Member update endpoint can now change ownership

tests/TestCaseWithDatabase.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Tests;
 
+use App\Enums\Role;
 use App\Models\Member;
 use App\Models\Organization;
 use App\Models\User;
@@ -18,7 +19,7 @@ abstract class TestCaseWithDatabase extends TestCase
 
     /**
      * @param  array<string>  $permissions
-     * @return object{user: User, organization: Organization, member: Member}
+     * @return object{user: User, organization: Organization, member: Member, owner: User, ownerMember: Member}
      */
     protected function createUserWithPermission(array $permissions = [], bool $isOwner = false): object
     {
@@ -29,7 +30,11 @@ abstract class TestCaseWithDatabase extends TestCase
         if ($isOwner) {
             $organization = Organization::factory()->withOwner($user)->create();
         } else {
-            $organization = Organization::factory()->create();
+            $owner = User::factory()->create();
+            $organization = Organization::factory()->withOwner($owner)->create();
+            $ownerMember = Member::factory()->forUser($owner)->forOrganization($organization)->create([
+                'role' => Role::Owner->value,
+            ]);
         }
         $member = Member::factory()->forUser($user)->forOrganization($organization)->create([
             'role' => $roleName,
@@ -39,6 +44,8 @@ abstract class TestCaseWithDatabase extends TestCase
             'user' => $user,
             'organization' => $organization,
             'member' => $member,
+            'owner' => $isOwner ? $user : $owner,
+            'ownerMember' => $isOwner ? $member : $ownerMember,
         ];
     }
 

tests/Unit/Endpoint/Api/V1/MemberEndpointTest.php

@@ -91,18 +91,18 @@ class MemberEndpointTest extends ApiEndpointTestAbstract
         $data = $this->createUserWithPermission([
             'members:update',
         ]);
+        $member = Member::factory()->forOrganization($data->organization)->role(Role::Admin)->create();
         $this->assertBillableRateServiceIsUnused();
         Passport::actingAs($data->user);
 
         // Act
-        $response = $this->putJson(route('api.v1.members.update', [$data->organization->id, $data->member]), [
+        $response = $this->putJson(route('api.v1.members.update', [$data->organization->id, $member]), [
             'billable_rate' => 10001,
             'role' => Role::Employee->value,
         ]);
 
         // Assert
         $response->assertStatus(200);
-        $member = $data->member;
         $member->refresh();
         $this->assertSame(10001, $member->billable_rate);
         $this->assertSame(Role::Employee->value, $member->role);
@@ -155,7 +155,7 @@ class MemberEndpointTest extends ApiEndpointTestAbstract
         $this->assertSame(Role::Admin->value, $otherMember->role);
     }
 
-    public function test_update_member_role_fails_if_role_is_owner(): void
+    public function test_update_member_allows_role_owner_in_request_if_that_would_not_the_role(): void
     {
         // Arrange
         $data = $this->createUserWithPermission([
@@ -164,13 +164,97 @@ class MemberEndpointTest extends ApiEndpointTestAbstract
         Passport::actingAs($data->user);
 
         // Act
-        $response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $data->member->getKey()]), [
+        $response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $data->ownerMember->getKey()]), [
             'role' => Role::Owner->value,
         ]);
 
         // Assert
-        $response->assertStatus(422);
-        $response->assertJsonPath('message', 'The selected role is invalid.');
+        $response->assertStatus(200);
+    }
+
+    public function test_update_member_fails_if_user_tries_to_change_role_to_owner(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'members:update',
+        ]);
+        $member = Member::factory()->forOrganization($data->organization)->role(Role::Employee)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $member->getKey()]), [
+            'role' => Role::Owner->value,
+        ]);
+
+        // Assert
+        $response->assertStatus(400);
+        $response->assertJsonPath('message', 'Only owner can change ownership');
+    }
+
+    public function test_update_member_fails_if_user_tries_to_change_role_of_the_current_owner(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'members:update',
+            'members:change-ownership',
+        ]);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $data->ownerMember->getKey()]), [
+            'role' => Role::Admin->value,
+        ]);
+
+        // Assert
+        $response->assertStatus(400);
+        $response->assertJsonPath('message', 'Organization needs at least one owner');
+    }
+
+    public function test_update_member_can_change_role_to_everything_expect_owner_with_the_member_update_permission(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'members:update',
+        ]);
+        $member = Member::factory()->forOrganization($data->organization)->role(Role::Employee)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $member->getKey()]), [
+            'role' => Role::Admin->value,
+        ]);
+
+        // Assert
+        $response->assertStatus(200);
+        $member->refresh();
+        $this->assertSame(Role::Admin->value, $member->role);
+    }
+
+    public function test_update_member_can_change_role_to_owner_if_auth_user_has_change_ownership_permission(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'members:update',
+            'members:change-ownership',
+        ]);
+        $oldOwner = $data->ownerMember;
+        $organization = $data->organization;
+        $member = Member::factory()->forOrganization($data->organization)->role(Role::Employee)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $member->getKey()]), [
+            'role' => Role::Owner->value,
+        ]);
+
+        // Assert
+        $response->assertStatus(200);
+        $member->refresh();
+        $organization->refresh();
+        $oldOwner->refresh();
+        $this->assertSame(Role::Owner->value, $member->role);
+        $this->assertSame($member->user_id, $organization->user_id);
+        $this->assertSame(Role::Admin->value, $oldOwner->role);
     }
 
     public function test_update_member_role_fails_if_role_is_placeholder(): void
@@ -179,16 +263,17 @@ class MemberEndpointTest extends ApiEndpointTestAbstract
         $data = $this->createUserWithPermission([
             'members:update',
         ]);
+        $member = Member::factory()->forOrganization($data->organization)->role(Role::Employee)->create();
         Passport::actingAs($data->user);
 
         // Act
-        $response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $data->member->getKey()]), [
+        $response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $member->getKey()]), [
             'role' => Role::Placeholder->value,
         ]);
 
         // Assert
-        $response->assertStatus(422);
-        $response->assertJsonPath('message', 'The selected role is invalid.');
+        $response->assertStatus(400);
+        $response->assertJsonPath('message', 'Changing role to placeholder is not allowed');
     }
 
     public function test_invite_placeholder_succeeds_if_data_is_valid(): void

tests/Unit/Service/MemberServiceTest.php

@@ -0,0 +1,116 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Service;
+
+use App\Enums\Role;
+use App\Models\Member;
+use App\Models\Organization;
+use App\Models\Project;
+use App\Models\ProjectMember;
+use App\Models\TimeEntry;
+use App\Models\User;
+use App\Service\MemberService;
+use App\Service\UserService;
+use InvalidArgumentException;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\UsesClass;
+use Tests\TestCaseWithDatabase;
+
+#[CoversClass(MemberService::class)]
+#[CoversClass(UserService::class)]
+#[UsesClass(MemberService::class)]
+class MemberServiceTest extends TestCaseWithDatabase
+{
+    private MemberService $memberService;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->memberService = app(MemberService::class);
+    }
+
+    public function test_change_ownership_fails_if_member_is_not_part_of_organization(): void
+    {
+        // Arrange
+        $organization = Organization::factory()->create();
+        $otherOrganization = Organization::factory()->create();
+        $newOwner = Member::factory()->forOrganization($otherOrganization)->create();
+
+        // Act
+        $this->expectException(InvalidArgumentException::class);
+        $this->memberService->changeOwnership($organization, $newOwner);
+
+        // Assert
+        $this->assertDatabaseHas(Organization::class, [
+            'id' => $organization->getKey(),
+            'user_id' => null,
+        ]);
+    }
+
+    public function test_change_ownership_changes_ownership_to_new_member(): void
+    {
+        $organization = Organization::factory()->create();
+        $newOwner = User::factory()->create();
+        $oldOwner = User::factory()->create();
+        $newOwnerMember = Member::factory()->forUser($newOwner)->forOrganization($organization)->role(Role::Admin)->create();
+        $oldOwnerMember = Member::factory()->forUser($oldOwner)->forOrganization($organization)->role(Role::Owner)->create();
+
+        // Act
+        $this->memberService->changeOwnership($organization, $newOwnerMember);
+
+        // Assert
+        $this->assertSame($newOwner->getKey(), $organization->refresh()->user_id);
+        $this->assertSame(Role::Owner->value, $newOwnerMember->refresh()->role);
+        $this->assertSame(Role::Admin->value, $oldOwnerMember->refresh()->role);
+    }
+
+    public function test_make_member_to_placeholder_creates_new_user_based_on_member_and_changes_member_to_placeholder(): void
+    {
+        // Arrange
+        $user = User::factory()->create();
+        $organization = Organization::factory()->create();
+        $member = Member::factory()->forOrganization($organization)->forUser($user)->role(Role::Employee)->create();
+        $timeEntry = TimeEntry::factory()->forOrganization($organization)->forMember($member)->create();
+        $project = Project::factory()->forOrganization($organization)->create();
+        $projectMember = ProjectMember::factory()->forProject($project)->forMember($member)->create();
+        // Note: create other user, organization, member, time entry and project member to check that they are not changed
+        $otherUser = User::factory()->create();
+        $otherOrganization = Organization::factory()->create();
+        $otherMember = Member::factory()->forOrganization($otherOrganization)->forUser($otherUser)->role(Role::Employee)->create();
+        $otherTimeEntry = TimeEntry::factory()->forOrganization($otherOrganization)->forMember($otherMember)->create();
+        $otherProject = Project::factory()->forOrganization($otherOrganization)->create();
+        $otherProjectMember = ProjectMember::factory()->forProject($otherProject)->forMember($otherMember)->create();
+
+        // Act
+        $this->memberService->makeMemberToPlaceholder($member);
+
+        // Assert
+        $member->refresh();
+        $timeEntry->refresh();
+        $projectMember->refresh();
+        $placeholderUser = $member->user;
+        $this->assertTrue($placeholderUser->is_placeholder);
+        $this->assertSame(Role::Placeholder->value, $member->role);
+        $this->assertSame($organization->getKey(), $member->organization_id);
+        $this->assertSame($placeholderUser->getKey(), $projectMember->user_id);
+        $this->assertSame($member->getKey(), $projectMember->member_id);
+        $this->assertSame($placeholderUser->getKey(), $timeEntry->user_id);
+        $this->assertSame($member->getKey(), $timeEntry->member_id);
+        $this->assertSame(1, $user->organizations()->count());
+        // Note: check that other user did not change
+        $otherMember->refresh();
+        $otherTimeEntry->refresh();
+        $otherProjectMember->refresh();
+        $otherUser->refresh();
+        $this->assertFalse($otherUser->is_placeholder);
+        $this->assertSame(Role::Employee->value, $otherMember->role);
+        $this->assertSame($otherOrganization->getKey(), $otherMember->organization_id);
+        $this->assertSame($otherUser->getKey(), $otherProjectMember->user_id);
+        $this->assertSame($otherMember->getKey(), $otherProjectMember->member_id);
+        $this->assertSame($otherUser->getKey(), $otherTimeEntry->user_id);
+        $this->assertSame($otherMember->getKey(), $otherTimeEntry->member_id);
+        $this->assertSame(1, $otherUser->organizations()->count());
+    }
+}

tests/Unit/Service/UserServiceTest.php

@@ -115,54 +115,6 @@ class UserServiceTest extends TestCase
         }
     }
 
-    public function test_make_member_to_placeholder_creates_new_user_based_on_member_and_changes_member_to_placeholder(): void
-    {
-        // Arrange
-        $user = User::factory()->create();
-        $organization = Organization::factory()->create();
-        $member = Member::factory()->forOrganization($organization)->forUser($user)->role(Role::Employee)->create();
-        $timeEntry = TimeEntry::factory()->forOrganization($organization)->forMember($member)->create();
-        $project = Project::factory()->forOrganization($organization)->create();
-        $projectMember = ProjectMember::factory()->forProject($project)->forMember($member)->create();
-        // Note: create other user, organization, member, time entry and project member to check that they are not changed
-        $otherUser = User::factory()->create();
-        $otherOrganization = Organization::factory()->create();
-        $otherMember = Member::factory()->forOrganization($otherOrganization)->forUser($otherUser)->role(Role::Employee)->create();
-        $otherTimeEntry = TimeEntry::factory()->forOrganization($otherOrganization)->forMember($otherMember)->create();
-        $otherProject = Project::factory()->forOrganization($otherOrganization)->create();
-        $otherProjectMember = ProjectMember::factory()->forProject($otherProject)->forMember($otherMember)->create();
-
-        // Act
-        $this->userService->makeMemberToPlaceholder($member);
-
-        // Assert
-        $member->refresh();
-        $timeEntry->refresh();
-        $projectMember->refresh();
-        $placeholderUser = $member->user;
-        $this->assertTrue($placeholderUser->is_placeholder);
-        $this->assertSame(Role::Placeholder->value, $member->role);
-        $this->assertSame($organization->getKey(), $member->organization_id);
-        $this->assertSame($placeholderUser->getKey(), $projectMember->user_id);
-        $this->assertSame($member->getKey(), $projectMember->member_id);
-        $this->assertSame($placeholderUser->getKey(), $timeEntry->user_id);
-        $this->assertSame($member->getKey(), $timeEntry->member_id);
-        $this->assertSame(1, $user->organizations()->count());
-        // Note: check that other user did not change
-        $otherMember->refresh();
-        $otherTimeEntry->refresh();
-        $otherProjectMember->refresh();
-        $otherUser->refresh();
-        $this->assertFalse($otherUser->is_placeholder);
-        $this->assertSame(Role::Employee->value, $otherMember->role);
-        $this->assertSame($otherOrganization->getKey(), $otherMember->organization_id);
-        $this->assertSame($otherUser->getKey(), $otherProjectMember->user_id);
-        $this->assertSame($otherMember->getKey(), $otherProjectMember->member_id);
-        $this->assertSame($otherUser->getKey(), $otherTimeEntry->user_id);
-        $this->assertSame($otherMember->getKey(), $otherTimeEntry->member_id);
-        $this->assertSame(1, $otherUser->organizations()->count());
-    }
-
     public function test_make_sure_user_has_current_organization_sets_current_organization_for_user_if_null(): void
     {
         // Arrange