+
+ public function test_attachment_access_without_permission_shows_404()
+ {
+ $admin = $this->getAdmin();
+ $viewer = $this->getViewer();
+ $page = Page::first();
+
+ $this->actingAs($admin);
+ $fileName = 'permission_test.txt';
+ $this->uploadFile($fileName, $page->id);
+ $attachment = Attachment::orderBy('id', 'desc')->take(1)->first();
+
+ $page->restricted = true;
+ $page->permissions()->delete();
+ $page->save();
+ $this->app[PermissionService::class]->buildJointPermissionsForEntity($page);
+ $page->load('jointPermissions');
+
+ $this->actingAs($viewer);
+ $attachmentGet = $this->get($attachment->getUrl());
+ $attachmentGet->assertStatus(404);
+ $attachmentGet->assertSee("Attachment not found");
+
+ $this->deleteUploads();
+ }