Migrate permission away from Jetstream; Moved update user to REST API

tests/Feature/ProfileInformationTest.php

@@ -5,9 +5,12 @@ declare(strict_types=1);
 namespace Tests\Feature;
 
 use App\Enums\Weekday;
+use App\Mail\VerifyUpdatedEmailMail;
 use App\Models\User;
 use App\Service\TimezoneService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\URL;
 use Tests\TestCase;
 
 class ProfileInformationTest extends TestCase
@@ -30,7 +33,9 @@ class ProfileInformationTest extends TestCase
     public function test_profile_information_can_be_updated(): void
     {
         // Arrange
-        $user = User::factory()->create();
+        $user = User::factory()->create([
+            'email' => 'test@example.com',
+        ]);
         $timezone = app(TimezoneService::class)->getTimezones()[0];
         $this->actingAs($user);
 
@@ -50,4 +55,120 @@ class ProfileInformationTest extends TestCase
         $this->assertEquals($timezone, $user->timezone);
         $this->assertEquals(Weekday::Sunday, $user->week_start);
     }
+
+    public function test_email_update_keeps_current_email_verified_until_new_email_is_verified(): void
+    {
+        // Arrange
+        Mail::fake();
+        $user = User::factory()->create([
+            'email' => 'current@example.com',
+            'email_verified_at' => now(),
+        ]);
+        $timezone = app(TimezoneService::class)->getTimezones()[0];
+        $this->actingAs($user);
+
+        // Act
+        $response = $this->put('/user/profile-information', [
+            'name' => 'Test Name',
+            'email' => 'New.Email@Example.com',
+            'timezone' => $timezone,
+            'week_start' => Weekday::Sunday->value,
+        ]);
+
+        // Assert
+        $response->assertValid(errorBag: 'updateProfileInformation');
+        $user = $user->fresh();
+        $this->assertEquals('current@example.com', $user->email);
+        $this->assertEquals('new.email@example.com', $user->pending_email);
+        $this->assertNotNull($user->email_verified_at);
+        Mail::assertSent(VerifyUpdatedEmailMail::class, function (VerifyUpdatedEmailMail $mail): bool {
+            return $mail->hasTo('new.email@example.com') && $mail->email === 'new.email@example.com';
+        });
+    }
+
+    public function test_pending_email_can_be_verified(): void
+    {
+        // Arrange
+        $user = User::factory()->create([
+            'email' => 'current@example.com',
+            'pending_email' => 'new.email@example.com',
+        ]);
+        $this->actingAs($user);
+        $verificationUrl = URL::temporarySignedRoute(
+            'users.verify-email-change',
+            now()->addMinutes(60),
+            [
+                'user' => $user->getKey(),
+                'email' => 'new.email@example.com',
+            ],
+            false
+        );
+
+        // Act
+        $response = $this->get($verificationUrl);
+
+        // Assert
+        $response->assertRedirect(route('dashboard', [
+            'bannerStyle' => 'success',
+            'bannerText' => 'Your email address has been updated successfully.',
+        ]));
+        $user = $user->fresh();
+        $this->assertEquals('new.email@example.com', $user->email);
+        $this->assertNull($user->pending_email);
+        $this->assertNotNull($user->email_verified_at);
+    }
+
+    public function test_profile_update_does_not_clear_pending_email_when_email_is_unchanged(): void
+    {
+        // Arrange
+        $user = User::factory()->create([
+            'email' => 'current@example.com',
+            'pending_email' => 'new.email@example.com',
+        ]);
+        $timezone = app(TimezoneService::class)->getTimezones()[0];
+        $this->actingAs($user);
+
+        // Act
+        $response = $this->put('/user/profile-information', [
+            'name' => 'Updated Name',
+            'email' => 'current@example.com',
+            'timezone' => $timezone,
+            'week_start' => Weekday::Sunday->value,
+        ]);
+
+        // Assert
+        $response->assertValid(errorBag: 'updateProfileInformation');
+        $user = $user->fresh();
+        $this->assertEquals('Updated Name', $user->name);
+        $this->assertEquals('current@example.com', $user->email);
+        $this->assertEquals('new.email@example.com', $user->pending_email);
+    }
+
+    public function test_stale_pending_email_verification_link_is_rejected(): void
+    {
+        // Arrange
+        $user = User::factory()->create([
+            'email' => 'current@example.com',
+            'pending_email' => 'newer@example.com',
+        ]);
+        $this->actingAs($user);
+        $verificationUrl = URL::temporarySignedRoute(
+            'users.verify-email-change',
+            now()->addMinutes(60),
+            [
+                'user' => $user->getKey(),
+                'email' => 'older@example.com',
+            ],
+            false
+        );
+
+        // Act
+        $response = $this->get($verificationUrl);
+
+        // Assert
+        $response->assertForbidden();
+        $user = $user->fresh();
+        $this->assertEquals('current@example.com', $user->email);
+        $this->assertEquals('newer@example.com', $user->pending_email);
+    }
 }

tests/TestCase.php

@@ -50,6 +50,7 @@ abstract class TestCase extends BaseTestCase
     {
         // Note: It is necessary to clear the permission cache after each test, since the "scoped singletons" are not reset between tests.
         app(PermissionStore::class)->clear();
+        PermissionStore::resetCustomRoles();
         parent::tearDown();
     }
 

tests/TestCaseWithDatabase.php

@@ -8,6 +8,7 @@ use App\Enums\Role;
 use App\Models\Member;
 use App\Models\Organization;
 use App\Models\User;
+use App\Service\PermissionStore;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
@@ -26,6 +27,7 @@ abstract class TestCaseWithDatabase extends TestCase
         $roleName = 'custom-test-'.Str::uuid();
         Jetstream::role($roleName, 'Custom Test', $permissions)
             ->description('Role custom for testing');
+        PermissionStore::registerCustomRole($roleName, $permissions);
         $user = User::factory()->create();
         if ($isOwner) {
             $organization = Organization::factory()->withOwner($user)->create();

tests/Unit/Endpoint/Api/V1/UserEndpointTest.php

@@ -4,7 +4,11 @@ declare(strict_types=1);
 
 namespace Tests\Unit\Endpoint\Api\V1;
 
+use App\Enums\Weekday;
+use App\Mail\VerifyUpdatedEmailMail;
 use App\Models\User;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Storage;
 use Laravel\Passport\Passport;
 
 class UserEndpointTest extends ApiEndpointTestAbstract
@@ -42,6 +46,298 @@ class UserEndpointTest extends ApiEndpointTestAbstract
         ]);
     }
 
+    public function test_update_changes_user_name_timezone_and_week_start(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'name' => 'Updated Name',
+            'timezone' => 'America/New_York',
+            'week_start' => Weekday::Sunday->value,
+        ]);
+
+        // Assert
+        $response->assertSuccessful();
+        $response->assertJson([
+            'data' => [
+                'id' => $data->user->getKey(),
+                'name' => 'Updated Name',
+                'timezone' => 'America/New_York',
+                'week_start' => Weekday::Sunday->value,
+            ],
+        ]);
+
+        $user = $data->user->fresh();
+        $this->assertSame('Updated Name', $user->name);
+        $this->assertSame('America/New_York', $user->timezone);
+        $this->assertSame(Weekday::Sunday, $user->week_start);
+    }
+
+    public function test_update_does_not_change_user_fields_that_are_not_given(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        $data->user->name = 'Original Name';
+        $data->user->timezone = 'Europe/Vienna';
+        $data->user->week_start = Weekday::Monday;
+        $data->user->save();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), []);
+
+        // Assert
+        $response->assertSuccessful();
+        $response->assertJson([
+            'data' => [
+                'id' => $data->user->getKey(),
+                'name' => 'Original Name',
+                'timezone' => 'Europe/Vienna',
+                'week_start' => Weekday::Monday->value,
+            ],
+        ]);
+
+        $user = $data->user->fresh();
+        $this->assertSame('Original Name', $user->name);
+        $this->assertSame('Europe/Vienna', $user->timezone);
+        $this->assertSame(Weekday::Monday, $user->week_start);
+    }
+
+    public function test_update_email_stores_pending_email_and_sends_verification_email(): void
+    {
+        // Arrange
+        Mail::fake();
+        $data = $this->createUserWithPermission();
+        $data->user->email = 'current@example.com';
+        $data->user->email_verified_at = now();
+        $data->user->save();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'email' => 'New.Email@Example.com',
+        ]);
+
+        // Assert
+        $response->assertSuccessful();
+
+        $user = $data->user->fresh();
+        $this->assertSame('current@example.com', $user->email);
+        $this->assertSame('new.email@example.com', $user->pending_email);
+        $this->assertNotNull($user->email_verified_at);
+        Mail::assertSent(VerifyUpdatedEmailMail::class, function (VerifyUpdatedEmailMail $mail): bool {
+            return $mail->hasTo('new.email@example.com') && $mail->email === 'new.email@example.com';
+        });
+    }
+
+    public function test_resend_email_verification_sends_pending_email_verification_email(): void
+    {
+        // Arrange
+        Mail::fake();
+        $data = $this->createUserWithPermission();
+        $data->user->pending_email = 'new.email@example.com';
+        $data->user->save();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.users.resend-email-verification', $data->user->getKey()));
+
+        // Assert
+        $response->assertNoContent();
+        Mail::assertNotSent(VerifyUpdatedEmailMail::class);
+        Mail::assertQueued(VerifyUpdatedEmailMail::class, function (VerifyUpdatedEmailMail $mail): bool {
+            return $mail->hasTo('new.email@example.com') && $mail->email === 'new.email@example.com';
+        });
+    }
+
+    public function test_resend_email_verification_fails_if_given_id_is_not_the_authenticated_user(): void
+    {
+        // Arrange
+        Mail::fake();
+        $data = $this->createUserWithPermission();
+        $otherData = $this->createUserWithPermission();
+        Passport::actingAs($otherData->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.users.resend-email-verification', $data->user->getKey()));
+
+        // Assert
+        $response->assertForbidden();
+        Mail::assertNotSent(VerifyUpdatedEmailMail::class);
+        Mail::assertNotQueued(VerifyUpdatedEmailMail::class);
+    }
+
+    public function test_resend_email_verification_fails_without_pending_email(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        $data->user->pending_email = null;
+        $data->user->save();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.users.resend-email-verification', $data->user->getKey()));
+
+        // Assert
+        $response->assertStatus(400);
+        $response->assertJson([
+            'error' => true,
+            'key' => 'user_resend_email_verification_no_pending_email',
+            'message' => 'Resend email not possible, no pending email.',
+        ]);
+        Mail::assertNotSent(VerifyUpdatedEmailMail::class);
+        Mail::assertNotQueued(VerifyUpdatedEmailMail::class);
+    }
+
+    public function test_update_changes_user_photo_from_base64_encoded_image(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        $photoDisk = (string) config('jetstream.profile_photo_disk', 'public');
+        $previousPhotoPath = 'profile-photos/previous.png';
+        $photo = file_get_contents(resource_path('testfiles/test.png'));
+        $this->assertIsString($photo);
+        Storage::fake($photoDisk);
+        Storage::disk($photoDisk)->put($previousPhotoPath, 'previous photo');
+        $data->user->profile_photo_path = $previousPhotoPath;
+        $data->user->save();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'photo' => base64_encode($photo),
+        ]);
+
+        // Assert
+        $response->assertSuccessful();
+
+        $user = $data->user->fresh();
+        $this->assertNotNull($user->profile_photo_path);
+        $this->assertNotSame($previousPhotoPath, $user->profile_photo_path);
+        $this->assertStringStartsWith('profile-photos/', $user->profile_photo_path);
+        $this->assertStringEndsWith('.png', $user->profile_photo_path);
+        Storage::disk($photoDisk)->assertExists($user->profile_photo_path);
+        Storage::disk($photoDisk)->assertMissing($previousPhotoPath);
+        $this->assertSame($photo, Storage::disk($photoDisk)->get($user->profile_photo_path));
+    }
+
+    public function test_update_fails_if_name_is_not_a_string(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'name' => 123,
+        ]);
+
+        // Assert
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['name']);
+    }
+
+    public function test_update_fails_if_name_is_too_long(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'name' => str_repeat('a', 256),
+        ]);
+
+        // Assert
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['name']);
+    }
+
+    public function test_update_fails_if_timezone_is_invalid(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'timezone' => 'not-a-timezone',
+        ]);
+
+        // Assert
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['timezone']);
+    }
+
+    public function test_update_fails_if_week_start_is_invalid(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'week_start' => 'not-a-weekday',
+        ]);
+
+        // Assert
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['week_start']);
+    }
+
+    public function test_update_fails_if_photo_is_not_a_string(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'photo' => 123,
+        ]);
+
+        // Assert
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['photo']);
+    }
+
+    public function test_update_fails_if_photo_is_not_base64_encoded(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'photo' => 'not base64 encoded',
+        ]);
+
+        // Assert
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['photo']);
+    }
+
+    public function test_update_fails_if_photo_is_not_a_jpg_or_png(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        $csv = file_get_contents(resource_path('testfiles/generic_projects_import_test_1.csv'));
+        $this->assertIsString($csv);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'photo' => base64_encode($csv),
+        ]);
+
+        // Assert
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['photo']);
+    }
+
     public function test_delete_fails_if_given_user_is_not_the_authenticated_user(): void
     {
         // Arrange

tests/Unit/Mail/VerifyUpdatedEmailMailTest.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Mail;
+
+use App\Mail\VerifyUpdatedEmailMail;
+use App\Models\User;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\URL;
+use PHPUnit\Framework\Attributes\CoversClass;
+use Tests\TestCaseWithDatabase;
+
+#[CoversClass(VerifyUpdatedEmailMail::class)]
+class VerifyUpdatedEmailMailTest extends TestCaseWithDatabase
+{
+    public function test_mail_renders_content_correctly(): void
+    {
+        // Arrange
+        $user = User::factory()->create();
+        $mail = new VerifyUpdatedEmailMail($user, 'New.Email@Example.com');
+
+        // Act
+        $rendered = $mail->render();
+
+        // Assert
+        $this->assertEquals('new.email@example.com', $mail->email);
+        $this->assertStringContainsString('Please verify your new email address', $rendered);
+    }
+
+    public function test_mail_uses_relative_signed_verification_url(): void
+    {
+        // Arrange
+        Carbon::setTestNow('2026-05-21 12:00:00');
+        $user = User::factory()->create();
+        $mail = new VerifyUpdatedEmailMail($user, 'new.email@example.com');
+
+        // Act
+        $rendered = $mail->render();
+        $expectedPath = URL::temporarySignedRoute(
+            'users.verify-email-change',
+            now()->addMinutes((int) config('auth.verification.expire', 60)),
+            [
+                'user' => $user->getKey(),
+                'email' => 'new.email@example.com',
+            ],
+            false
+        );
+
+        // Assert
+        $this->assertStringContainsString(e(URL::to($expectedPath)), $rendered);
+    }
+}

tests/Unit/Service/PermissionStoreTest.php

@@ -9,7 +9,6 @@ use App\Models\Organization;
 use App\Models\User;
 use App\Service\PermissionStore;
 use Illuminate\Foundation\Testing\RefreshDatabase;
-use Laravel\Jetstream\Jetstream;
 use PHPUnit\Framework\Attributes\CoversClass;
 use Tests\TestCase;
 
@@ -122,7 +121,7 @@ class PermissionStoreTest extends TestCase
         $result = $permissionStore->getPermissions($organization);
 
         // Assert
-        $this->assertSame(Jetstream::findRole(Role::Employee->value)->permissions, $result);
+        $this->assertSame(PermissionStore::permissionsForRole(Role::Employee->value), $result);
     }
 
     public function test_employee_does_not_have_task_permissions_by_default(): void