Added client and organization endpoints

app/Http/Controllers/Api/V1/ClientController.php

@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Requests\V1\Tag\TagStoreRequest;
+use App\Http\Requests\V1\Tag\TagUpdateRequest;
+use App\Http\Resources\V1\Client\ClientCollection;
+use App\Http\Resources\V1\Client\ClientResource;
+use App\Models\Client;
+use App\Models\Organization;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Http\JsonResponse;
+
+class ClientController extends Controller
+{
+    protected function checkPermission(Organization $organization, string $permission, ?Client $client = null): void
+    {
+        parent::checkPermission($organization, $permission);
+        if ($client !== null && $client->organization_id !== $organization->getKey()) {
+            throw new AuthorizationException('Tag does not belong to organization');
+        }
+    }
+
+    /**
+     * Get clients
+     *
+     * @throws AuthorizationException
+     */
+    public function index(Organization $organization): ClientCollection
+    {
+        $this->checkPermission($organization, 'clients:view');
+
+        $clients = Client::query()
+            ->whereBelongsTo($organization, 'organization')
+            ->orderBy('created_at', 'desc')
+            ->get();
+
+        return new ClientCollection($clients);
+    }
+
+    /**
+     * Create client
+     *
+     * @throws AuthorizationException
+     */
+    public function store(Organization $organization, TagStoreRequest $request): ClientResource
+    {
+        $this->checkPermission($organization, 'clients:create');
+
+        $client = new Client();
+        $client->name = $request->input('name');
+        $client->organization()->associate($organization);
+        $client->save();
+
+        return new ClientResource($client);
+    }
+
+    /**
+     * Update client
+     *
+     * @throws AuthorizationException
+     */
+    public function update(Organization $organization, Client $client, TagUpdateRequest $request): ClientResource
+    {
+        $this->checkPermission($organization, 'clients:update', $client);
+
+        $client->name = $request->input('name');
+        $client->save();
+
+        return new ClientResource($client);
+    }
+
+    /**
+     * Delete client
+     *
+     * @throws AuthorizationException
+     */
+    public function destroy(Organization $organization, Client $client): JsonResponse
+    {
+        $this->checkPermission($organization, 'clients:delete', $client);
+
+        $client->delete();
+
+        return response()->json(null, 204);
+    }
+}

app/Http/Controllers/Api/V1/OrganizationController.php

@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Requests\V1\Organization\OrganizationUpdateRequest;
+use App\Http\Resources\V1\Organization\OrganizationResource;
+use App\Models\Organization;
+use Illuminate\Auth\Access\AuthorizationException;
+
+class OrganizationController extends Controller
+{
+    /**
+     * Get organization
+     *
+     * @throws AuthorizationException
+     */
+    public function show(Organization $organization): OrganizationResource
+    {
+        $this->checkPermission($organization, 'organizations:view');
+
+        return new OrganizationResource($organization);
+    }
+
+    /**
+     * Update organization
+     *
+     * @throws AuthorizationException
+     */
+    public function update(Organization $organization, OrganizationUpdateRequest $request): OrganizationResource
+    {
+        $this->checkPermission($organization, 'organizations:update');
+
+        $organization->name = $request->input('name');
+        $organization->save();
+
+        return new OrganizationResource($organization);
+    }
+}

app/Http/Controllers/Api/V1/ProjectController.php

@@ -64,6 +64,7 @@ class ProjectController extends Controller
         $project = new Project();
         $project->name = $request->input('name');
         $project->color = $request->input('color');
+        $project->client_id = $request->input('client_id');
         $project->organization()->associate($organization);
         $project->save();
 

app/Http/Requests/V1/Organization/OrganizationUpdateRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\V1\Organization;
+
+use App\Models\Organization;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * @property Organization $organization Organization from model binding
+ */
+class OrganizationUpdateRequest extends FormRequest
+{
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, array<string|ValidationRule>>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => [
+                'required',
+                'string',
+                'max:255',
+            ],
+        ];
+    }
+}

app/Http/Requests/V1/Project/ProjectStoreRequest.php

@@ -4,9 +4,16 @@ declare(strict_types=1);
 
 namespace App\Http\Requests\V1\Project;
 
+use App\Models\Client;
+use App\Models\Organization;
 use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Foundation\Http\FormRequest;
+use Korridor\LaravelModelValidationRules\Rules\ExistsEloquent;
 
+/**
+ * @property Organization $organization Organization from model binding
+ */
 class ProjectStoreRequest extends FormRequest
 {
     /**
@@ -28,6 +35,13 @@ class ProjectStoreRequest extends FormRequest
                 'string',
                 'max:255',
             ],
+            'client_id' => [
+                'nullable',
+                new ExistsEloquent(Client::class, null, function (Builder $builder): Builder {
+                    /** @var Builder<Client> $builder */
+                    return $builder->whereBelongsTo($this->organization, 'organization');
+                }),
+            ],
         ];
     }
 }

app/Http/Requests/V1/Project/ProjectUpdateRequest.php

@@ -4,9 +4,16 @@ declare(strict_types=1);
 
 namespace App\Http\Requests\V1\Project;
 
+use App\Models\Client;
+use App\Models\Organization;
 use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Foundation\Http\FormRequest;
+use Korridor\LaravelModelValidationRules\Rules\ExistsEloquent;
 
+/**
+ * @property Organization $organization Organization from model binding
+ */
 class ProjectUpdateRequest extends FormRequest
 {
     /**
@@ -27,6 +34,13 @@ class ProjectUpdateRequest extends FormRequest
                 'string',
                 'max:255',
             ],
+            'client_id' => [
+                'nullable',
+                new ExistsEloquent(Client::class, null, function (Builder $builder): Builder {
+                    /** @var Builder<Client> $builder */
+                    return $builder->whereBelongsTo($this->organization, 'organization');
+                }),
+            ],
         ];
     }
 }

app/Http/Resources/V1/Client/ClientCollection.php

@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\V1\Client;
+
+use Illuminate\Http\Resources\Json\ResourceCollection;
+
+class ClientCollection extends ResourceCollection
+{
+    /**
+     * The resource that this resource collects.
+     *
+     * @var string
+     */
+    public $collects = ClientResource::class;
+}

app/Http/Resources/V1/Client/ClientResource.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\V1\Client;
+
+use App\Http\Resources\V1\BaseResource;
+use App\Models\Client;
+use Illuminate\Http\Request;
+
+/**
+ * @property Client $resource
+ */
+class ClientResource extends BaseResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, string|bool|int|null>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            /** @var string $id ID */
+            'id' => $this->resource->id,
+            /** @var string $name Name */
+            'name' => $this->resource->name,
+            /** @var string $created_at When the tag was created */
+            'created_at' => $this->formatDateTime($this->resource->created_at),
+            /** @var string $updated_at When the tag was last updated */
+            'updated_at' => $this->formatDateTime($this->resource->updated_at),
+        ];
+    }
+}

app/Http/Resources/V1/Organization/OrganizationResource.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\V1\Organization;
+
+use App\Http\Resources\V1\BaseResource;
+use App\Models\Organization;
+use Illuminate\Http\Request;
+
+/**
+ * @property Organization $resource
+ */
+class OrganizationResource extends BaseResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, string|bool|int|null>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            /** @var string $id ID */
+            'id' => $this->resource->id,
+            /** @var string $name Name */
+            'name' => $this->resource->name,
+            /** @var string $color Personal organizations automatically created after registration */
+            'is_personal' => $this->resource->personal_team,
+        ];
+    }
+}

app/Models/Client.php

@@ -9,13 +9,15 @@ use Illuminate\Database\Eloquent\Concerns\HasUuids;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Support\Carbon;
 
 /**
  * @property string $id
  * @property string $name
  * @property string $organization_id
- * @property string $created_at
- * @property string $updated_at
+ * @property Carbon|null $created_at
+ * @property Carbon|null $updated_at
  * @property-read Organization $organization
  *
  * @method static ClientFactory factory()
@@ -41,4 +43,12 @@ class Client extends Model
     {
         return $this->belongsTo(Organization::class, 'organization_id');
     }
+
+    /**
+     * @return HasMany<Project>
+     */
+    public function projects(): HasMany
+    {
+        return $this->hasMany(Project::class, 'client_id');
+    }
 }

app/Models/Organization.php

@@ -15,6 +15,8 @@ use Laravel\Jetstream\Team as JetstreamTeam;
 
 /**
  * @property string $id
+ * @property string $name
+ * @property bool $personal_team
  * @property User $owner
  *
  * @method HasMany<OrganizationInvitation> teamInvitations()
@@ -31,6 +33,7 @@ class Organization extends JetstreamTeam
      * @var array<string, string>
      */
     protected $casts = [
+        'name' => 'string',
         'personal_team' => 'boolean',
     ];
 

app/Providers/JetstreamServiceProvider.php

@@ -68,6 +68,12 @@ class JetstreamServiceProvider extends ServiceProvider
             'tags:create',
             'tags:update',
             'tags:delete',
+            'clients:view',
+            'clients:create',
+            'clients:update',
+            'clients:delete',
+            'organizations:view',
+            'organizations:update',
         ])->description('Administrator users can perform any action.');
 
         Jetstream::role('manager', 'Manager', [
@@ -87,6 +93,7 @@ class JetstreamServiceProvider extends ServiceProvider
             'tags:create',
             'tags:update',
             'tags:delete',
+            'organizations:view',
         ])->description('Editor users have the ability to read, create, and update.');
 
         Jetstream::role('employee', 'Employee', [
@@ -96,6 +103,7 @@ class JetstreamServiceProvider extends ServiceProvider
             'time-entries:create:own',
             'time-entries:update:own',
             'time-entries:delete:own',
+            'organizations:view',
         ])->description('Editor users have the ability to read, create, and update.');
     }
 }

database/factories/ProjectFactory.php

@@ -31,16 +31,25 @@ class ProjectFactory extends Factory
 
     public function forOrganization(Organization $organization): self
     {
-        return $this->state(function (array $attributes) use ($organization) {
+        return $this->state(function (array $attributes) use ($organization): array {
             return [
                 'organization_id' => $organization->getKey(),
             ];
         });
     }
 
+    public function withClient(): self
+    {
+        return $this->state(function (array $attributes): array {
+            return [
+                'client_id' => Client::factory(),
+            ];
+        });
+    }
+
     public function forClient(?Client $client): self
     {
-        return $this->state(function (array $attributes) use ($client) {
+        return $this->state(function (array $attributes) use ($client): array {
             return [
                 'client_id' => $client?->getKey(),
             ];

routes/api.php

@@ -2,6 +2,8 @@
 
 declare(strict_types=1);
 
+use App\Http\Controllers\Api\V1\ClientController;
+use App\Http\Controllers\Api\V1\OrganizationController;
 use App\Http\Controllers\Api\V1\ProjectController;
 use App\Http\Controllers\Api\V1\TagController;
 use App\Http\Controllers\Api\V1\TimeEntryController;
@@ -20,29 +22,43 @@ use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 */
 
 Route::middleware('auth:api')->prefix('v1')->name('v1.')->group(static function () {
+    // Organization routes
+    Route::name('organizations.')->group(static function () {
+        Route::get('/organizations/{organization}', [OrganizationController::class, 'show'])->name('show');
+        Route::put('/organizations/{organization}', [OrganizationController::class, 'update'])->name('update');
+    });
+
     // Project routes
     Route::name('projects.')->group(static function () {
-        Route::get('/organization/{organization}/projects', [ProjectController::class, 'index'])->name('index');
-        Route::get('/organization/{organization}/projects/{project}', [ProjectController::class, 'show'])->name('show');
-        Route::post('/organization/{organization}/projects', [ProjectController::class, 'store'])->name('store');
-        Route::put('/organization/{organization}/projects/{project}', [ProjectController::class, 'update'])->name('update');
-        Route::delete('/organization/{organization}/projects/{project}', [ProjectController::class, 'destroy'])->name('destroy');
+        Route::get('/organizations/{organization}/projects', [ProjectController::class, 'index'])->name('index');
+        Route::get('/organizations/{organization}/projects/{project}', [ProjectController::class, 'show'])->name('show');
+        Route::post('/organizations/{organization}/projects', [ProjectController::class, 'store'])->name('store');
+        Route::put('/organizations/{organization}/projects/{project}', [ProjectController::class, 'update'])->name('update');
+        Route::delete('/organizations/{organization}/projects/{project}', [ProjectController::class, 'destroy'])->name('destroy');
     });
 
     // Time entry routes
     Route::name('time-entries.')->group(static function () {
-        Route::get('/organization/{organization}/time-entries', [TimeEntryController::class, 'index'])->name('index');
-        Route::post('/organization/{organization}/time-entries', [TimeEntryController::class, 'store'])->name('store');
-        Route::put('/organization/{organization}/time-entries/{timeEntry}', [TimeEntryController::class, 'update'])->name('update');
-        Route::delete('/organization/{organization}/time-entries/{timeEntry}', [TimeEntryController::class, 'destroy'])->name('destroy');
+        Route::get('/organizations/{organization}/time-entries', [TimeEntryController::class, 'index'])->name('index');
+        Route::post('/organizations/{organization}/time-entries', [TimeEntryController::class, 'store'])->name('store');
+        Route::put('/organizations/{organization}/time-entries/{timeEntry}', [TimeEntryController::class, 'update'])->name('update');
+        Route::delete('/organizations/{organization}/time-entries/{timeEntry}', [TimeEntryController::class, 'destroy'])->name('destroy');
     });
 
     // Tag routes
     Route::name('tags.')->group(static function () {
-        Route::get('/organization/{organization}/tags', [TagController::class, 'index'])->name('index');
-        Route::post('/organization/{organization}/tags', [TagController::class, 'store'])->name('store');
-        Route::put('/organization/{organization}/tags/{tag}', [TagController::class, 'update'])->name('update');
-        Route::delete('/organization/{organization}/tags/{tag}', [TagController::class, 'destroy'])->name('destroy');
+        Route::get('/organizations/{organization}/tags', [TagController::class, 'index'])->name('index');
+        Route::post('/organizations/{organization}/tags', [TagController::class, 'store'])->name('store');
+        Route::put('/organizations/{organization}/tags/{tag}', [TagController::class, 'update'])->name('update');
+        Route::delete('/organizations/{organization}/tags/{tag}', [TagController::class, 'destroy'])->name('destroy');
+    });
+
+    // Client routes
+    Route::name('clients.')->group(static function () {
+        Route::get('/organizations/{organization}/clients', [ClientController::class, 'index'])->name('index');
+        Route::post('/organizations/{organization}/clients', [ClientController::class, 'store'])->name('store');
+        Route::put('/organizations/{organization}/clients/{client}', [ClientController::class, 'update'])->name('update');
+        Route::delete('/organizations/{organization}/clients/{client}', [ClientController::class, 'destroy'])->name('destroy');
     });
 });
 

tests/Unit/Endpoint/Api/V1/ClientEndpointTest.php

@@ -0,0 +1,218 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Endpoint\Api\V1;
+
+use App\Models\Client;
+use App\Models\Organization;
+use Illuminate\Testing\Fluent\AssertableJson;
+use Laravel\Passport\Passport;
+
+class ClientEndpointTest extends ApiEndpointTestAbstract
+{
+    public function test_index_endpoint_fails_if_user_has_no_permission_to_view_clients(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+        ]);
+        $clients = Client::factory()->forOrganization($data->organization)->createMany(4);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->getJson(route('api.v1.clients.index', [$data->organization->getKey()]));
+
+        // Assert
+        $response->assertStatus(403);
+    }
+
+    public function test_index_endpoint_returns_list_of_all_clients_of_organization_ordered_by_created_at_desc_per_default(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'clients:view',
+        ]);
+        $clients = Client::factory()->forOrganization($data->organization)->createMany(4);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->getJson(route('api.v1.clients.index', [$data->organization->getKey()]));
+
+        // Assert
+        $response->assertStatus(200);
+        $response->assertJsonCount(4, 'data');
+        $response->assertJson(fn (AssertableJson $json) => $json
+            ->has('data')
+            ->count('data', 4)
+            ->where('data.0.id', $clients->sortByDesc('created_at')->get(0)->getKey())
+            ->where('data.1.id', $clients->sortByDesc('created_at')->get(1)->getKey())
+            ->where('data.2.id', $clients->sortByDesc('created_at')->get(2)->getKey())
+            ->where('data.3.id', $clients->sortByDesc('created_at')->get(3)->getKey())
+        );
+    }
+
+    public function test_store_endpoint_fails_if_user_has_no_permission_to_create_clients(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+        ]);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.clients.store', [$data->organization->getKey()]), [
+            'name' => 'Test Client',
+        ]);
+
+        // Assert
+        $response->assertStatus(403);
+    }
+
+    public function test_store_endpoint_creates_new_client(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'clients:create',
+        ]);
+        $clientFake = Client::factory()->make();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.clients.store', [$data->organization->getKey()]), [
+            'name' => $clientFake->name,
+        ]);
+
+        // Assert
+        $response->assertStatus(201);
+        $response->assertJson(fn (AssertableJson $json) => $json
+            ->has('data')
+            ->where('data.name', $clientFake->name)
+        );
+    }
+
+    public function test_update_endpoint_fails_if_user_has_no_permission_to_update_clients(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+        ]);
+        $client = Client::factory()->forOrganization($data->organization)->create();
+        $clientFake = Client::factory()->make();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.clients.update', [$data->organization->getKey(), $client->getKey()]), [
+            'name' => $clientFake->name,
+        ]);
+
+        // Assert
+        $response->assertStatus(403);
+    }
+
+    public function test_update_endpoint_fails_if_user_is_not_part_of_client_organization(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'clients:update',
+        ]);
+        $otherOrganization = Organization::factory()->create();
+        $client = Client::factory()->forOrganization($otherOrganization)->create();
+        $clientFake = Client::factory()->make();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.clients.update', [$data->organization->getKey(), $client->getKey()]), [
+            'name' => $clientFake->name,
+        ]);
+
+        // Assert
+        $response->assertStatus(403);
+        $this->assertDatabaseHas(Client::class, [
+            'id' => $client->getKey(),
+            'name' => $client->name,
+            'organization_id' => $otherOrganization->getKey(),
+        ]);
+    }
+
+    public function test_update_endpoint_updates_client(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'clients:update',
+        ]);
+        $client = Client::factory()->forOrganization($data->organization)->create();
+        $clientFake = Client::factory()->make();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.clients.update', [$data->organization->getKey(), $client->getKey()]), [
+            'name' => $clientFake->name,
+        ]);
+
+        // Assert
+        $response->assertStatus(200);
+        $response->assertJson(fn (AssertableJson $json) => $json
+            ->has('data')
+            ->where('data.name', $clientFake->name)
+        );
+        $this->assertDatabaseHas(Client::class, [
+            'name' => $clientFake->name,
+            'organization_id' => $data->organization->getKey(),
+        ]);
+    }
+
+    public function test_destroy_endpoint_fails_if_user_has_no_permission_to_delete_clients(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+        ]);
+        $client = Client::factory()->forOrganization($data->organization)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->deleteJson(route('api.v1.clients.destroy', [$data->organization->getKey(), $client->getKey()]));
+
+        // Assert
+        $response->assertStatus(403);
+    }
+
+    public function test_destroy_endpoint_fails_if_user_is_not_part_of_client_organization(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'clients:delete',
+        ]);
+        $otherOrganization = Organization::factory()->create();
+        $client = Client::factory()->forOrganization($otherOrganization)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->deleteJson(route('api.v1.clients.destroy', [$data->organization->getKey(), $client->getKey()]));
+
+        // Assert
+        $response->assertStatus(403);
+        $this->assertDatabaseHas(Client::class, [
+            'id' => $client->getKey(),
+            'name' => $client->name,
+            'organization_id' => $otherOrganization->getKey(),
+        ]);
+    }
+
+    public function test_destroy_endpoint_deletes_client(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'clients:delete',
+        ]);
+        $client = Client::factory()->forOrganization($data->organization)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->deleteJson(route('api.v1.clients.destroy', [$data->organization->getKey(), $client->getKey()]));
+
+        // Assert
+        $response->assertStatus(204);
+        $response->assertNoContent();
+        $this->assertDatabaseMissing(Client::class, [
+            'id' => $client->getKey(),
+        ]);
+    }
+}

tests/Unit/Endpoint/Api/V1/OrganizationEndpointTest.php

@@ -0,0 +1,79 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Endpoint\Api\V1;
+
+use App\Models\Organization;
+use Laravel\Passport\Passport;
+
+class OrganizationEndpointTest extends ApiEndpointTestAbstract
+{
+    public function test_show_endpoint_fails_if_user_has_no_permission_to_view_organizations(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+        ]);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->getJson(route('api.v1.organizations.show', [$data->organization->getKey()]));
+
+        // Assert
+        $response->assertStatus(403);
+    }
+
+    public function test_show_endpoint_returns_organization(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'organizations:view',
+        ]);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->getJson(route('api.v1.organizations.show', [$data->organization->getKey()]));
+
+        // Assert
+        $response->assertStatus(200);
+        $response->assertJsonPath('data.id', $data->organization->getKey());
+    }
+
+    public function test_update_endpoint_fails_if_user_has_no_permission_to_update_organizations(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+        ]);
+        $organizationFake = Organization::factory()->make();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.organizations.update', [$data->organization->getKey()]), [
+            'name' => $organizationFake->name,
+        ]);
+
+        // Assert
+        $response->assertStatus(403);
+    }
+
+    public function test_update_endpoint_updates_project(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'organizations:update',
+        ]);
+        $organizationFake = Organization::factory()->make();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.organizations.update', [$data->organization->getKey()]), [
+            'name' => $organizationFake->name,
+        ]);
+
+        // Assert
+        $response->assertStatus(200);
+        $this->assertDatabaseHas(Organization::class, [
+            'name' => $organizationFake->name,
+        ]);
+    }
+}

tests/Unit/Endpoint/Api/V1/ProjectEndpointTest.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Tests\Unit\Endpoint\Api\V1;
 
+use App\Models\Client;
 use App\Models\Organization;
 use App\Models\Project;
 use Laravel\Passport\Passport;
@@ -16,6 +17,7 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
         $data = $this->createUserWithPermission([
         ]);
         $projects = Project::factory()->forOrganization($data->organization)->createMany(4);
+        $projectsWithClients = Project::factory()->forOrganization($data->organization)->withClient()->createMany(4);
         Passport::actingAs($data->user);
 
         // Act
@@ -133,6 +135,33 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
         ]);
     }
 
+    public function test_store_endpoint_creates_new_project_with_client(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([
+            'projects:create',
+        ]);
+        $client = Client::factory()->forOrganization($data->organization)->create();
+        $project = Project::factory()->forOrganization($data->organization)->make();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.projects.store', [$data->organization->getKey()]), [
+            'name' => $project->name,
+            'color' => $project->color,
+            'client_id' => $client->getKey(),
+        ]);
+
+        // Assert
+        $response->assertStatus(201);
+        $this->assertDatabaseHas(Project::class, [
+            'name' => $project->name,
+            'color' => $project->color,
+            'organization_id' => $project->organization_id,
+            'client_id' => $client->getKey(),
+        ]);
+    }
+
     public function test_update_endpoint_fails_if_user_is_not_part_of_project_organization(): void
     {
         // Arrange

tests/Unit/Model/ClientModelTest.php

@@ -6,6 +6,7 @@ namespace Tests\Unit\Model;
 
 use App\Models\Client;
 use App\Models\Organization;
+use App\Models\Project;
 
 class ClientModelTest extends ModelTestAbstract
 {
@@ -23,4 +24,22 @@ class ClientModelTest extends ModelTestAbstract
         $this->assertNotNull($organizationRel);
         $this->assertTrue($organizationRel->is($organization));
     }
+
+    public function test_it_has_many_projects(): void
+    {
+        // Arrange
+        $client = Client::factory()->create();
+        $otherClient = Client::factory()->create();
+        $projects = Project::factory()->forClient($client)->createMany(4);
+        $projectsOtherClient = Project::factory()->forClient($otherClient)->createMany(4);
+
+        // Act
+        $client->refresh();
+        $projectsRel = $client->projects;
+
+        // Assert
+        $this->assertNotNull($projectsRel);
+        $this->assertCount(4, $projectsRel);
+        $this->assertTrue($projectsRel->first()->is($projects->first()));
+    }
 }