create(); $workspace = Workspace::factory()->create(); $workspace->users()->attach($user->id, [ 'role' => $role, 'permissions' => $permissions, ]); session(['current_workspace_id' => $workspace->id]); return [$user, $workspace]; } function createRemovalTestMember(Workspace $workspace, string $role, array $permissions = []): User { $member = User::factory()->create(); $workspace->users()->attach($member->id, [ 'role' => $role, 'permissions' => $permissions, ]); return $member; } function getRemovalPivotId(Workspace $workspace, User $user): int { return WorkspaceUser::where('workspace_id', $workspace->id) ->where('user_id', $user->id) ->firstOrFail() ->id; } // ── Owner can remove a member ────────────────────────────── test('owner can remove a member', function () { [$owner, $workspace] = setupRemovalTestUser(WorkspaceUserRole::Owner); $worker = createRemovalTestMember($workspace, WorkspaceUserRole::Worker); $pivotId = getRemovalPivotId($workspace, $worker); $response = $this->actingAs($owner)->delete(route('team.remove', $pivotId)); $response->assertRedirect(); $response->assertSessionHas('success', 'Membre retiré'); // Pivot row should be deleted expect(WorkspaceUser::find($pivotId))->toBeNull(); }); // ── Owner cannot remove themselves ───────────────────────── test('owner cannot remove themselves', function () { [$owner, $workspace] = setupRemovalTestUser(WorkspaceUserRole::Owner); $pivotId = getRemovalPivotId($workspace, $owner); $response = $this->actingAs($owner)->delete(route('team.remove', $pivotId)); $response->assertNotFound(); }); // ── Manager with can_manage_team can remove worker ───────── test('manager with can_manage_team can remove worker', function () { [$manager, $workspace] = setupRemovalTestUser(WorkspaceUserRole::Manager, [ Permission::CanManageTeam => true, ]); $worker = createRemovalTestMember($workspace, WorkspaceUserRole::Worker); $pivotId = getRemovalPivotId($workspace, $worker); $response = $this->actingAs($manager)->delete(route('team.remove', $pivotId)); $response->assertRedirect(); $response->assertSessionHas('success', 'Membre retiré'); }); // ── Manager with can_manage_team cannot remove owner ─────── test('manager with can_manage_team cannot remove owner', function () { [$manager, $workspace] = setupRemovalTestUser(WorkspaceUserRole::Manager, [ Permission::CanManageTeam => true, ]); $owner = createRemovalTestMember($workspace, WorkspaceUserRole::Owner); $pivotId = getRemovalPivotId($workspace, $owner); $response = $this->actingAs($manager)->delete(route('team.remove', $pivotId)); $response->assertNotFound(); }); // ── Manager without can_manage_team gets 404 ─────────────── test('manager without can_manage_team gets 404 on remove', function () { [$manager, $workspace] = setupRemovalTestUser(WorkspaceUserRole::Manager, [ Permission::CanManageTeam => false, ]); $worker = createRemovalTestMember($workspace, WorkspaceUserRole::Worker); $pivotId = getRemovalPivotId($workspace, $worker); $response = $this->actingAs($manager)->delete(route('team.remove', $pivotId)); $response->assertNotFound(); }); // ── Worker gets 404 on remove attempt ────────────────────── test('worker gets 404 on remove attempt', function () { [$worker, $workspace] = setupRemovalTestUser(WorkspaceUserRole::Worker); $otherWorker = createRemovalTestMember($workspace, WorkspaceUserRole::Worker); $pivotId = getRemovalPivotId($workspace, $otherWorker); $response = $this->actingAs($worker)->delete(route('team.remove', $pivotId)); $response->assertNotFound(); }); // ── Member removal is logged ─────────────────────────────── test('member removal is logged in activity log', function () { [$owner, $workspace] = setupRemovalTestUser(WorkspaceUserRole::Owner); $worker = createRemovalTestMember($workspace, WorkspaceUserRole::Worker); $pivotId = getRemovalPivotId($workspace, $worker); $this->actingAs($owner)->delete(route('team.remove', $pivotId)); $log = Activity::latest('id')->first(); expect($log->description)->toBe('member_removed') ->and($log->properties['target_user'])->toBe($worker->name) ->and($log->properties['target_email'])->toBe($worker->email) ->and($log->properties['role'])->toBe('worker'); }); // ── Removed user account still exists ────────────────────── test('removed user account still exists after removal', function () { [$owner, $workspace] = setupRemovalTestUser(WorkspaceUserRole::Owner); $worker = createRemovalTestMember($workspace, WorkspaceUserRole::Worker); $pivotId = getRemovalPivotId($workspace, $worker); $this->actingAs($owner)->delete(route('team.remove', $pivotId)); // User record still exists expect(User::find($worker->id))->not->toBeNull(); // But pivot row is deleted expect(WorkspaceUser::find($pivotId))->toBeNull(); });