Merge pull request 'Fix/team security review' (#1) from fix/team-security-review into main

Reviewed-on: #1

Dockerfile

@@ -52,16 +52,8 @@ WORKDIR /var/www
 FROM php_base AS build
 
 ARG VITE_APP_VERSION=local
-ARG VITE_REVERB_APP_KEY
-ARG VITE_REVERB_HOST
-ARG VITE_REVERB_PORT
-ARG VITE_REVERB_SCHEME
 
-ENV VITE_APP_VERSION=${VITE_APP_VERSION} \
+ENV VITE_APP_VERSION=${VITE_APP_VERSION}
-    VITE_REVERB_APP_KEY=${VITE_REVERB_APP_KEY} \
-    VITE_REVERB_HOST=${VITE_REVERB_HOST} \
-    VITE_REVERB_PORT=${VITE_REVERB_PORT} \
-    VITE_REVERB_SCHEME=${VITE_REVERB_SCHEME}
 
 COPY --from=node_binary /usr/local/ /usr/local/
 COPY . /var/www

app/Concerns/ReservedSlugs.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Concerns;
+
+trait ReservedSlugs
+{
+    public function isReserved(string $slug): bool
+    {
+        return in_array($slug, $this->reservedSlugs());
+    }
+
+    public function reservedSlugs(): array
+    {
+        return [
+            'index',
+            'edit',
+            'update',
+            'create',
+            'store',
+            'delete',
+            'destroy',
+            'revoke',
+            'invite',
+            'accept',
+        ];
+    }
+}

app/Http/Controllers/TeamController.php

@@ -2,69 +2,73 @@
 
 namespace App\Http\Controllers;
 
+use App\Concerns\ReservedSlugs;
 use App\Enums\TeamMemberRole;
 use App\Http\Requests\StoreTeamRequest;
 use App\Http\Requests\UpdateTeamRequest;
 use App\Http\Resources\TeamInviteResource;
 use App\Http\Resources\TeamResource;
 use App\Models\Team;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
 use Inertia\Inertia;
-use Str;
+use Inertia\Response;
 
 class TeamController extends Controller
 {
+
+    use ReservedSlugs;
+
     /**
      * Display a listing of the resource.
      */
-    public function index(Request $request)
+    public function index(Request $request): Response
     {
         return Inertia::render('team/Index', [
-            'teams' => TeamResource::collection(Team::visibleTo(auth()->user())->get())->resolve($request),
+            'teams' => TeamResource::collection(Team::visibleTo($request->user())->with('members')->get())->resolve($request),
         ]);
     }
 
-    public function show(Request $request, Team $team)
+    public function show(Request $request, Team $team): Response
     {
-        $teamManager = auth()->user()->can('manage', $team);
+        $teamManager = $request->user()->can('manage', $team);
+        $team->load('members');
 
         return Inertia::render('team/Show', [
             'team' => TeamResource::make($team)->resolve($request),
             'canManageTeam' => $teamManager,
         ] + ($teamManager ? [
-            'teamInvites' => TeamInviteResource::collection($team->invites)->resolve($request),
+            'teamInvites' => TeamInviteResource::collection($team->invites()->with('invitedBy')->get())->resolve($request),
         ] : []));
     }
 
     /**
      * Store a newly created resource in storage.
      */
-    public function store(StoreTeamRequest $request)
+    public function store(StoreTeamRequest $request): RedirectResponse
     {
-        $validated = $request->validated();
-
         try {
-            DB::transaction(function () use ($validated) {
+            DB::transaction(function () use ($request): void {
-                $team = Team::create($validated);
+                $team = Team::create($request->validated());
-                $team->members()->attach(
+                $team->members()->attach($request->user(), ['role' => TeamMemberRole::Admin]);
-                    request()->user()->id,
-                    ['role' => TeamMemberRole::Admin]
-                );
             });
+        } catch (\Exception $exception) {
+            report($exception);
+            Inertia::flash('error', 'Team could not be created.');
+
+            return back()->withInput();
+        }
+
         Inertia::flash('success', 'Team successfully created.');
 
         return to_route('teams.index');
-        } catch (\Exception $exception) {
-            Inertia::flash('error', 'Team could not be created.');
-            DB::rollBack();
-
-            return back();
-        }
     }
 
-    public function create()
+    public function create(): Response
     {
         return Inertia::render('team/Create');
     }
@@ -72,7 +76,7 @@ class TeamController extends Controller
     /**
      * Show the form for editing the specified resource.
      */
-    public function edit(Request $request, Team $team)
+    public function edit(Request $request, Team $team): Response
     {
         return Inertia::render('team/Edit', [
             'team' => TeamResource::make($team)->resolve($request),
@@ -82,25 +86,23 @@ class TeamController extends Controller
     /**
      * Update the specified resource in storage.
      */
-    public function update(UpdateTeamRequest $request, Team $team)
+    public function update(UpdateTeamRequest $request, Team $team): RedirectResponse
     {
-        $validated = $request->validated();
-
         try {
-            DB::transaction(function () use ($validated, $team) {
+            $team->update($request->validated());
-                $team->update($validated);
-            });
-            Inertia::flash('success', 'Team successfully updated.');
-
         } catch (\Exception $exception) {
+            report($exception);
             Inertia::flash('error', 'Team could not be updated.');
-            DB::rollBack();
+
+            return back()->withInput();
         }
 
+        Inertia::flash('success', 'Team successfully updated.');
+
         return to_route('teams.show', $team);
     }
 
-    public function nameToSlug(Request $request)
+    public function nameToSlug(Request $request): JsonResponse
     {
         $validated = $request->validate([
             'name' => 'required|string|max:255',
@@ -114,7 +116,7 @@ class TeamController extends Controller
         return response()->json([
             'name' => $name,
             'slug' => $slug,
-            'taken' => $slug !== $ignoredSlug && Team::whereSlug($slug)->exists(),
+            'taken' => $this->isReserved($slug) || ($slug !== $ignoredSlug && Team::whereSlug($slug)->exists()),
         ]);
     }
 
@@ -134,25 +136,25 @@ class TeamController extends Controller
         Inertia::flash('success', 'User invited to your team.');
     }
 
-    public function revokeInvite(Request $request, Team $team)
+    public function revokeInvite(Request $request, Team $team): RedirectResponse
     {
         $validated = $request->validate([
-            'email' => 'required|email|max:255|exists:team_invites,invited_email',
+            'email' => 'required|email|max:255',
         ]);
 
-        abort_unless(auth()->user()->can('manage', $team), 403);
-
         $teamInvite = $team->invites()->whereInvitedEmail(Arr::get($validated,'email'))->firstOrFail();
 
         try {
-            DB::transaction(function () use ($teamInvite) {
             $teamInvite->delete();
-            });
+        } catch (\Exception $exception) {
-            Inertia::flash('success', 'successfully deleted user invite.');
+            report($exception);
-        } catch (\Throwable $e) {
             Inertia::flash('error', 'could not delete user invite.');
-            DB::rollBack();
+
+            return to_route('teams.show', $team);
         }
 
+        Inertia::flash('success', 'successfully deleted user invite.');
+
+        return to_route('teams.show', $team);
     }
 }

app/Http/Requests/StoreTeamRequest.php

@@ -2,12 +2,17 @@
 
 namespace App\Http\Requests;
 
+use App\Concerns\ReservedSlugs;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
 
 class StoreTeamRequest extends FormRequest
 {
+
+    use ReservedSlugs;
+
     /**
      * Get the validation rules that apply to the request.
      *
@@ -17,7 +22,7 @@ class StoreTeamRequest extends FormRequest
     {
         return [
             'name' => ['required', 'string', 'max:255'],
-            'slug' => ['required', 'string', 'max:255', 'unique:teams,slug'],
+            'slug' => ['required', 'string', 'max:255', Rule::notIn($this->reservedSlugs()), Rule::unique('teams', 'slug')],
             'require_2fa' => ['required', 'boolean'],
         ];
     }
@@ -25,9 +30,8 @@ class StoreTeamRequest extends FormRequest
     public function messages(): array
     {
         return [
-            'slug.string' => '',
+            'slug.required' => 'The name must contain letters or numbers.',
-            'slug.required' => '',
+            'slug.not_in' => 'This name is reserved.',
-            'slug.max' => '',
             'slug.unique' => 'The name has already been taken.',
         ];
     }
@@ -35,7 +39,7 @@ class StoreTeamRequest extends FormRequest
     protected function prepareForValidation(): void
     {
         $this->merge([
-            'slug' => Str::slug($this->name),
+            'slug' => is_string($this->input('name')) ? Str::slug($this->input('name')) : null,
         ]);
     }
 }

app/Http/Requests/UpdateTeamRequest.php

@@ -2,12 +2,15 @@
 
 namespace App\Http\Requests;
 
+use App\Concerns\ReservedSlugs;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
 
 class UpdateTeamRequest extends FormRequest
 {
+    use ReservedSlugs;
     /**
      * Get the validation rules that apply to the request.
      *
@@ -16,8 +19,8 @@ class UpdateTeamRequest extends FormRequest
     public function rules(): array
     {
         return [
-            'name' => ['nullable', 'string', 'max:255'],
+            'name' => ['sometimes', 'required', 'string', 'max:255'],
-            'slug' => ['nullable', 'required_with:name', 'string', 'max:255', 'unique:teams,slug,'.$this->route('team')->id],
+            'slug' => [Rule::excludeIf(! $this->has('name')), 'required', 'string', 'max:255', Rule::notIn($this->reservedSlugs()), Rule::unique('teams', 'slug')->ignore($this->route('team'))],
             'require_2fa' => ['required', 'boolean'],
         ];
     }
@@ -25,9 +28,8 @@ class UpdateTeamRequest extends FormRequest
     public function messages(): array
     {
         return [
-            'slug.string' => '',
+            'slug.required' => 'The name must contain letters or numbers.',
-            'slug.required' => '',
+            'slug.not_in' => 'This name is reserved.',
-            'slug.max' => '',
             'slug.unique' => 'The name has already been taken.',
         ];
     }
@@ -35,7 +37,7 @@ class UpdateTeamRequest extends FormRequest
     protected function prepareForValidation(): void
     {
         $this->merge([
-            'slug' => Str::slug($this->name),
+            'slug' => is_string($this->input('name')) ? Str::slug($this->input('name')) : null,
         ]);
     }
 }

app/Http/Resources/TeamInviteResource.php

@@ -20,7 +20,6 @@ class TeamInviteResource extends JsonResource
     {
         return [
             'invitedEmail' => $this->invited_email,
-            'team' => TeamResource::make($this->team)->resolve($request),
             'invitedBy' => UserResource::make($this->invitedBy)->resolve($request),
             'invitedAt' => $this->created_at->toDateTimeString(),
         ];

app/Http/Resources/UserResource.php

@@ -21,7 +21,7 @@ class UserResource extends JsonResource
         return [
             'name' => $this->name,
             'email' => $this->email,
-            'has_multi_factor' => $this->hasVerifiedEmail() || $this->hasEnabledTwoFactorAuthentication(),
+            'has_multi_factor' => $this->hasEnabledTwoFactorAuthentication(),
         ];
     }
 }

app/Models/Team.php

@@ -2,9 +2,11 @@
 
 namespace App\Models;
 
+use Carbon\CarbonImmutable;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Attributes\Scope;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
@@ -13,24 +15,26 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
  * @property int $id
  * @property string $name
  * @property string $slug
- * @property int $created_by
  * @property bool $require_2fa
- * @property \Carbon\CarbonImmutable|null $created_at
+ * @property CarbonImmutable|null $created_at
- * @property \Carbon\CarbonImmutable|null $updated_at
+ * @property CarbonImmutable|null $updated_at
- * @property-read \App\Models\TeamMember|null $pivot
+ * @property-read Collection<int, TeamInvite> $invites
- * @property-read \Illuminate\Database\Eloquent\Collection<int, \App\Models\User> $members
+ * @property-read int|null $invites_count
+ * @property-read TeamMember|null $pivot
+ * @property-read Collection<int, User> $members
  * @property-read int|null $members_count
+ *
  * @method static Builder<static>|Team newModelQuery()
  * @method static Builder<static>|Team newQuery()
  * @method static Builder<static>|Team query()
- * @method static Builder<static>|Team visibleTo(\App\Models\User $user)
+ * @method static Builder<static>|Team scopeVisibleTo(\App\Models\User $user)
  * @method static Builder<static>|Team whereCreatedAt($value)
- * @method static Builder<static>|Team whereCreatedBy($value)
  * @method static Builder<static>|Team whereId($value)
  * @method static Builder<static>|Team whereName($value)
  * @method static Builder<static>|Team whereRequire2fa($value)
  * @method static Builder<static>|Team whereSlug($value)
  * @method static Builder<static>|Team whereUpdatedAt($value)
+ *
  * @mixin \Eloquent
  */
 #[Fillable(['name', 'slug', 'require_2fa'])]
@@ -43,6 +47,7 @@ class Team extends Model
             ->withPivot('role')
             ->withTimestamps();
     }
+
     public function invites(): HasMany
     {
         return $this->hasMany(TeamInvite::class);

app/Models/TeamInvite.php

@@ -3,15 +3,45 @@
 namespace App\Models;
 
 use App\Notifications\InviteToTeam;
+use Carbon\CarbonImmutable;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Attributes\Scope;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Notifications\DatabaseNotification;
+use Illuminate\Notifications\DatabaseNotificationCollection;
 use Illuminate\Notifications\Notifiable;
 use Illuminate\Notifications\Notification;
 use Str;
 
+/**
+ * @property int $id
+ * @property int $team_id
+ * @property int $invited_by_user_id
+ * @property string $invited_email
+ * @property string $invite_token
+ * @property CarbonImmutable|null $created_at
+ * @property CarbonImmutable|null $updated_at
+ * @property-read User $invitedBy
+ * @property-read DatabaseNotificationCollection<int, DatabaseNotification> $notifications
+ * @property-read int|null $notifications_count
+ * @property-read Team $team
+ *
+ * @method static Builder<static>|TeamInvite findByPlainToken(string $token)
+ * @method static Builder<static>|TeamInvite newModelQuery()
+ * @method static Builder<static>|TeamInvite newQuery()
+ * @method static Builder<static>|TeamInvite query()
+ * @method static Builder<static>|TeamInvite whereCreatedAt($value)
+ * @method static Builder<static>|TeamInvite whereId($value)
+ * @method static Builder<static>|TeamInvite whereInviteToken($value)
+ * @method static Builder<static>|TeamInvite whereInvitedByUserId($value)
+ * @method static Builder<static>|TeamInvite whereInvitedEmail($value)
+ * @method static Builder<static>|TeamInvite whereTeamId($value)
+ * @method static Builder<static>|TeamInvite whereUpdatedAt($value)
+ *
+ * @mixin \Eloquent
+ */
 #[Fillable(['team_id', 'invited_by_user_id', 'invited_email'])]
 class TeamInvite extends Model
 {

app/Models/TeamMember.php

@@ -3,15 +3,16 @@
 namespace App\Models;
 
 use App\Enums\TeamMemberRole;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Carbon\CarbonImmutable;
 use Illuminate\Database\Eloquent\Relations\Pivot;
 
 /**
  * @property int $team_id
  * @property int $user_id
  * @property TeamMemberRole $role
- * @property \Carbon\CarbonImmutable|null $created_at
+ * @property CarbonImmutable|null $created_at
- * @property \Carbon\CarbonImmutable|null $updated_at
+ * @property CarbonImmutable|null $updated_at
+ *
  * @method static \Illuminate\Database\Eloquent\Builder<static>|TeamMember newModelQuery()
  * @method static \Illuminate\Database\Eloquent\Builder<static>|TeamMember newQuery()
  * @method static \Illuminate\Database\Eloquent\Builder<static>|TeamMember query()
@@ -20,6 +21,7 @@ use Illuminate\Database\Eloquent\Relations\Pivot;
  * @method static \Illuminate\Database\Eloquent\Builder<static>|TeamMember whereTeamId($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|TeamMember whereUpdatedAt($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|TeamMember whereUserId($value)
+ *
  * @mixin \Eloquent
  */
 class TeamMember extends Pivot

app/Models/User.php

@@ -2,37 +2,43 @@
 
 namespace App\Models;
 
-use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Carbon\CarbonImmutable;
 use Database\Factories\UserFactory;
+use Illuminate\Contracts\Auth\MustVerifyEmail;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Attributes\Hidden;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
+use Illuminate\Notifications\DatabaseNotification;
+use Illuminate\Notifications\DatabaseNotificationCollection;
 use Illuminate\Notifications\Notifiable;
 use Laravel\Fortify\Contracts\PasskeyUser;
 use Laravel\Fortify\PasskeyAuthenticatable;
 use Laravel\Fortify\TwoFactorAuthenticatable;
+use Laravel\Passkeys\Passkey;
 
 /**
  * @property int $id
  * @property string $name
  * @property string $email
- * @property \Carbon\CarbonImmutable|null $email_verified_at
+ * @property CarbonImmutable|null $email_verified_at
  * @property string $password
- * @property string|null $remember_token
- * @property \Carbon\CarbonImmutable|null $created_at
- * @property \Carbon\CarbonImmutable|null $updated_at
  * @property string|null $two_factor_secret
  * @property string|null $two_factor_recovery_codes
- * @property \Carbon\CarbonImmutable|null $two_factor_confirmed_at
+ * @property CarbonImmutable|null $two_factor_confirmed_at
- * @property-read \Illuminate\Notifications\DatabaseNotificationCollection<int, \Illuminate\Notifications\DatabaseNotification> $notifications
+ * @property string|null $remember_token
+ * @property CarbonImmutable|null $created_at
+ * @property CarbonImmutable|null $updated_at
+ * @property-read DatabaseNotificationCollection<int, DatabaseNotification> $notifications
  * @property-read int|null $notifications_count
- * @property-read \Illuminate\Database\Eloquent\Collection<int, \Laravel\Passkeys\Passkey> $passkeys
+ * @property-read Collection<int, Passkey> $passkeys
  * @property-read int|null $passkeys_count
- * @property-read \App\Models\TeamMember|null $pivot
+ * @property-read TeamMember|null $pivot
- * @property-read \Illuminate\Database\Eloquent\Collection<int, \App\Models\Team> $teams
+ * @property-read Collection<int, Team> $teams
  * @property-read int|null $teams_count
+ *
  * @method static \Database\Factories\UserFactory factory($count = null, $state = [])
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User newModelQuery()
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User newQuery()
@@ -48,11 +54,12 @@ use Laravel\Fortify\TwoFactorAuthenticatable;
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereTwoFactorRecoveryCodes($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereTwoFactorSecret($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereUpdatedAt($value)
+ *
  * @mixin \Eloquent
  */
 #[Fillable(['name', 'email', 'password'])]
 #[Hidden(['password', 'two_factor_secret', 'two_factor_recovery_codes', 'remember_token'])]
-class User extends Authenticatable implements PasskeyUser, MustVerifyEmail
+class User extends Authenticatable implements MustVerifyEmail, PasskeyUser
 {
     /** @use HasFactory<UserFactory> */
     use HasFactory, Notifiable, PasskeyAuthenticatable, TwoFactorAuthenticatable;

database/factories/TeamFactory.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\Team;
+use Illuminate\Database\Eloquent\Factories\Factory;
+use Illuminate\Support\Str;
+
+/** @extends Factory<Team> */
+class TeamFactory extends Factory
+{
+    public function definition(): array
+    {
+        $name = fake()->unique()->company();
+
+        return [
+            'name' => $name,
+            'slug' => Str::slug($name),
+            'require_2fa' => false,
+        ];
+    }
+}

database/factories/TeamInviteFactory.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\TeamInvite;
+use Illuminate\Database\Eloquent\Factories\Factory;
+use Illuminate\Support\Str;
+
+/** @extends Factory<TeamInvite> */
+class TeamInviteFactory extends Factory
+{
+    public function definition(): array
+    {
+        return [
+            'team_id' => TeamFactory::new(),
+            'invited_by_user_id' => UserFactory::new(),
+            'invited_email' => fake()->unique()->safeEmail(),
+            'invite_token' => hash('sha256', Str::random(128)),
+        ];
+    }
+}

database/migrations/2026_09_10_192513_create_teams_table.php

@@ -1,6 +1,5 @@
 <?php
 
-use App\Models\User;
 use Illuminate\Database\Migrations\Migration;
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Support\Facades\Schema;

resources/js/components/TeamSlug.vue

@@ -1,53 +1,80 @@
 <script lang="ts" setup>
-import teamRoutes from '@/routes/teams';
+import { useHttp } from '@inertiajs/vue3';
+import { ref, watch } from 'vue';
+import InputError from '@/components/InputError.vue';
+import { Label } from '@/components/ui/label';
+import { Input } from '@/components/ui/input';
+import { nameToSlug } from '@/routes/teams';
 
-import InputError from "@/components/InputError.vue";
+type TeamSlugRequest = {
-import {Label} from "@/components/ui/label";
+  name: string;
-import {Input} from "@/components/ui/input";
+  ignored_slug: string | null;
-import {watch} from "vue";
+};
 
-type nameToSlugResponse = {
+type TeamSlugResponse = {
   name: string;
   slug: string;
   taken: boolean;
+};
+
+const props = defineProps<{
+  name: string;
+  ignoredSlug?: string;
+  error?: string;
+}>();
+const slug = defineModel<string>('slug', { required: true });
+const slugTaken = defineModel<boolean>('slugTaken', { required: true });
+const previewError = ref('');
+const http = useHttp<TeamSlugRequest, TeamSlugResponse>({
+  name: '',
+  ignored_slug: null,
+});
+
+watch(
+  () => props.name,
+  (name, _previous, onCleanup) => {
+    let active = true;
+    slugTaken.value = false;
+    previewError.value = '';
+
+    const timer = setTimeout(async () => {
+      if (!name.trim()) {
+        slug.value = '';
+        return;
       }
 
-const props = defineProps<{ name: string, ignoredSlug?: string }>()
+      http.name = name;
+      http.ignored_slug = props.ignoredSlug ?? null;
 
-const slug = defineModel<string>('slug', {
+      try {
-  required: true,
+        const response = await http.submit(nameToSlug());
-});
+        if (active) {
-const slugTaken = defineModel<boolean>('slugTaken', {
+          slug.value = response.slug;
-  required: true,
+          slugTaken.value = response.taken;
-});
+          previewError.value = response.taken
-const slugError = defineModel<string>('slugError', {
+            ? 'Der Slug ist bereits vergeben.'
-  required: true,
+            : '';
-});
-
-watch(() => props.name, (newName) => fetch(teamRoutes.nameToSlug().url, {
-    method: 'POST',
-    headers: {'Content-Type': 'application/json'},
-    body: JSON.stringify({name: newName, ignored_slug: props.ignoredSlug})
-  }).then(async (response) => {
-    slugError.value = ''
-    console.info(response)
-    const body = (await response.json()) as unknown as nameToSlugResponse;
-    console.info(body)
-    slug.value = body.slug;
-    slugTaken.value = body.taken;
-    if (slugTaken.value) {
-      slugError.value = 'Der Slug ist bereits vergeben.'
         }
-  }).catch(() => slugError.value = 'Failed to Fetch new slug')
+      } catch {
-)
+        if (active) {
+          previewError.value = 'Die Slug-Vorschau konnte nicht geladen werden.';
+        }
+      }
+    }, 250);
 
+    onCleanup(() => {
+      active = false;
+      clearTimeout(timer);
+      http.cancel();
+    });
+  },
+);
 </script>
 
 <template>
   <div class="grid items-start gap-3">
     <Label for="slug">Slug</Label>
-    <Input id="slug" v-model="slug" disabled name="slug"/>
+    <Input id="slug" :model-value="slug" disabled name="slug" />
-    <InputError :message="slugError"/>
+    <InputError :message="error || previewError" />
   </div>
 </template>
-

resources/js/pages/team/Create.vue

@@ -7,9 +7,9 @@ import {Input} from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
 import InputError from '@/components/InputError.vue';
 import { Checkbox } from '@/components/ui/checkbox';
-import {ref, watch} from "vue";
+import { ref } from 'vue';
-import TeamSlug from "@/components/TeamSlug.vue";
+import TeamSlug from '@/components/TeamSlug.vue';
-import {Card, CardContent} from "@/components/ui/card";
+import { Card, CardContent } from '@/components/ui/card';
 
 defineOptions({
   layout: {
@@ -26,36 +26,37 @@ defineOptions({
   },
 });
 
-const slug = ref('');
 const slugTaken = ref(false);
-const slugError = ref<string>('');
 
 const form = useForm({
   name: '',
+  slug: '',
   require_2fa: false,
 });
 
 function submit(): void {
   form.submit(teamRoutes.store());
 }
-
-watch(() => (form.errors as any).slug, (newError) => slugError.value = newError)
 </script>
 
 <template>
-  <Head title="Teams"/>
-
   <div class="flex flex-col justify-center p-16">
+    <Head title="Teams" />
     <Card class="w-full">
       <CardContent>
         <form class="grid w-full gap-5 py-4" @submit.prevent="submit">
-          <div class="grid grid-cols-2 gap-5 items-start">
+          <div class="grid grid-cols-2 items-start gap-5">
             <div class="grid items-start gap-3">
               <Label for="name">Name</Label>
               <Input id="name" v-model="form.name" name="name" />
               <InputError :message="form.errors.name" />
             </div>
-            <TeamSlug :name="form.name" :slug="slug" :slug-error="slugError" :slug-taken="slugTaken"/>
+            <TeamSlug
+              :name="form.name"
+              v-model:slug="form.slug"
+              :error="form.errors.slug"
+              v-model:slug-taken="slugTaken"
+            />
             <div class="grid items-start gap-3">
               <Label for="require_2fa">Require 2FA</Label>
               <Checkbox
@@ -67,7 +68,11 @@ watch(() => (form.errors as any).slug, (newError) => slugError.value = newError)
             </div>
           </div>
           <div class="flex w-full justify-end">
-            <Button :disabled="form.processing || slugTaken" class="w-fit" type="submit">
+            <Button
+              :disabled="form.processing || slugTaken"
+              class="w-fit"
+              type="submit"
+            >
               <component :is="Save" />
               Erstellen
             </Button>

resources/js/pages/team/Edit.vue

@@ -7,10 +7,10 @@ import {Input} from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
 import InputError from '@/components/InputError.vue';
 import { Checkbox } from '@/components/ui/checkbox';
-import {Team} from '@/types/models';
+import type { Team } from '@/types/models';
-import {ref, watch} from "vue";
+import { ref } from 'vue';
-import TeamSlug from "@/components/TeamSlug.vue";
+import TeamSlug from '@/components/TeamSlug.vue';
-import {Card, CardContent} from "@/components/ui/card";
+import { Card, CardContent } from '@/components/ui/card';
 
 const props = defineProps<{
   team: Team;
@@ -24,42 +24,43 @@ setLayoutProps({
     },
     {
       title: props.team.name,
-      href: teamRoutes.create(),
+      href: teamRoutes.show({ team: props.team.slug }),
     },
   ],
 });
 
-const slug = ref(props.team.slug);
 const slugTaken = ref(false);
-const slugError = ref<string>('');
 
 const form = useForm({
   name: props.team.name,
+  slug: props.team.slug,
   require_2fa: props.team.multi_factor_required,
 });
 
 function submit(): void {
   form.patch(teamRoutes.update({ team: props.team.slug }).url);
 }
-
-watch(() => (form.errors as any).slug, (newError) => slugError.value = newError)
 </script>
 
 <template>
-  <Head title="Teams"/>
-
   <div class="flex flex-col justify-center p-16">
+    <Head title="Teams" />
     <Card class="w-full">
       <CardContent>
         <form class="grid w-full gap-5 py-4" @submit.prevent="submit">
-          <div class="grid grid-cols-2 gap-5 items-start">
+          <div class="grid grid-cols-2 items-start gap-5">
             <div class="grid items-start gap-3">
               <Label for="name">Name</Label>
               <Input id="name" v-model="form.name" name="name" />
               <InputError :message="form.errors.name" />
             </div>
-            <TeamSlug :ignored-slug="team.slug" :name="form.name" :slug="slug" :slug-error="slugError"
+            <TeamSlug
-                      :slug-taken="slugTaken"/>
+              :ignored-slug="team.slug"
+              :name="form.name"
+              v-model:slug="form.slug"
+              :error="form.errors.slug"
+              v-model:slug-taken="slugTaken"
+            />
             <div class="grid items-start gap-3">
               <Label for="require_2fa">Require 2FA</Label>
               <Checkbox
@@ -71,7 +72,11 @@ watch(() => (form.errors as any).slug, (newError) => slugError.value = newError)
             </div>
           </div>
           <div class="flex w-full justify-end">
-            <Button :disabled="form.processing || slugTaken" class="w-fit" type="submit">
+            <Button
+              :disabled="form.processing || slugTaken"
+              class="w-fit"
+              type="submit"
+            >
               <component :is="Save" />
               Speichern
             </Button>

resources/js/pages/team/Index.vue

@@ -4,7 +4,15 @@ import {Head, Link, router, usePage} from '@inertiajs/vue3';
 import type { Team } from '@/types/models';
 import TextLink from '@/components/TextLink.vue';
 import { Card, CardContent } from '@/components/ui/card';
-import {Table, TableBody, TableCaption, TableCell, TableHead, TableHeader, TableRow,} from '@/components/ui/table';
+import {
+  Table,
+  TableBody,
+  TableCaption,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table';
 import { Button } from '@/components/ui/button';
 import { Eye, Pencil, Plus } from '@lucide/vue';
 
@@ -33,9 +41,8 @@ const canManageTeam = (team: Team) =>
 </script>
 
 <template>
-  <Head title="Teams"/>
-
   <div class="flex flex-col justify-center p-16">
+    <Head title="Teams" />
     <div class="flex w-full justify-end py-4">
       <Link :href="teamRoutes.create()">
         <Button>
@@ -59,25 +66,34 @@ const canManageTeam = (team: Team) =>
           <TableBody>
             <TableRow
               v-for="team in teams"
-              v-if="teams.length > 0"
               :key="team.slug"
               role="link"
               tabindex="0"
               @click="openTeam(team)"
+              @keydown.enter.self="openTeam(team)"
             >
               <TableCell>{{ team.name }}</TableCell>
               <TableCell>{{ team.slug }}</TableCell>
               <TableCell>{{ team.members.length }}</TableCell>
-              <TableCell>{{ team.multi_factor_required ? 'Ja' : 'Nein' }}</TableCell>
+              <TableCell>{{
+                team.multi_factor_required ? 'Ja' : 'Nein'
+              }}</TableCell>
+              <TableCell>
                 <Link
-                :href="(canManageTeam(team) ? teamRoutes.edit : teamRoutes.show)({ team: team.slug })"
+                  :href="
+                    (canManageTeam(team) ? teamRoutes.edit : teamRoutes.show)({
+                      team: team.slug,
+                    })
+                  "
                   class="cursor-pointer"
                   @click.stop
                 >
-                <TableCell>
+                  <component
-                  <component :is="canManageTeam(team) ? Pencil : Eye" size="18"/>
+                    :is="canManageTeam(team) ? Pencil : Eye"
-                </TableCell>
+                    size="18"
+                  />
                 </Link>
+              </TableCell>
             </TableRow>
           </TableBody>
           <TableCaption v-if="teams.length <= 0">

resources/js/pages/team/Show.vue

@@ -1,9 +1,17 @@
 <script lang="ts" setup>
 import teamRoutes from '@/routes/teams';
-import {Head, Link, setLayoutProps} from '@inertiajs/vue3';
+import { Head, Link, setLayoutProps, useForm } from '@inertiajs/vue3';
 import type { Team, TeamInvite } from '@/types/models';
+import InputError from '@/components/InputError.vue';
 import { Card, CardContent } from '@/components/ui/card';
-import {Table, TableBody, TableCell, TableHead, TableHeader, TableRow,} from '@/components/ui/table';
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table';
 import { Button } from '@/components/ui/button';
 import { Pencil, Trash } from '@lucide/vue';
 
@@ -26,18 +34,23 @@ setLayoutProps({
   ],
 });
 
-const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(teamInvite.team.slug).url, {
+const revokeForm = useForm({ email: '' });
-  method: 'POST',
-  headers: {'Content-Type': 'application/json'},
-  body: JSON.stringify({email: teamInvite.invitedEmail})
-})
 
+function revokeInvite(invite: TeamInvite): void {
+  if (revokeForm.processing) {
+    return;
+  }
+
+  revokeForm.email = invite.invitedEmail;
+  revokeForm.submit(teamRoutes.invite.revoke({ team: props.team.slug }), {
+    preserveScroll: true,
+  });
+}
 </script>
 
 <template>
-  <Head title="Teams"/>
-
   <div class="flex flex-col justify-center p-16">
+    <Head title="Teams" />
     <div v-if="canManageTeam" class="flex w-full justify-end py-4">
       <Link :href="teamRoutes.edit({ team: team.slug })">
         <Button>
@@ -47,18 +60,20 @@ const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(
       </Link>
     </div>
 
-    <Card class="w-full mb-8">
+    <Card class="mb-8 w-full">
       <CardContent class="flex flex-col">
-        <h1 class="font-semibold text-2xl">{{ team.name }}</h1>
+        <h1 class="text-2xl font-semibold">{{ team.name }}</h1>
         <Table>
-          <TableBody class="[&_td]:py-0 [&_tr]:border-0 text-gray-500 text-sm">
+          <TableBody class="text-sm text-gray-500 [&_td]:py-0 [&_tr]:border-0">
             <TableRow>
               <TableCell class="font-bold">Slug:</TableCell>
               <TableCell>{{ team.slug }}</TableCell>
             </TableRow>
             <TableRow>
               <TableCell class="font-bold">Erfordert 2FA:</TableCell>
-              <TableCell>{{ team.multi_factor_required ? 'Ja' : 'Nein' }}</TableCell>
+              <TableCell>{{
+                team.multi_factor_required ? 'Ja' : 'Nein'
+              }}</TableCell>
             </TableRow>
             <TableRow>
               <TableCell class="font-bold">Erstellt am:</TableCell>
@@ -68,9 +83,9 @@ const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(
         </Table>
       </CardContent>
     </Card>
-    <Card class="w-full mb-8">
+    <Card class="mb-8 w-full">
       <CardContent>
-        <h2 class="font-semibold text-lg">Mitglieder</h2>
+        <h2 class="text-lg font-semibold">Mitglieder</h2>
         <Table>
           <TableHeader>
             <TableRow>
@@ -82,10 +97,12 @@ const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(
             </TableRow>
           </TableHeader>
           <TableBody>
-            <TableRow v-for="member in team.members">
+            <TableRow v-for="member in team.members" :key="member.email">
               <TableCell>{{ member.name }}</TableCell>
               <TableCell>{{ member.email }}</TableCell>
-              <TableCell>{{ member.has_multi_factor ? 'Ja' : 'Nein' }}</TableCell>
+              <TableCell>{{
+                member.has_multi_factor ? 'Ja' : 'Nein'
+              }}</TableCell>
               <TableCell>{{ member.role }}</TableCell>
               <TableCell>{{ member.joined_at }}</TableCell>
             </TableRow>
@@ -93,9 +110,10 @@ const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(
         </Table>
       </CardContent>
     </Card>
-    <Card v-if="teamInvites" class="w-full mb-8">
+    <Card v-if="teamInvites" class="mb-8 w-full">
       <CardContent>
-        <h2 class="font-semibold text-lg">Ausstehende Invites</h2>
+        <h2 class="text-lg font-semibold">Ausstehende Invites</h2>
+        <InputError :message="revokeForm.errors.email" />
         <Table>
           <TableHeader>
             <TableRow>
@@ -105,19 +123,22 @@ const revokeInvite = (teamInvite: TeamInvite) => fetch(teamRoutes.invite.revoke(
             </TableRow>
           </TableHeader>
           <TableBody>
-            <TableRow v-for="invite in teamInvites">
+            <TableRow v-for="invite in teamInvites" :key="invite.invitedEmail">
               <TableCell>{{ invite.invitedEmail }}</TableCell>
               <TableCell>{{ invite.invitedBy.name }}</TableCell>
               <TableCell>{{ invite.invitedAt }}</TableCell>
-              <Link
+              <TableCell>
-                :href="teamRoutes.invite.revoke({team: invite.team.slug})"
+                <Button
-                class="cursor-pointer"
+                  type="button"
+                  variant="ghost"
+                  size="icon"
+                  :disabled="revokeForm.processing"
+                  :aria-label="`Einladung für ${invite.invitedEmail} widerrufen`"
                   @click="revokeInvite(invite)"
                 >
-                <TableCell>
+                  <Trash :size="18" />
-                  <component :is="Trash" size="18"/>
+                </Button>
               </TableCell>
-              </Link>
             </TableRow>
           </TableBody>
         </Table>

resources/js/pages/team/invite/Create.vue

@@ -1,10 +1,10 @@
 <script lang="ts" setup>
 import teamRoutes from '@/routes/teams';
 import { Form, Head, useForm } from '@inertiajs/vue3';
-import {Card, CardContent} from "@/components/ui/card";
+import { Card, CardContent } from '@/components/ui/card';
-import {Input} from "@/components/ui/input";
+import { Input } from '@/components/ui/input';
-import InputError from "@/components/InputError.vue";
+import InputError from '@/components/InputError.vue';
-import {Button} from "@/components/ui/button";
+import { Button } from '@/components/ui/button';
 
 defineOptions({
   layout: {
@@ -22,15 +22,14 @@ defineOptions({
 });
 
 const props = defineProps<{
-  inviteToken?: string,
+  inviteToken?: string;
-}>()
+}>();
 
 const form = useForm({
-  inviteToken: props.inviteToken
+  inviteToken: props.inviteToken,
-})
+});
-
-const submit = () => form.post(teamRoutes.invite.store().url)
 
+const submit = () => form.post(teamRoutes.invite.store().url);
 </script>
 
 <template>
@@ -39,15 +38,21 @@ const submit = () => form.post(teamRoutes.invite.store().url)
   <div class="flex flex-col justify-center p-16">
     <Card class="w-full">
       <CardContent>
-        <h1 class="font-bold text-2xl">Team Einladung</h1>
+        <h1 class="text-2xl font-bold">Team Einladung</h1>
         <form class="grid gap-y-3" @submit.prevent="submit">
           <div class="grid items-start gap-3">
-            <Input id="inviteToken" v-model="form.inviteToken" name="inviteToken" placeholder="Token"/>
+            <Input
+              id="inviteToken"
+              v-model="form.inviteToken"
+              name="inviteToken"
+              placeholder="Token"
+            />
             <InputError :message="form.errors.inviteToken" />
           </div>
-          <div class="w-full flex justify-end">
+          <div class="flex w-full justify-end">
-
+            <Button :disabled="form.processing" type="submit"
-            <Button :disabled="form.processing" type="submit">Team Beitreten</Button>
+              >Team Beitreten</Button
+            >
           </div>
         </form>
       </CardContent>

resources/js/types/models.ts

@@ -3,7 +3,7 @@ export interface Team {
   slug: string;
   members: TeamMember[];
   multi_factor_required: boolean;
-  created_at: string
+  created_at: string;
 }
 
 export type TeamMemberRole = 'admin' | 'member';
@@ -21,7 +21,6 @@ export interface TeamMember extends User {
 
 export interface TeamInvite {
   invitedEmail: string;
-  team: Team;
   invitedBy: User;
   invitedAt: string;
 }

routes/web.php

@@ -2,6 +2,7 @@
 
 use App\Http\Controllers\TeamController;
 use App\Http\Controllers\TeamInviteAcceptController;
+use App\Models\Team;
 use Illuminate\Support\Facades\Route;
 
 Route::inertia('/', 'Welcome')->name('home');
@@ -10,24 +11,22 @@ Route::middleware(['auth'])->group(function () {
     Route::inertia('dashboard', 'Dashboard')->name('dashboard');
 
     Route::controller(TeamController::class)->prefix('teams')->name('teams.')->group(function () {
-        Route::prefix('invite')->name('invite.')->group(function () {
+        Route::name('invite.')->group(function () {
-            Route::get('/accept', [TeamInviteAcceptController::class, 'create'])->name('create');
+            Route::get('invite/accept', [TeamInviteAcceptController::class, 'create'])->name('create');
-            Route::post('/accept', [TeamInviteAcceptController::class, 'store'])->name('store');
+            Route::post('invite/accept', [TeamInviteAcceptController::class, 'store'])->name('store');
+            Route::post('{team:slug}/invite', [TeamController::class, 'invite'])->name('invite');
+            Route::post('{team:slug}/invite/revoke', [TeamController::class, 'revokeInvite'])->name('revoke')->can('manage', 'team');
         });
 
         Route::get('/', 'index')->name('index');
-        Route::get('/create', 'create')->name('create');
+        Route::get('/create', 'create')->name('create')->can('create', Team::class);
-        Route::post('/', 'store')->name('store');
+        Route::post('/', 'store')->name('store')->can('create', Team::class);
-        Route::get('/edit/{team:slug}', 'edit')->name('edit');
+        Route::get('/edit/{team:slug}', 'edit')->name('edit')->can('manage', 'team');
-        Route::patch('/{team:slug}', 'update')->name('update');
+        Route::patch('/{team:slug}', 'update')->name('update')->can('manage', 'team');
         Route::post('/name-to-slug', 'nameToSlug')->name('nameToSlug');
-        Route::get('/{team:slug}', 'show')->name('show');
+        Route::get('/{team:slug}', 'show')->name('show')->can('view', 'team');
-        Route::post('{team:slug}/invite', [TeamController::class, 'invite'])->name('invite');
-        Route::post('{team:slug}/invite/revoke', [TeamController::class, 'revokeInvite'])->name('invite.revoke');
     });
 
-
 });
 
-
 require __DIR__.'/settings.php';

tests/Feature/TeamControllerTest.php

@@ -0,0 +1,306 @@
+<?php
+
+use App\Enums\TeamMemberRole;
+use App\Models\Team;
+use App\Models\TeamInvite;
+use App\Models\TeamMember;
+use App\Models\User;
+use Database\Factories\TeamFactory;
+use Database\Factories\TeamInviteFactory;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Exceptions;
+use Inertia\Testing\AssertableInertia as Assert;
+
+test('team endpoints require authentication', function (string $method, string $routeName) {
+    $team = TeamFactory::new()->create();
+
+    $this->{$method}(route($routeName, $team->slug))->assertRedirect(route('login'));
+})->with([
+    ['get', 'teams.index'],
+    ['get', 'teams.show'],
+    ['get', 'teams.create'],
+    ['post', 'teams.store'],
+    ['get', 'teams.edit'],
+    ['patch', 'teams.update'],
+    ['post', 'teams.invite.revoke'],
+    ['post', 'teams.nameToSlug'],
+]);
+
+test('outsiders cannot read a team', function () {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+
+    $this->actingAs($user)->get(route('teams.show', $team->slug))->assertForbidden();
+});
+
+test('members cannot access the team edit form', function () {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Member]);
+
+    $this->actingAs($user)->get(route('teams.edit', $team->slug))->assertForbidden();
+});
+
+test('members and outsiders cannot modify a team', function (bool $isMember) {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    if ($isMember) {
+        $team->members()->attach($user, ['role' => TeamMemberRole::Member]);
+    }
+
+    $this->actingAs($user)->patch(route('teams.update', $team->slug), [
+        'name' => 'Hijacked', 'require_2fa' => true,
+    ])->assertForbidden();
+
+    $this->assertDatabaseHas('teams', ['id' => $team->id, 'name' => $team->name, 'require_2fa' => false]);
+})->with([true, false]);
+
+test('unverified users cannot create teams', function (string $method, string $routeName) {
+    $user = User::factory()->unverified()->create();
+
+    $this->actingAs($user)->{$method}(route($routeName), [
+        'name' => 'Test Team', 'require_2fa' => false,
+    ])->assertForbidden();
+
+    $this->assertDatabaseCount('teams', 0);
+})->with([['get', 'teams.create'], ['post', 'teams.store']]);
+
+test('team creation derives the slug and adds its creator as admin', function () {
+    $user = User::factory()->create();
+
+    $this->actingAs($user)->post(route('teams.store'), [
+        'name' => 'Test Team', 'slug' => 'forged', 'require_2fa' => true, 'id' => 999,
+    ])->assertSessionHasNoErrors()->assertRedirect(route('teams.index'));
+
+    $this->assertDatabaseHas('teams', ['name' => 'Test Team', 'slug' => 'test-team', 'require_2fa' => true]);
+    $this->assertDatabaseHas('team_members', ['user_id' => $user->id, 'role' => 'admin']);
+    $this->assertDatabaseMissing('teams', ['id' => 999]);
+});
+
+test('admins can rename teams and follow the updated slug', function () {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
+
+    $this->actingAs($user)->patch(route('teams.update', $team->slug), [
+        'name' => 'New Name', 'slug' => 'forged', 'require_2fa' => true,
+    ])->assertSessionHasNoErrors()->assertRedirect(route('teams.show', 'new-name'));
+
+    $this->assertDatabaseHas('teams', ['id' => $team->id, 'name' => 'New Name', 'slug' => 'new-name', 'require_2fa' => true]);
+});
+
+test('updating settings without a name preserves the existing slug', function () {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
+
+    $this->actingAs($user)->patch(route('teams.update', $team->slug), [
+        'require_2fa' => true, 'slug' => 'forged',
+    ])->assertSessionHasNoErrors()->assertRedirect(route('teams.show', $team->slug));
+
+    $this->assertDatabaseHas('teams', ['id' => $team->id, 'name' => $team->name, 'slug' => $team->slug, 'require_2fa' => true]);
+});
+
+test('invalid names are rejected without server errors', function (mixed $name, string $errorKey, string $method, string $routeName) {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
+
+    $this->actingAs($user)->{$method}(route($routeName, $team->slug), [
+        'name' => $name, 'require_2fa' => false,
+    ])->assertUnprocessable()->assertJsonValidationErrors($errorKey);
+
+    $this->assertDatabaseCount('teams', 1);
+    $this->assertDatabaseHas('teams', ['id' => $team->id, 'name' => $team->name, 'slug' => $team->slug]);
+})->with([
+    'array' => [['bad'], 'name'],
+    'empty' => ['', 'name'],
+    'null' => [null, 'name'],
+    'no slug characters' => ['!!!', 'slug'],
+    'reserved path' => ['Create', 'slug'],
+])->with([['postJson', 'teams.store'], ['patchJson', 'teams.update']]);
+
+test('duplicate team slugs are rejected', function (string $method, string $routeName) {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    TeamFactory::new()->create(['name' => 'Taken Name', 'slug' => 'taken-name']);
+    $team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
+
+    $this->actingAs($user)->{$method}(route($routeName, $team->slug), [
+        'name' => 'Taken Name', 'require_2fa' => false,
+    ])->assertUnprocessable()->assertJsonValidationErrors(['slug' => 'The name has already been taken.']);
+})->with([['postJson', 'teams.store'], ['patchJson', 'teams.update']]);
+
+test('team index only lists memberships', function () {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Member]);
+
+    $this->actingAs($user)->get(route('teams.index'))->assertInertia(fn (Assert $page) => $page
+        ->component('team/Index')->has('teams', 1)->where('teams.0.slug', $team->slug));
+});
+
+test('members can view their team without seeing pending invites', function () {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Member]);
+    TeamInviteFactory::new()->createQuietly(['team_id' => $team->id, 'invited_by_user_id' => $user->id]);
+
+    $this->actingAs($user)->get(route('teams.show', $team->slug))->assertInertia(fn (Assert $page) => $page
+        ->component('team/Show')->where('canManageTeam', false)->missing('teamInvites'));
+});
+
+test('admins see pending invites without tokens or repeated team data', function () {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
+    $invite = TeamInviteFactory::new()->createQuietly(['team_id' => $team->id, 'invited_by_user_id' => $user->id]);
+
+    $this->actingAs($user)->get(route('teams.show', $team->slug))->assertInertia(fn (Assert $page) => $page
+        ->component('team/Show')->where('canManageTeam', true)->has('teamInvites', 1)
+        ->where('teamInvites.0.invitedEmail', $invite->invited_email)
+        ->missing('teamInvites.0.invite_token')->missing('teamInvites.0.team')
+        ->missing('team.members.0.password')->missing('team.members.0.two_factor_secret'));
+});
+
+test('member two factor status requires confirmed two factor authentication', function (bool $enabled, bool $confirmed, bool $expected) {
+    $user = User::factory()->create();
+    $member = User::factory()->create([
+        'two_factor_secret' => $enabled ? encrypt('secret') : null,
+        'two_factor_confirmed_at' => $confirmed ? now() : null,
+    ]);
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
+    $team->members()->attach($member, ['role' => TeamMemberRole::Member]);
+
+    $this->actingAs($user)->get(route('teams.show', $team->slug))->assertInertia(fn (Assert $page) => $page
+        ->where('team.members.1.has_multi_factor', $expected));
+})->with([
+    'verified email only' => [false, false, false],
+    'unconfirmed setup' => [true, false, false],
+    'confirmed 2fa' => [true, true, true],
+]);
+
+test('members cannot revoke invitations even with invalid input', function () {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Member]);
+    $invite = TeamInviteFactory::new()->createQuietly(['team_id' => $team->id, 'invited_by_user_id' => $user->id]);
+
+    $this->actingAs($user)->postJson(route('teams.invite.revoke', $team->slug), [])->assertForbidden();
+
+    $this->assertModelExists($invite);
+});
+
+test('admins cannot revoke invitations of another team', function () {
+    $user = User::factory()->create();
+    $ownTeam = TeamFactory::new()->create();
+    $ownTeam->members()->attach($user, ['role' => TeamMemberRole::Admin]);
+    $invite = TeamInviteFactory::new()->createQuietly();
+
+    $this->actingAs($user)->postJson(route('teams.invite.revoke', $invite->team->slug), [
+        'email' => $invite->invited_email,
+    ])->assertForbidden();
+
+    $this->assertModelExists($invite);
+});
+
+test('revoke does not reveal whether an email is invited to another team', function (bool $hasOtherInvite) {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
+    if ($hasOtherInvite) {
+        TeamInviteFactory::new()->createQuietly(['invited_email' => 'elsewhere@example.com']);
+    }
+
+    $this->actingAs($user)->postJson(route('teams.invite.revoke', $team->slug), [
+        'email' => 'elsewhere@example.com',
+    ])->assertNotFound();
+
+    $this->assertDatabaseCount('team_invites', $hasOtherInvite ? 1 : 0);
+})->with([true, false]);
+
+test('admins revoke only the matching invitation and return to the team', function () {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
+    $invite = TeamInviteFactory::new()->createQuietly(['team_id' => $team->id, 'invited_by_user_id' => $user->id]);
+    $otherInvite = TeamInviteFactory::new()->createQuietly(['invited_email' => $invite->invited_email]);
+
+    $this->actingAs($user)->post(route('teams.invite.revoke', $team->slug), [
+        'email' => $invite->invited_email,
+    ])->assertSessionHasNoErrors()->assertRedirect(route('teams.show', $team->slug));
+
+    $this->assertModelMissing($invite);
+    $this->assertModelExists($otherInvite);
+});
+
+test('slug preview reports availability and allows the unchanged slug', function (string $name, ?string $ignoredSlug, bool $taken) {
+    $user = User::factory()->create();
+    TeamFactory::new()->create(['name' => 'Existing Team', 'slug' => 'existing-team']);
+
+    $this->actingAs($user)->postJson(route('teams.nameToSlug'), [
+        'name' => $name, 'ignored_slug' => $ignoredSlug,
+    ])->assertOk()->assertJsonPath('taken', $taken);
+})->with([
+    ['Existing Team', null, true],
+    ['Existing Team', 'existing-team', false],
+    ['New Team', null, false],
+    ['Create', null, true],
+]);
+
+test('team creation rolls back when admin membership cannot be saved', function () {
+    $user = User::factory()->create();
+    $exception = new RuntimeException('Membership persistence failed.');
+    Exceptions::fake();
+    Event::listen('eloquent.creating: '.TeamMember::class, function () use ($exception): void {
+        throw $exception;
+    });
+
+    $this->actingAs($user)->from(route('teams.create'))->post(route('teams.store'), [
+        'name' => 'Test Team', 'require_2fa' => false,
+    ])->assertRedirect(route('teams.create'))->assertSessionHas('_old_input.name', 'Test Team');
+
+    $this->assertDatabaseCount('teams', 0);
+    $this->assertDatabaseCount('team_members', 0);
+    $this->assertModelExists($user);
+    Exceptions::assertReported(fn (RuntimeException $reported): bool => $reported === $exception);
+});
+
+test('failed updates return to the original edit form and report the error', function () {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
+    $exception = new RuntimeException('Team persistence failed.');
+    Exceptions::fake();
+    Event::listen('eloquent.updating: '.Team::class, function () use ($exception): void {
+        throw $exception;
+    });
+
+    $this->actingAs($user)->from(route('teams.edit', $team->slug))->patch(route('teams.update', $team->slug), [
+        'name' => 'New Name', 'require_2fa' => true,
+    ])->assertRedirect(route('teams.edit', $team->slug))->assertSessionHas('_old_input.name', 'New Name');
+
+    $this->assertDatabaseHas('teams', ['id' => $team->id, 'name' => $team->name, 'slug' => $team->slug, 'require_2fa' => false]);
+    Exceptions::assertReported(fn (RuntimeException $reported): bool => $reported === $exception);
+});
+
+test('failed revocations preserve the invitation and report the error', function () {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    $team->members()->attach($user, ['role' => TeamMemberRole::Admin]);
+    $invite = TeamInviteFactory::new()->createQuietly(['team_id' => $team->id, 'invited_by_user_id' => $user->id]);
+    $exception = new RuntimeException('Invite deletion failed.');
+    Exceptions::fake();
+    Event::listen('eloquent.deleting: '.TeamInvite::class, function () use ($exception): void {
+        throw $exception;
+    });
+
+    $this->actingAs($user)->post(route('teams.invite.revoke', $team->slug), [
+        'email' => $invite->invited_email,
+    ])->assertRedirect(route('teams.show', $team->slug));
+
+    $this->assertModelExists($invite);
+    Exceptions::assertReported(fn (RuntimeException $reported): bool => $reported === $exception);
+});

tests/Feature/TeamPolicyTest.php

@@ -0,0 +1,29 @@
+<?php
+
+use App\Enums\TeamMemberRole;
+use App\Models\Team;
+use App\Models\User;
+use Database\Factories\TeamFactory;
+
+test('team permissions follow membership and role', function (?TeamMemberRole $role, bool $canView, bool $canManage) {
+    $user = User::factory()->create();
+    $team = TeamFactory::new()->create();
+    if ($role !== null) {
+        $team->members()->attach($user, ['role' => $role]);
+    }
+
+    expect($user->can('view', $team))->toBe($canView);
+    expect($user->can('manage', $team))->toBe($canManage);
+})->with([
+    'outsider' => [null, false, false],
+    'member' => [TeamMemberRole::Member, true, false],
+    'admin' => [TeamMemberRole::Admin, true, true],
+]);
+
+test('team creation requires a verified email', function () {
+    $verified = User::factory()->create();
+    $unverified = User::factory()->unverified()->create();
+
+    expect($verified->can('create', Team::class))->toBeTrue();
+    expect($unverified->can('create', Team::class))->toBeFalse();
+});