Add more tests

tests/Unit/Endpoint/Api/V1/UserEndpointTest.php

@@ -240,6 +240,22 @@ class UserEndpointTest extends ApiEndpointTestAbstract
         $response->assertJsonValidationErrors(['name']);
     }
 
+    public function test_update_fails_if_given_user_is_not_the_authenticated_user(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        $otherData = $this->createUserWithPermission();
+        Passport::actingAs($otherData->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'name' => 'Updated Name',
+        ]);
+
+        // Assert
+        $response->assertForbidden();
+    }
+
     public function test_update_fails_if_name_is_too_long(): void
     {
         // Arrange

tests/Unit/Endpoint/Web/OrganizationInvitationEndpointTest.php

@@ -251,4 +251,27 @@ class OrganizationInvitationEndpointTest extends EndpointTestAbstract
         // Assert
         $response->assertForbidden();
     }
+
+    public function test_fails_if_invitation_has_owner_role(): void
+    {
+        // Arrange
+        $user = $this->createUserWithPermission();
+        $invitation = OrganizationInvitation::factory()
+            ->forOrganization($user->organization)
+            ->create([
+                'role' => Role::Owner->value,
+            ]);
+
+        // Act
+        $acceptUrl = URL::to(URL::temporarySignedRoute(
+            'organization-invitations.accept',
+            now()->addMinutes(60),
+            [$invitation->getKey()],
+            false
+        ));
+        $response = $this->get($acceptUrl);
+
+        // Assert
+        $response->assertStatus(500);
+    }
 }