initial commit

tests/Feature/ApiTokenPermissionsTest.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Laravel\Jetstream\Features;
+use Tests\TestCase;
+
+class ApiTokenPermissionsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_api_token_permissions_can_be_updated()
+    {
+        if (! Features::hasApiFeatures()) {
+            return $this->markTestSkipped('API support is not enabled.');
+        }
+
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $token = $user->tokens()->create([
+            'name' => 'Test Token',
+            'token' => Str::random(40),
+            'abilities' => ['create', 'read'],
+        ]);
+
+        $response = $this->put('/user/api-tokens/'.$token->id, [
+            'name' => $token->name,
+            'permissions' => [
+                'delete',
+                'missing-permission',
+            ],
+        ]);
+
+        $this->assertTrue($user->fresh()->tokens->first()->can('delete'));
+        $this->assertFalse($user->fresh()->tokens->first()->can('read'));
+        $this->assertFalse($user->fresh()->tokens->first()->can('missing-permission'));
+    }
+}

tests/Feature/AuthenticationTest.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use App\Providers\RouteServiceProvider;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AuthenticationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_login_screen_can_be_rendered()
+    {
+        $response = $this->get('/login');
+
+        $response->assertStatus(200);
+    }
+
+    public function test_users_can_authenticate_using_the_login_screen()
+    {
+        $user = User::factory()->create();
+
+        $response = $this->post('/login', [
+            'email' => $user->email,
+            'password' => 'password',
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(RouteServiceProvider::HOME);
+    }
+
+    public function test_users_can_not_authenticate_with_invalid_password()
+    {
+        $user = User::factory()->create();
+
+        $this->post('/login', [
+            'email' => $user->email,
+            'password' => 'wrong-password',
+        ]);
+
+        $this->assertGuest();
+    }
+}

tests/Feature/BrowserSessionsTest.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class BrowserSessionsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_other_browser_sessions_can_be_logged_out()
+    {
+        $this->actingAs($user = User::factory()->create());
+
+        $response = $this->delete('/user/other-browser-sessions', [
+            'password' => 'password',
+        ]);
+
+        $response->assertSessionHasNoErrors();
+    }
+}

tests/Feature/CreateApiTokenTest.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Jetstream\Features;
+use Tests\TestCase;
+
+class CreateApiTokenTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_api_tokens_can_be_created()
+    {
+        if (! Features::hasApiFeatures()) {
+            return $this->markTestSkipped('API support is not enabled.');
+        }
+
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $response = $this->post('/user/api-tokens', [
+            'name' => 'Test Token',
+            'permissions' => [
+                'read',
+                'update',
+            ],
+        ]);
+
+        $this->assertCount(1, $user->fresh()->tokens);
+        $this->assertEquals('Test Token', $user->fresh()->tokens->first()->name);
+        $this->assertTrue($user->fresh()->tokens->first()->can('read'));
+        $this->assertFalse($user->fresh()->tokens->first()->can('delete'));
+    }
+}

tests/Feature/CreateTeamTest.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class CreateTeamTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_teams_can_be_created()
+    {
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $response = $this->post('/teams', [
+            'name' => 'Test Team',
+        ]);
+
+        $this->assertCount(2, $user->fresh()->ownedTeams);
+        $this->assertEquals('Test Team', $user->fresh()->ownedTeams()->latest('id')->first()->name);
+    }
+}

tests/Feature/DeleteAccountTest.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Jetstream\Features;
+use Tests\TestCase;
+
+class DeleteAccountTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_user_accounts_can_be_deleted()
+    {
+        if (! Features::hasAccountDeletionFeatures()) {
+            return $this->markTestSkipped('Account deletion is not enabled.');
+        }
+
+        $this->actingAs($user = User::factory()->create());
+
+        $response = $this->delete('/user', [
+            'password' => 'password',
+        ]);
+
+        $this->assertNull($user->fresh());
+    }
+
+    public function test_correct_password_must_be_provided_before_account_can_be_deleted()
+    {
+        if (! Features::hasAccountDeletionFeatures()) {
+            return $this->markTestSkipped('Account deletion is not enabled.');
+        }
+
+        $this->actingAs($user = User::factory()->create());
+
+        $response = $this->delete('/user', [
+            'password' => 'wrong-password',
+        ]);
+
+        $this->assertNotNull($user->fresh());
+    }
+}

tests/Feature/DeleteApiTokenTest.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Laravel\Jetstream\Features;
+use Tests\TestCase;
+
+class DeleteApiTokenTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_api_tokens_can_be_deleted()
+    {
+        if (! Features::hasApiFeatures()) {
+            return $this->markTestSkipped('API support is not enabled.');
+        }
+
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $token = $user->tokens()->create([
+            'name' => 'Test Token',
+            'token' => Str::random(40),
+            'abilities' => ['create', 'read'],
+        ]);
+
+        $response = $this->delete('/user/api-tokens/'.$token->id);
+
+        $this->assertCount(0, $user->fresh()->tokens);
+    }
+}

tests/Feature/DeleteTeamTest.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class DeleteTeamTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_teams_can_be_deleted()
+    {
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $user->ownedTeams()->save($team = Team::factory()->make([
+            'personal_team' => false,
+        ]));
+
+        $team->users()->attach(
+            $otherUser = User::factory()->create(), ['role' => 'test-role']
+        );
+
+        $response = $this->delete('/teams/'.$team->id);
+
+        $this->assertNull($team->fresh());
+        $this->assertCount(0, $otherUser->fresh()->teams);
+    }
+
+    public function test_personal_teams_cant_be_deleted()
+    {
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $response = $this->delete('/teams/'.$user->currentTeam->id);
+
+        $this->assertNotNull($user->currentTeam->fresh());
+    }
+}

tests/Feature/EmailVerificationTest.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use App\Providers\RouteServiceProvider;
+use Illuminate\Auth\Events\Verified;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\URL;
+use Laravel\Fortify\Features;
+use Tests\TestCase;
+
+class EmailVerificationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_email_verification_screen_can_be_rendered()
+    {
+        if (! Features::enabled(Features::emailVerification())) {
+            return $this->markTestSkipped('Email verification not enabled.');
+        }
+
+        $user = User::factory()->withPersonalTeam()->unverified()->create();
+
+        $response = $this->actingAs($user)->get('/email/verify');
+
+        $response->assertStatus(200);
+    }
+
+    public function test_email_can_be_verified()
+    {
+        if (! Features::enabled(Features::emailVerification())) {
+            return $this->markTestSkipped('Email verification not enabled.');
+        }
+
+        Event::fake();
+
+        $user = User::factory()->unverified()->create();
+
+        $verificationUrl = URL::temporarySignedRoute(
+            'verification.verify',
+            now()->addMinutes(60),
+            ['id' => $user->id, 'hash' => sha1($user->email)]
+        );
+
+        $response = $this->actingAs($user)->get($verificationUrl);
+
+        Event::assertDispatched(Verified::class);
+
+        $this->assertTrue($user->fresh()->hasVerifiedEmail());
+        $response->assertRedirect(RouteServiceProvider::HOME.'?verified=1');
+    }
+
+    public function test_email_can_not_verified_with_invalid_hash()
+    {
+        if (! Features::enabled(Features::emailVerification())) {
+            return $this->markTestSkipped('Email verification not enabled.');
+        }
+
+        $user = User::factory()->unverified()->create();
+
+        $verificationUrl = URL::temporarySignedRoute(
+            'verification.verify',
+            now()->addMinutes(60),
+            ['id' => $user->id, 'hash' => sha1('wrong-email')]
+        );
+
+        $this->actingAs($user)->get($verificationUrl);
+
+        $this->assertFalse($user->fresh()->hasVerifiedEmail());
+    }
+}

tests/Feature/ExampleTest.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace Tests\Feature;
+
+// use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ExampleTest extends TestCase
+{
+    /**
+     * A basic test example.
+     *
+     * @return void
+     */
+    public function test_the_application_returns_a_successful_response()
+    {
+        $response = $this->get('/');
+
+        $response->assertStatus(200);
+    }
+}

tests/Feature/InviteTeamMemberTest.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Mail;
+use Laravel\Jetstream\Features;
+use Laravel\Jetstream\Mail\TeamInvitation;
+use Tests\TestCase;
+
+class InviteTeamMemberTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_team_members_can_be_invited_to_team()
+    {
+        if (! Features::sendsTeamInvitations()) {
+            return $this->markTestSkipped('Team invitations not enabled.');
+        }
+
+        Mail::fake();
+
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $response = $this->post('/teams/'.$user->currentTeam->id.'/members', [
+            'email' => 'test@example.com',
+            'role' => 'admin',
+        ]);
+
+        Mail::assertSent(TeamInvitation::class);
+
+        $this->assertCount(1, $user->currentTeam->fresh()->teamInvitations);
+    }
+
+    public function test_team_member_invitations_can_be_cancelled()
+    {
+        if (! Features::sendsTeamInvitations()) {
+            return $this->markTestSkipped('Team invitations not enabled.');
+        }
+
+        Mail::fake();
+
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $invitation = $user->currentTeam->teamInvitations()->create([
+            'email' => 'test@example.com',
+            'role' => 'admin',
+        ]);
+
+        $response = $this->delete('/team-invitations/'.$invitation->id);
+
+        $this->assertCount(0, $user->currentTeam->fresh()->teamInvitations);
+    }
+}

tests/Feature/LeaveTeamTest.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class LeaveTeamTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_users_can_leave_teams()
+    {
+        $user = User::factory()->withPersonalTeam()->create();
+
+        $user->currentTeam->users()->attach(
+            $otherUser = User::factory()->create(), ['role' => 'admin']
+        );
+
+        $this->actingAs($otherUser);
+
+        $response = $this->delete('/teams/'.$user->currentTeam->id.'/members/'.$otherUser->id);
+
+        $this->assertCount(0, $user->currentTeam->fresh()->users);
+    }
+
+    public function test_team_owners_cant_leave_their_own_team()
+    {
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $response = $this->delete('/teams/'.$user->currentTeam->id.'/members/'.$user->id);
+
+        $response->assertSessionHasErrorsIn('removeTeamMember', ['team']);
+
+        $this->assertNotNull($user->currentTeam->fresh());
+    }
+}

tests/Feature/PasswordConfirmationTest.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Jetstream\Features;
+use Tests\TestCase;
+
+class PasswordConfirmationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_confirm_password_screen_can_be_rendered()
+    {
+        $user = User::factory()->withPersonalTeam()->create();
+
+        $response = $this->actingAs($user)->get('/user/confirm-password');
+
+        $response->assertStatus(200);
+    }
+
+    public function test_password_can_be_confirmed()
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->post('/user/confirm-password', [
+            'password' => 'password',
+        ]);
+
+        $response->assertRedirect();
+        $response->assertSessionHasNoErrors();
+    }
+
+    public function test_password_is_not_confirmed_with_invalid_password()
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->post('/user/confirm-password', [
+            'password' => 'wrong-password',
+        ]);
+
+        $response->assertSessionHasErrors();
+    }
+}

tests/Feature/PasswordResetTest.php

@@ -0,0 +1,94 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Auth\Notifications\ResetPassword;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Notification;
+use Laravel\Fortify\Features;
+use Tests\TestCase;
+
+class PasswordResetTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_reset_password_link_screen_can_be_rendered()
+    {
+        if (! Features::enabled(Features::resetPasswords())) {
+            return $this->markTestSkipped('Password updates are not enabled.');
+        }
+
+        $response = $this->get('/forgot-password');
+
+        $response->assertStatus(200);
+    }
+
+    public function test_reset_password_link_can_be_requested()
+    {
+        if (! Features::enabled(Features::resetPasswords())) {
+            return $this->markTestSkipped('Password updates are not enabled.');
+        }
+
+        Notification::fake();
+
+        $user = User::factory()->create();
+
+        $response = $this->post('/forgot-password', [
+            'email' => $user->email,
+        ]);
+
+        Notification::assertSentTo($user, ResetPassword::class);
+    }
+
+    public function test_reset_password_screen_can_be_rendered()
+    {
+        if (! Features::enabled(Features::resetPasswords())) {
+            return $this->markTestSkipped('Password updates are not enabled.');
+        }
+
+        Notification::fake();
+
+        $user = User::factory()->create();
+
+        $response = $this->post('/forgot-password', [
+            'email' => $user->email,
+        ]);
+
+        Notification::assertSentTo($user, ResetPassword::class, function ($notification) {
+            $response = $this->get('/reset-password/'.$notification->token);
+
+            $response->assertStatus(200);
+
+            return true;
+        });
+    }
+
+    public function test_password_can_be_reset_with_valid_token()
+    {
+        if (! Features::enabled(Features::resetPasswords())) {
+            return $this->markTestSkipped('Password updates are not enabled.');
+        }
+
+        Notification::fake();
+
+        $user = User::factory()->create();
+
+        $response = $this->post('/forgot-password', [
+            'email' => $user->email,
+        ]);
+
+        Notification::assertSentTo($user, ResetPassword::class, function ($notification) use ($user) {
+            $response = $this->post('/reset-password', [
+                'token' => $notification->token,
+                'email' => $user->email,
+                'password' => 'password',
+                'password_confirmation' => 'password',
+            ]);
+
+            $response->assertSessionHasNoErrors();
+
+            return true;
+        });
+    }
+}

tests/Feature/ProfileInformationTest.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ProfileInformationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_profile_information_can_be_updated()
+    {
+        $this->actingAs($user = User::factory()->create());
+
+        $response = $this->put('/user/profile-information', [
+            'name' => 'Test Name',
+            'email' => 'test@example.com',
+        ]);
+
+        $this->assertEquals('Test Name', $user->fresh()->name);
+        $this->assertEquals('test@example.com', $user->fresh()->email);
+    }
+}

tests/Feature/RegistrationTest.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Providers\RouteServiceProvider;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Fortify\Features;
+use Laravel\Jetstream\Jetstream;
+use Tests\TestCase;
+
+class RegistrationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_registration_screen_can_be_rendered()
+    {
+        if (! Features::enabled(Features::registration())) {
+            return $this->markTestSkipped('Registration support is not enabled.');
+        }
+
+        $response = $this->get('/register');
+
+        $response->assertStatus(200);
+    }
+
+    public function test_registration_screen_cannot_be_rendered_if_support_is_disabled()
+    {
+        if (Features::enabled(Features::registration())) {
+            return $this->markTestSkipped('Registration support is enabled.');
+        }
+
+        $response = $this->get('/register');
+
+        $response->assertStatus(404);
+    }
+
+    public function test_new_users_can_register()
+    {
+        if (! Features::enabled(Features::registration())) {
+            return $this->markTestSkipped('Registration support is not enabled.');
+        }
+
+        $response = $this->post('/register', [
+            'name' => 'Test User',
+            'email' => 'test@example.com',
+            'password' => 'password',
+            'password_confirmation' => 'password',
+            'terms' => Jetstream::hasTermsAndPrivacyPolicyFeature(),
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertRedirect(RouteServiceProvider::HOME);
+    }
+}

tests/Feature/RemoveTeamMemberTest.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class RemoveTeamMemberTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_team_members_can_be_removed_from_teams()
+    {
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $user->currentTeam->users()->attach(
+            $otherUser = User::factory()->create(), ['role' => 'admin']
+        );
+
+        $response = $this->delete('/teams/'.$user->currentTeam->id.'/members/'.$otherUser->id);
+
+        $this->assertCount(0, $user->currentTeam->fresh()->users);
+    }
+
+    public function test_only_team_owner_can_remove_team_members()
+    {
+        $user = User::factory()->withPersonalTeam()->create();
+
+        $user->currentTeam->users()->attach(
+            $otherUser = User::factory()->create(), ['role' => 'admin']
+        );
+
+        $this->actingAs($otherUser);
+
+        $response = $this->delete('/teams/'.$user->currentTeam->id.'/members/'.$user->id);
+
+        $response->assertStatus(403);
+    }
+}

tests/Feature/TwoFactorAuthenticationSettingsTest.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Fortify\Features;
+use Tests\TestCase;
+
+class TwoFactorAuthenticationSettingsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_two_factor_authentication_can_be_enabled()
+    {
+        if (! Features::canManageTwoFactorAuthentication()) {
+            return $this->markTestSkipped('Two factor authentication is not enabled.');
+        }
+
+        $this->actingAs($user = User::factory()->create());
+
+        $this->withSession(['auth.password_confirmed_at' => time()]);
+
+        $response = $this->post('/user/two-factor-authentication');
+
+        $this->assertNotNull($user->fresh()->two_factor_secret);
+        $this->assertCount(8, $user->fresh()->recoveryCodes());
+    }
+
+    public function test_recovery_codes_can_be_regenerated()
+    {
+        if (! Features::canManageTwoFactorAuthentication()) {
+            return $this->markTestSkipped('Two factor authentication is not enabled.');
+        }
+
+        $this->actingAs($user = User::factory()->create());
+
+        $this->withSession(['auth.password_confirmed_at' => time()]);
+
+        $this->post('/user/two-factor-authentication');
+        $this->post('/user/two-factor-recovery-codes');
+
+        $user = $user->fresh();
+
+        $this->post('/user/two-factor-recovery-codes');
+
+        $this->assertCount(8, $user->recoveryCodes());
+        $this->assertCount(8, array_diff($user->recoveryCodes(), $user->fresh()->recoveryCodes()));
+    }
+
+    public function test_two_factor_authentication_can_be_disabled()
+    {
+        if (! Features::canManageTwoFactorAuthentication()) {
+            return $this->markTestSkipped('Two factor authentication is not enabled.');
+        }
+
+        $this->actingAs($user = User::factory()->create());
+
+        $this->withSession(['auth.password_confirmed_at' => time()]);
+
+        $this->post('/user/two-factor-authentication');
+
+        $this->assertNotNull($user->fresh()->two_factor_secret);
+
+        $this->delete('/user/two-factor-authentication');
+
+        $this->assertNull($user->fresh()->two_factor_secret);
+    }
+}

tests/Feature/UpdatePasswordTest.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+use Tests\TestCase;
+
+class UpdatePasswordTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_password_can_be_updated()
+    {
+        $this->actingAs($user = User::factory()->create());
+
+        $response = $this->put('/user/password', [
+            'current_password' => 'password',
+            'password' => 'new-password',
+            'password_confirmation' => 'new-password',
+        ]);
+
+        $this->assertTrue(Hash::check('new-password', $user->fresh()->password));
+    }
+
+    public function test_current_password_must_be_correct()
+    {
+        $this->actingAs($user = User::factory()->create());
+
+        $response = $this->put('/user/password', [
+            'current_password' => 'wrong-password',
+            'password' => 'new-password',
+            'password_confirmation' => 'new-password',
+        ]);
+
+        $response->assertSessionHasErrors();
+
+        $this->assertTrue(Hash::check('password', $user->fresh()->password));
+    }
+
+    public function test_new_passwords_must_match()
+    {
+        $this->actingAs($user = User::factory()->create());
+
+        $response = $this->put('/user/password', [
+            'current_password' => 'password',
+            'password' => 'new-password',
+            'password_confirmation' => 'wrong-password',
+        ]);
+
+        $response->assertSessionHasErrors();
+
+        $this->assertTrue(Hash::check('password', $user->fresh()->password));
+    }
+}

tests/Feature/UpdateTeamMemberRoleTest.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class UpdateTeamMemberRoleTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_team_member_roles_can_be_updated()
+    {
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $user->currentTeam->users()->attach(
+            $otherUser = User::factory()->create(), ['role' => 'admin']
+        );
+
+        $response = $this->put('/teams/'.$user->currentTeam->id.'/members/'.$otherUser->id, [
+            'role' => 'editor',
+        ]);
+
+        $this->assertTrue($otherUser->fresh()->hasTeamRole(
+            $user->currentTeam->fresh(), 'editor'
+        ));
+    }
+
+    public function test_only_team_owner_can_update_team_member_roles()
+    {
+        $user = User::factory()->withPersonalTeam()->create();
+
+        $user->currentTeam->users()->attach(
+            $otherUser = User::factory()->create(), ['role' => 'admin']
+        );
+
+        $this->actingAs($otherUser);
+
+        $response = $this->put('/teams/'.$user->currentTeam->id.'/members/'.$otherUser->id, [
+            'role' => 'editor',
+        ]);
+
+        $this->assertTrue($otherUser->fresh()->hasTeamRole(
+            $user->currentTeam->fresh(), 'admin'
+        ));
+    }
+}

tests/Feature/UpdateTeamNameTest.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class UpdateTeamNameTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_team_names_can_be_updated()
+    {
+        $this->actingAs($user = User::factory()->withPersonalTeam()->create());
+
+        $response = $this->put('/teams/'.$user->currentTeam->id, [
+            'name' => 'Test Team',
+        ]);
+
+        $this->assertCount(1, $user->fresh()->ownedTeams);
+        $this->assertEquals('Test Team', $user->currentTeam->fresh()->name);
+    }
+}