app/Http/Controllers/StudentController.php

@@ -108,7 +108,7 @@ class StudentController extends Controller
 
         //        TODO if a students grade is changed, we need to be sure they are still eligible for the auditions in which they are entered.
 
-        return redirect('/students');
+        return redirect('/students')->with('success', 'Student updated successfully.');
     }
 
     /**

tests/Feature/Pages/StudentsEditTest.php

@@ -0,0 +1,75 @@
+<?php
+
+use App\Models\School;
+use App\Models\Student;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+use function Pest\Laravel\actingAs;
+use function Pest\Laravel\get;
+use function Pest\Laravel\patch;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->school = School::factory()->create();
+    $this->user = User::factory()->create(['school_id' => $this->school->id]);
+    $this->student = Student::factory()->create([
+        'school_id' => $this->school->id, 'first_name' => 'Bandit', 'last_name' => 'Heeler',
+    ]);
+});
+
+test('responds positively when the user has the same school as the entry', function () {
+    actingAs($this->user);
+    get(route('students.edit', $this->student))
+        ->assertOk()
+        ->assertSee([$this->student->first_name, 'Edit Student', 'Save Changes']);
+});
+
+it('denies guests', function () {
+    get(route('students.edit', $this->student))
+        ->assertRedirect(route('home'));
+});
+
+it('denies users that are not at the students school', function () {
+    // Arrange
+    $otherUser = User::factory()->create();
+    // Act & Assert
+    actingAs($otherUser);
+    get(route('students.edit', $this->student))
+        ->assertForbidden();
+});
+
+it('modifies the student', function () {
+    actingAs($this->user);
+    get(route('students.index'))
+        ->assertSee('Bandit')
+        ->assertDontSee('Bluey');
+
+    patch(route('students.update', $this->student), [
+        'first_name' => 'Bluey',
+        'last_name' => 'Heeler',
+        'grade' => 1,
+    ])->assertRedirect(route('students.index'))
+        ->assertSessionHas('success', 'Student updated successfully.')
+        ->assertSessionHasNoErrors();
+
+    get(route('students.index'))
+        ->assertSee('Bluey')
+        ->assertDontSee('Bandit');
+
+});
+
+it('will not modify a student not at the users school', function () {
+    actingAs(User::factory()->create());
+    patch(route('students.update', $this->student), [
+        'first_name' => 'Bluey',
+        'last_name' => 'Heeler',
+        'grade' => 1,
+    ])->assertForbidden();
+
+    actingAs($this->user);
+    get(route('students.index'))
+        ->assertSee('Bandit')
+        ->assertDontSee('Bluey');
+});