From 486b5d2152ad83e26713099fb5b5197bc4c54337 Mon Sep 17 00:00:00 2001
From: Gregor Vostrak <gregor@solidtime.io>
Date: Tue, 26 May 2026 17:21:40 +0200
Subject: [PATCH] add user endpoint tests for idempotence email update,
 unauthenticated update and invalid email

---
 .../Unit/Endpoint/Api/V1/UserEndpointTest.php | 53 +++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php b/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php
index 90184354..f877d8c1 100644
--- a/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php
+++ b/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php
@@ -133,6 +133,59 @@ class UserEndpointTest extends ApiEndpointTestAbstract
         });
     }
 
+    public function test_update_with_the_current_email_does_not_change_pending_email_or_send_a_mail(): void
+    {
+        // Arrange
+        Mail::fake();
+        $data = $this->createUserWithPermission();
+        $data->user->email = 'current@example.com';
+        $data->user->pending_email = null;
+        $data->user->save();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'email' => 'current@example.com',
+        ]);
+
+        // Assert
+        $response->assertSuccessful();
+        $user = $data->user->fresh();
+        $this->assertSame('current@example.com', $user->email);
+        $this->assertNull($user->pending_email);
+        Mail::assertNothingSent();
+    }
+
+    public function test_update_fails_if_email_format_is_invalid(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'email' => 'not-an-email',
+        ]);
+
+        // Assert
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['email']);
+    }
+
+    public function test_update_fails_when_not_authenticated(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'name' => 'Anonymous Edit',
+        ]);
+
+        // Assert
+        $response->assertUnauthorized();
+    }
+
     public function test_resend_email_verification_sends_pending_email_verification_email(): void
     {
         // Arrange