The failure was a bug in the test. The decimal:2 cast returns a string so that no precision is lost, so the JSON holds "19.50", and assertJsonPath() compares with ===. Either expect '19.50' or make the API send numbers, but choose deliberately. After the fix, all seven tests passed (30 assertions).
A failed form validation redirects back and leaves its errors in the session, so the invalid-input test posts ['price' => -1] from /products/new and chains ->assertRedirect('/products/new')->assertSessionHasErrors(['name' => 'The name field is required.', 'price']). The other assertions follow the same pattern. For status codes there are assertOk, assertCreated, assertForbidden and assertNotFound. For views, use assertViewIs, assertViewHas and assertSee. For the session and login, use assertSessionHas, assertAuthenticated and assertGuest. assertJson() passes when the array you give appears anywhere in the response, while assertExactJson() requires an exact match. When a test puzzles you, chain ->dump() or ->dumpSession() to print what the test actually received.