Add roles for project members; Restrict access to sensitive project values

app/Enums/ProjectMemberRole.php

@@ -0,0 +1,11 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+enum ProjectMemberRole: string
+{
+    case Manager = 'manager';
+    case Normal = 'normal';
+}

app/Http/Controllers/Api/V1/ProjectController.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api\V1;
 
+use App\Enums\ProjectMemberRole;
 use App\Exceptions\Api\EntityStillInUseApiException;
 use App\Http\Requests\V1\Project\ProjectIndexRequest;
 use App\Http\Requests\V1\Project\ProjectStoreRequest;
@@ -15,6 +16,8 @@ use App\Models\Project;
 use App\Models\ProjectMember;
 use App\Service\BillableRateService;
 use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Resources\Json\JsonResource;
 use Illuminate\Support\Carbon;
@@ -50,6 +53,12 @@ class ProjectController extends Controller
 
         if (! $canViewAllProjects) {
             $projectsQuery->visibleByEmployee($user);
+            $projectsQuery->with([
+                'members' => function (HasMany $query): void {
+                    /** @var Builder<ProjectMember> $query */
+                    $query->whereBelongsTo($this->user(), 'user');
+                },
+            ]);
         }
         $filterArchived = $request->getFilterArchived();
         if ($filterArchived === 'true') {
@@ -60,6 +69,14 @@ class ProjectController extends Controller
 
         $projects = $projectsQuery->paginate(config('app.pagination_per_page_default'));
 
+        foreach ($projects->items() as $project) {
+            if ($canViewAllProjects) {
+                $project->setAttribute('limited_visibility', false);
+            } else {
+                $project->setAttribute('limited_visibility', $project->members->firstWhere('user_id', $this->user()->id)?->role !== ProjectMemberRole::Manager);
+            }
+        }
+
         return new ProjectCollection($projects);
     }
 
@@ -73,6 +90,26 @@ class ProjectController extends Controller
     public function show(Organization $organization, Project $project): JsonResource
     {
         $this->checkPermission($organization, 'projects:view', $project);
+        $canViewAllProjects = $this->hasPermission($organization, 'projects:view:all');
+
+        $project->load([
+            'members' => function (HasMany $query): void {
+                /** @var Builder<ProjectMember> $query */
+                $query->whereBelongsTo($this->user(), 'user');
+            },
+        ]);
+
+        if (! $canViewAllProjects) {
+            if (! $project->is_public && $project->members->firstWhere('user_id', '=', $this->user()->id) === null) {
+                throw new AuthorizationException('No access to project');
+            }
+        }
+
+        if ($canViewAllProjects) {
+            $project->setAttribute('limited_visibility', false);
+        } else {
+            $project->setAttribute('limited_visibility', $project->members->firstWhere('user_id', $this->user()->id)?->role !== ProjectMemberRole::Manager);
+        }
 
         $project->load('organization');
 
@@ -101,6 +138,8 @@ class ProjectController extends Controller
         $project->organization()->associate($organization);
         $project->save();
 
+        $project->setAttribute('limited_visibility', false);
+
         return new ProjectResource($project);
     }
 
@@ -132,6 +171,8 @@ class ProjectController extends Controller
             $billableRateService->updateTimeEntriesBillableRateForProject($project);
         }
 
+        $project->setAttribute('limited_visibility', false);
+
         return new ProjectResource($project);
     }
 

app/Http/Controllers/Api/V1/ProjectMemberController.php

@@ -72,6 +72,7 @@ class ProjectMemberController extends Controller
         }
 
         $projectMember = new ProjectMember;
+        $projectMember->role = $request->getRole();
         $projectMember->billable_rate = $request->getBillableRate();
         $projectMember->member()->associate($member);
         $projectMember->user()->associate($member->user);
@@ -95,11 +96,17 @@ class ProjectMemberController extends Controller
     public function update(Organization $organization, ProjectMember $projectMember, ProjectMemberUpdateRequest $request, BillableRateService $billableRateService): JsonResource
     {
         $this->checkPermission($organization, 'project-members:update', projectMember: $projectMember);
+        $hasBillableRate = $request->has('billable_rate');
+        if ($hasBillableRate) {
             $oldBillableRate = $projectMember->billable_rate;
             $projectMember->billable_rate = $request->getBillableRate();
+        }
+        if ($request->getRole() !== null) {
+            $projectMember->role = $request->getRole();
+        }
         $projectMember->save();
 
-        if ($oldBillableRate !== $request->getBillableRate()) {
+        if ($hasBillableRate && $oldBillableRate !== $request->getBillableRate()) {
             $billableRateService->updateTimeEntriesBillableRateForProjectMember($projectMember);
         }
 

app/Http/Requests/V1/ProjectMember/ProjectMemberStoreRequest.php

@@ -4,11 +4,13 @@ declare(strict_types=1);
 
 namespace App\Http\Requests\V1\ProjectMember;
 
+use App\Enums\ProjectMemberRole;
 use App\Models\Member;
 use App\Models\Organization;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
 use Korridor\LaravelModelValidationRules\Rules\ExistsEloquent;
 
 /**
@@ -19,7 +21,7 @@ class ProjectMemberStoreRequest extends FormRequest
     /**
      * Get the validation rules that apply to the request.
      *
-     * @return array<string, array<string|ValidationRule>>
+     * @return array<string, array<string|ValidationRule|\Illuminate\Contracts\Validation\Rule>>
      */
     public function rules(): array
     {
@@ -37,6 +39,11 @@ class ProjectMemberStoreRequest extends FormRequest
                 'integer',
                 'min:0',
             ],
+            'role' => [
+                'required',
+                'string',
+                Rule::enum(ProjectMemberRole::class),
+            ],
         ];
     }
 
@@ -46,4 +53,9 @@ class ProjectMemberStoreRequest extends FormRequest
 
         return $input !== null && $input !== 0 ? (int) $this->input('billable_rate') : null;
     }
+
+    public function getRole(): ProjectMemberRole
+    {
+        return ProjectMemberRole::from($this->validated('role'));
+    }
 }

app/Http/Requests/V1/ProjectMember/ProjectMemberUpdateRequest.php

@@ -4,9 +4,11 @@ declare(strict_types=1);
 
 namespace App\Http\Requests\V1\ProjectMember;
 
+use App\Enums\ProjectMemberRole;
 use App\Models\Organization;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
 
 /**
  * @property Organization $organization Organization from model binding
@@ -16,7 +18,7 @@ class ProjectMemberUpdateRequest extends FormRequest
     /**
      * Get the validation rules that apply to the request.
      *
-     * @return array<string, array<string|ValidationRule>>
+     * @return array<string, array<string|ValidationRule|\Illuminate\Contracts\Validation\Rule>>
      */
     public function rules(): array
     {
@@ -26,6 +28,10 @@ class ProjectMemberUpdateRequest extends FormRequest
                 'integer',
                 'min:0',
             ],
+            'role' => [
+                'string',
+                Rule::enum(ProjectMemberRole::class),
+            ],
         ];
     }
 
@@ -33,6 +39,11 @@ class ProjectMemberUpdateRequest extends FormRequest
     {
         $input = $this->input('billable_rate');
 
-        return $input !== null && $input !== 0 ? (int) $this->input('billable_rate') : null;
+        return $input !== null && ((int) $input) !== 0 ? (int) $this->validated('billable_rate') : null;
+    }
+
+    public function getRole(): ?ProjectMemberRole
+    {
+        return $this->has('role') ? ProjectMemberRole::from($this->validated('role')) : null;
     }
 }

app/Http/Resources/V1/Project/ProjectResource.php

@@ -20,6 +20,8 @@ class ProjectResource extends BaseResource
      */
     public function toArray(Request $request): array
     {
+        $limitedVisibility = is_bool($this->resource->getAttributeValue('limited_visibility')) ? $this->resource->getAttributeValue('limited_visibility') : true;
+
         return [
             /** @var string $id ID of project */
             'id' => $this->resource->id,
@@ -32,13 +34,15 @@ class ProjectResource extends BaseResource
             /** @var bool $is_archived Whether the client is archived */
             'is_archived' => $this->resource->is_archived,
             /** @var int|null $billable_rate Billable rate in cents per hour */
-            'billable_rate' => $this->resource->billable_rate,
+            'billable_rate' => $limitedVisibility ? null : $this->resource->billable_rate,
             /** @var bool $is_billable Project time entries billable default */
             'is_billable' => $this->resource->is_billable,
             /** @var int|null $estimated_time Estimated time in seconds */
-            'estimated_time' => $this->resource->estimated_time,
+            'estimated_time' => $limitedVisibility ? null : $this->resource->estimated_time,
             /** @var int $spent_time Spent time on this project in seconds (sum of the duration of all associated time entries, excl. still running time entries) */
-            'spent_time' => $this->resource->spent_time,
+            'spent_time' => $limitedVisibility ? null : $this->resource->spent_time,
+            /** @var bool $limited_visibility */
+            'limited_visibility' => $limitedVisibility,
         ];
     }
 }

app/Models/ProjectMember.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Enums\ProjectMemberRole;
 use App\Models\Concerns\CustomAuditable;
 use App\Models\Concerns\HasUuids;
 use Database\Factories\ProjectMemberFactory;
@@ -22,6 +23,7 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @property string $user_id User ID (legacy)
  * @property Carbon|null $created_at
  * @property Carbon|null $updated_at
+ * @property ProjectMemberRole $role
  * @property-read Project $project
  * @property-read Member $member
  * @property-read User $user
@@ -45,6 +47,7 @@ class ProjectMember extends Model implements AuditableContract
      */
     protected $casts = [
         'billable_rate' => 'int',
+        'role' => ProjectMemberRole::class,
     ];
 
     /**

database/factories/ProjectMemberFactory.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Database\Factories;
 
+use App\Enums\ProjectMemberRole;
 use App\Models\Member;
 use App\Models\Project;
 use App\Models\ProjectMember;
@@ -24,12 +25,22 @@ class ProjectMemberFactory extends Factory
     {
         return [
             'billable_rate' => $this->faker->numberBetween(10, 10000) * 100,
+            'role' => ProjectMemberRole::Normal,
             'project_id' => Project::factory(),
             'user_id' => User::factory(),
             'member_id' => Member::factory(),
         ];
     }
 
+    public function role(ProjectMemberRole $role): self
+    {
+        return $this->state(function (array $attributes) use ($role) {
+            return [
+                'role' => $role,
+            ];
+        });
+    }
+
     /**
      * @deprecated Use forMember instead
      */

database/migrations/2024_09_30_155934_add_role_to_project_members_table.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('project_members', function (Blueprint $table): void {
+            $table->string('role')->default('normal');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('project_members', function (Blueprint $table): void {
+            $table->dropColumn('role');
+        });
+    }
+};

tests/Unit/Endpoint/Api/V1/ProjectEndpointTest.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Tests\Unit\Endpoint\Api\V1;
 
+use App\Enums\ProjectMemberRole;
 use App\Http\Controllers\Api\V1\ProjectController;
 use App\Models\Client;
 use App\Models\Organization;
@@ -159,6 +160,54 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
         $response->assertJsonCount(4, 'data');
     }
 
+    public function test_index_endpoint_returns_limited_visibility_flag_for_projects(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'projects:view',
+            'projects:view:all',
+        ]);
+        Project::factory()->forOrganization($data->organization)->createMany(2);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->getJson(route('api.v1.projects.index', [$data->organization->getKey()]));
+
+        // Assert
+        $response->assertStatus(200);
+        $response->assertJsonPath('data.0.limited_visibility', false);
+        $response->assertJsonPath('data.1.limited_visibility', false);
+    }
+
+    public function test_index_endpoint_returns_limit_visibility_flag_for_projects_for_user_with_restricted_permission(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'projects:view',
+        ]);
+        $project1 = Project::factory()->forOrganization($data->organization)->create([
+            'created_at' => now()->subDays(4),
+        ]);
+        ProjectMember::factory()->forProject($project1)->forMember($data->member)->role(ProjectMemberRole::Normal)->create();
+        $project2 = Project::factory()->forOrganization($data->organization)->create([
+            'created_at' => now()->subDays(3),
+        ]);
+        ProjectMember::factory()->forProject($project2)->forMember($data->member)->role(ProjectMemberRole::Manager)->create();
+        $project3 = Project::factory()->forOrganization($data->organization)->isPublic()->create([
+            'created_at' => now()->subDays(2),
+        ]);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->getJson(route('api.v1.projects.index', [$data->organization->getKey()]));
+
+        // Assert
+        $response->assertStatus(200);
+        $response->assertJsonPath('data.0.limited_visibility', true);
+        $response->assertJsonPath('data.1.limited_visibility', false);
+        $response->assertJsonPath('data.2.limited_visibility', true);
+    }
+
     public function test_show_endpoint_fails_if_user_is_not_part_of_project_organization(): void
     {
         // Arrange
@@ -190,7 +239,82 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
         $response->assertForbidden();
     }
 
-    public function test_show_endpoint_returns_project(): void
+    public function test_show_endpoint_returns_project_if_user_has_access_to_all_projects_in_organization(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'projects:view',
+            'projects:view:all',
+        ]);
+        $project = Project::factory()->forOrganization($data->organization)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $project->getKey()]));
+
+        // Assert
+        $response->assertStatus(200);
+        $response->assertJsonPath('data.id', $project->getKey());
+        $response->assertJsonPath('data.limited_visibility', false);
+    }
+
+    public function test_show_endpoint_returns_project_if_user_can_view_projects_and_project_is_public(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'projects:view',
+        ]);
+        $project = Project::factory()->forOrganization($data->organization)->isPublic()->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $project->getKey()]));
+
+        // Assert
+        $response->assertStatus(200);
+        $response->assertJsonPath('data.id', $project->getKey());
+        $response->assertJsonPath('data.limited_visibility', true);
+    }
+
+    public function test_show_endpoint_returns_project_if_user_can_view_projects_and_user_is_member_of_project(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'projects:view',
+        ]);
+        $project = Project::factory()->forOrganization($data->organization)->create();
+        ProjectMember::factory()->forProject($project)->forMember($data->member)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $project->getKey()]));
+
+        // Assert
+        $response->assertStatus(200);
+        $response->assertJsonPath('data.id', $project->getKey());
+        $response->assertJsonPath('data.limited_visibility', true);
+    }
+
+    public function test_show_endpoint_returns_project_with_no_limited_visibility_is_user_is_project_manager(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'projects:view',
+        ]);
+        $project = Project::factory()->forOrganization($data->organization)->create();
+        ProjectMember::factory()->forProject($project)->forMember($data->member)->role(ProjectMemberRole::Manager)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $project->getKey()]));
+
+        // Assert
+        $response->assertStatus(200);
+        $response->assertJsonPath('data.id', $project->getKey());
+        $response->assertJsonPath('data.limited_visibility', false);
+    }
+
+    public function test_show_endpoint_fails_for_user_with_access_to_not_all_projects_for_project_that_is_private_and_the_user_is_not_a_member_of(): void
     {
         // Arrange
         $data = $this->createUserWithPermission([
@@ -203,8 +327,7 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
         $response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $project->getKey()]));
 
         // Assert
-        $response->assertStatus(200);
+        $response->assertStatus(403);
-        $response->assertJsonPath('data.id', $project->getKey());
     }
 
     public function test_store_endpoint_fails_if_user_has_no_permission_to_create_projects(): void

tests/Unit/Endpoint/Api/V1/ProjectMemberEndpointTest.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Tests\Unit\Endpoint\Api\V1;
 
+use App\Enums\ProjectMemberRole;
 use App\Http\Controllers\Api\V1\ProjectMemberController;
 use App\Models\Member;
 use App\Models\Organization;
@@ -93,6 +94,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
         // Act
         $response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
             'billable_rate' => $projectMemberFake->billable_rate,
+            'role' => $projectMemberFake->role->value,
             'member_id' => $member->getKey(),
         ]);
 
@@ -118,6 +120,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
         // Act
         $response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
             'billable_rate' => $projectMemberFake->billable_rate,
+            'role' => $projectMemberFake->role->value,
             'member_id' => $member->getKey(),
         ]);
 
@@ -165,6 +168,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
         // Act
         $response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
             'billable_rate' => $projectMemberFake->billable_rate,
+            'role' => $projectMemberFake->role->value,
             'member_id' => $member->getKey(),
         ]);
 
@@ -179,6 +183,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
             'billable_rate' => $projectMemberFake->billable_rate,
             'member_id' => $member->getKey(),
             'project_id' => $project->getKey(),
+            'role' => $projectMemberFake->role->value,
         ]);
     }
 
@@ -197,6 +202,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
         // Act
         $response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
             'billable_rate' => $projectMemberFake->billable_rate,
+            'role' => $projectMemberFake->role->value,
             'member_id' => $member->getKey(),
         ]);
 
@@ -211,6 +217,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
             'billable_rate' => $projectMemberFake->billable_rate,
             'member_id' => $member->getKey(),
             'project_id' => $project->getKey(),
+            'role' => $projectMemberFake->role->value,
         ]);
     }
 
@@ -236,6 +243,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
         // Act
         $response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
             'billable_rate' => $projectMemberFake->billable_rate,
+            'role' => $projectMemberFake->role->value,
             'member_id' => $member->getKey(),
         ]);
 
@@ -245,6 +253,36 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
             'billable_rate' => $projectMemberFake->billable_rate,
             'member_id' => $member->getKey(),
             'project_id' => $project->getKey(),
+            'role' => $projectMemberFake->role->value,
+        ]);
+    }
+
+    public function test_store_endpoint_can_create_a_new_project_member_with_role_manager(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'project-members:create',
+        ]);
+        $project = Project::factory()->forOrganization($data->organization)->create();
+        $user = User::factory()->create();
+        $member = Member::factory()->forOrganization($data->organization)->forUser($user)->create();
+        $this->assertBillableRateServiceIsUnused();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
+            'billable_rate' => null,
+            'role' => ProjectMemberRole::Manager->value,
+            'member_id' => $member->getKey(),
+        ]);
+
+        // Assert
+        $response->assertStatus(201);
+        $this->assertDatabaseHas(ProjectMember::class, [
+            'billable_rate' => null,
+            'member_id' => $member->getKey(),
+            'project_id' => $project->getKey(),
+            'role' => ProjectMemberRole::Manager->value,
         ]);
     }
 
@@ -266,6 +304,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
         // Act
         $response = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
             'billable_rate' => $projectMemberFake->billable_rate,
+            'role' => $projectMemberFake->role->value,
             'member_id' => $member->getKey(),
         ]);
 
@@ -275,6 +314,7 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
             'billable_rate' => null,
             'member_id' => $member->getKey(),
             'project_id' => $project->getKey(),
+            'role' => $projectMemberFake->role->value,
         ]);
     }
 
@@ -374,6 +414,32 @@ class ProjectMemberEndpointTest extends ApiEndpointTestAbstract
         ]);
     }
 
+    public function test_update_endpoint_can_update_role(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'project-members:update',
+        ]);
+        $project = Project::factory()->forOrganization($data->organization)->create();
+        $projectMember = ProjectMember::factory()->forProject($project)->role(ProjectMemberRole::Normal)->create();
+        $this->assertBillableRateServiceIsUnused();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.project-members.update', [$data->organization->getKey(), $projectMember->getKey()]), [
+            'role' => ProjectMemberRole::Manager->value,
+        ]);
+
+        // Assert
+        $response->assertStatus(200);
+        $this->assertDatabaseHas(ProjectMember::class, [
+            'id' => $projectMember->getKey(),
+            'billable_rate' => $projectMember->billable_rate,
+            'member_id' => $projectMember->member_id,
+            'role' => ProjectMemberRole::Manager->value,
+        ]);
+    }
+
     public function test_destroy_endpoint_fails_if_user_is_not_part_of_project_members_organization(): void
     {
         // Arrange

tests/Unit/Model/ClientModelTest.php

@@ -44,7 +44,7 @@ class ClientModelTest extends ModelTestAbstract
         // Assert
         $this->assertNotNull($projectsRel);
         $this->assertCount(4, $projectsRel);
-        $this->assertTrue($projectsRel->first()->is($projects->first()));
+        $this->assertNotEquals($projectsOtherClient->pluck('id'), $projectsRel->pluck('id'));
     }
 
     public function test_accessor_is_archived_is_true_if_archived_at_is_not_null(): void

tests/Unit/Model/ProjectModelTest.php

@@ -75,7 +75,7 @@ class ProjectModelTest extends ModelTestAbstract
         // Assert
         $this->assertNotNull($tasksRel);
         $this->assertCount(3, $tasksRel);
-        $this->assertTrue($tasksRel->first()->is($tasks->first()));
+        $this->assertEqualsIdsOfEloquentCollection($tasks->pluck('id')->toArray(), $tasksRel);
     }
 
     public function test_it_has_many_members(): void
@@ -91,7 +91,7 @@ class ProjectModelTest extends ModelTestAbstract
         // Assert
         $this->assertNotNull($membersRel);
         $this->assertCount(3, $membersRel);
-        $this->assertTrue($membersRel->first()->is($members->first()));
+        $this->assertEqualsIdsOfEloquentCollection($members->pluck('id')->toArray(), $membersRel);
     }
 
     public function test_scope_visible_by_user_filters_so_that_only_public_projects_or_projects_where_the_user_is_member_are_shown(): void