Returning User's Posts Only & Global Scope for Post Order

app/Http/Controllers/PostController.php

@@ -4,13 +4,12 @@
 
 use App\Http\Resources\Post as PostResource;
 use App\Http\Resources\PostCollection;
-use App\Post;
 
 class PostController extends Controller
 {
     public function index()
     {
-        return new PostCollection(Post::all());
+        return new PostCollection(request()->user()->posts);
     }
 
     public function store()

app/Post.php

@@ -2,12 +2,20 @@
 
 namespace App;
 
+use App\Scopes\ReverseScope;
 use Illuminate\Database\Eloquent\Model;
 
 class Post extends Model
 {
     protected $guarded = [];// disable mass assignment
 
+    protected static function boot()
+    {
+        parent::boot();
+
+        static::addGlobalScope(new ReverseScope());
+    }
+
     public function user()
     {
         return $this->belongsTo(User::class);

app/Scopes/ReverseScope.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Scopes;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Scope;
+
+class ReverseScope implements Scope
+{
+    public function apply(Builder $builder, Model $model)
+    {
+        $builder->orderBy('id', 'desc');
+    }
+}

tests/Feature/RetrievePostsTest.php

@@ -17,7 +17,9 @@ public function a_user_can_retrieve_posts()
     {
         $this->withoutExceptionHandling();
         $this->actingAs($user = factory(User::class)->create(), 'api');
-        $posts = factory(Post::class, 2)->create();
+        $posts = factory(Post::class, 2)->create([
+            'user_id' => $user->id
+        ]);
 
 
         $response = $this->get('/api/posts');
@@ -28,28 +30,44 @@ public function a_user_can_retrieve_posts()
                         'data' =>
                             [
                                 'type' => 'posts',
-                                'post_id' => $posts->first()->id,
+                                'post_id' => $posts->last()->id,
                                 'attributes' => [
-                                    'body' => $posts->first()->body
+                                    'body' => $posts->last()->body
                                 ]
                             ]
                     ],
                     [
                         'data' =>
                             [
                                 'type' => 'posts',
-                                'post_id' => $posts->last()->id,
+                                'post_id' => $posts->first()->id,
                                 'attributes' => [
-                                    'body' => $posts->last()->body
+                                    'body' => $posts->first()->body
                                 ]
                             ]
                     ]
-
                 ],
                 'links' => [
                     'self' => url('/posts')
                 ],
             ]);
 
     }
+
+    /** @test */
+    public function a_user_can_only_retrieve_their_posts()
+    {
+        $this->actingAs($user = factory(User::class)->create(), 'api');
+        $posts = factory(Post::class)->create();
+        $response = $this->get('/api/posts');
+        $response->assertStatus(Response::HTTP_OK)
+            ->assertExactJson(
+                [
+                    'data' => [],
+                    'links' => [
+                        'self' => url('/posts')
+                    ]
+                ]
+            );
+    }
 }