ abstract class TestCase extends BaseTestCase
             'mail.default' => 'array',
         ]);
 
-        $this->withoutMiddleware(ValidateCsrfToken::class);
+        /**
+         * Feature tests post directly to web routes. Keep CSRF enabled in the
+         * application, but exclude it in PHPUnit so tests exercise validation,
+         * authorization, tenancy and persistence instead of failing with 419.
+         */
+        if (class_exists(ValidateCsrfToken::class)) {
+            ValidateCsrfToken::except(['*']);
+            $this->withoutMiddleware(ValidateCsrfToken::class);
+        }
+
+        if (class_exists(\App\Http\Middleware\VerifyCsrfToken::class)) {
+            \App\Http\Middleware\VerifyCsrfToken::except(['*']);
+            $this->withoutMiddleware(\App\Http\Middleware\VerifyCsrfToken::class);
+        }
     }
 
     /**
-     * POST with a real CSRF token for Fortify/web form tests.
+     * POST with a real CSRF token for tests that intentionally verify web-form behaviour.
      *
      * @param  array<string, mixed>  $data
      */