add invoice copy to openapi client

app/Actions/Jetstream/CreateOrganization.php

@@ -9,6 +9,7 @@ use App\Models\Organization;
 use App\Models\User;
 use App\Service\IpLookup\IpLookupServiceContract;
 use App\Service\OrganizationService;
+use App\Service\UserService;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Validator;
@@ -50,10 +51,8 @@ class CreateOrganization implements CreatesTeams
             $currency
         );
 
-        $user->switchTeam($organization);
+        app(UserService::class)->switchCurrentOrganization($user, $organization);
 
-        // Note: The refresh is necessary for currently unknown reasons. Do not remove it.
-        $organization = $organization->refresh();
         AfterCreateOrganization::dispatch($organization);
 
         return $organization;

app/Console/Commands/Admin/UserCreateCommand.php

@@ -69,7 +69,7 @@ class UserCreateCommand extends Command
             );
         });
         /** @var Organization|null $organization */
-        $organization = $user->ownedTeams->first();
+        $organization = $user->ownedOrganizations->first();
         if ($organization === null) {
             throw new LogicException('User does not have an organization');
         }

app/Filament/Resources/OrganizationResource/RelationManagers/InvitationsRelationManager.php

@@ -21,7 +21,7 @@ use Illuminate\Validation\Rule;
 
 class InvitationsRelationManager extends RelationManager
 {
-    protected static string $relationship = 'teamInvitations';
+    protected static string $relationship = 'organizationInvitations';
 
     protected static ?string $title = 'Invitations';
 

app/Filament/Resources/UserResource.php

@@ -12,6 +12,7 @@ use App\Filament\Resources\UserResource\RelationManagers\OwnedOrganizationsRelat
 use App\Models\User;
 use App\Service\DeletionService;
 use App\Service\TimezoneService;
+use App\Service\UserService;
 use Brick\Money\ISOCurrencyProvider;
 use Exception;
 use Filament\Forms;
@@ -179,7 +180,7 @@ class UserResource extends Resource
             ])
             ->actions([
                 Impersonate::make()->before(function (User $record): void {
-                    if ($record->currentTeam === null) {
+                    if ($record->currentOrganization === null) {
                         $organization = $record->organizations()->where('personal_team', '=', true)->first();
                         if ($organization === null) {
                             $organization = $record->organizations()->first();
@@ -187,8 +188,7 @@ class UserResource extends Resource
                         if ($organization === null) {
                             throw new Exception('User has no organization');
                         }
-                        $record->currentTeam()->associate($organization);
-                        $record->save();
+                        app(UserService::class)->switchCurrentOrganization($record, $organization);
                     }
                 }),
                 Tables\Actions\EditAction::make(),

app/Filament/Resources/UserResource/RelationManagers/OwnedOrganizationsRelationManager.php

@@ -16,7 +16,7 @@ class OwnedOrganizationsRelationManager extends RelationManager
 {
     protected static ?string $title = 'Owned Organizations';
 
-    protected static string $relationship = 'ownedTeams';
+    protected static string $relationship = 'ownedOrganizations';
 
     public function form(Form $form): Form
     {

app/Http/Controllers/Api/V1/InvitationController.php

@@ -40,7 +40,7 @@ class InvitationController extends Controller
     {
         $this->checkPermission($organization, 'invitations:view');
 
-        $invitations = $organization->teamInvitations()
+        $invitations = $organization->organizationInvitations()
             ->orderBy('created_at', 'desc')
             ->paginate(config('app.pagination_per_page_default'));
 

app/Http/Controllers/Api/V1/OrganizationController.php

@@ -14,6 +14,7 @@ use App\Service\BillableRateService;
 use App\Service\DeletionService;
 use App\Service\IpLookup\IpLookupServiceContract;
 use App\Service\OrganizationService;
+use App\Service\UserService;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Http\JsonResponse;
 
@@ -106,10 +107,8 @@ class OrganizationController extends Controller
             $currency
         );
 
-        $user->switchTeam($organization);
+        app(UserService::class)->switchCurrentOrganization($user, $organization);
 
-        // Note: The refresh is necessary for currently unknown reasons. Do not remove it.
-        $organization = $organization->refresh();
         AfterCreateOrganization::dispatch($organization);
 
         return new OrganizationResource($organization, true);

app/Http/Controllers/Api/V1/UserController.php

@@ -100,6 +100,27 @@ class UserController extends Controller
         return new UserResource($user);
     }
 
+    /**
+     * Reset the pending email for a user.
+     *
+     * This endpoint is independent of the organization.
+     *
+     * @operationId resetUserPendingEmail
+     *
+     * @throws AuthorizationException Thrown when the authenticated user does not match the user whose email is pending verification.
+     */
+    public function resetPendingEmail(User $user): JsonResponse
+    {
+        if ($user->getKey() !== $this->user()->getKey()) {
+            throw new AuthorizationException;
+        }
+
+        $user->pending_email = null;
+        $user->save();
+
+        return response()->json(null, 204);
+    }
+
     /**
      * Resend the pending email update verification email.
      *

app/Http/Controllers/Controller.php

@@ -59,7 +59,7 @@ class Controller extends BaseController
     protected function currentOrganization(): Organization
     {
         $user = $this->user();
-        $organization = $user->currentTeam;
+        $organization = $user->currentOrganization;
         if ($organization === null) {
             $organization = $user->organizations()->first();
         }

app/Http/Middleware/HandleInertiaRequests.php

@@ -46,7 +46,7 @@ class HandleInertiaRequests extends Middleware
         /** @var BillingContract $billing */
         $billing = app(BillingContract::class);
 
-        $currentOrganization = $request->user()?->currentTeam;
+        $currentOrganization = $request->user()?->currentOrganization;
 
         return array_merge(parent::share($request), [
             'has_billing_extension' => $hasBilling,

app/Models/Organization.php

@@ -43,7 +43,7 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @property Carbon|null $updated_at
  * @property Collection<int, User> $users
  * @property Collection<int, User> $realUsers
- * @property-read Collection<int, OrganizationInvitation> $teamInvitations
+ * @property-read Collection<int, OrganizationInvitation> $organizationInvitations
  * @property Member $membership
  * @property NumberFormat $number_format
  * @property CurrencyFormat $currency_format
@@ -51,7 +51,6 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @property IntervalFormat $interval_format
  * @property TimeFormat $time_format
  *
- * @method HasMany<OrganizationInvitation, $this> teamInvitations()
  * @method static OrganizationFactory factory()
  */
 class Organization extends JetstreamTeam implements AuditableContract
@@ -111,23 +110,6 @@ class Organization extends JetstreamTeam implements AuditableContract
     protected $attributes = [
     ];
 
-    /**
-     * Get all the non-placeholder users of the organization including its owner.
-     *
-     * @return Collection<int, User>
-     */
-    public function allRealUsers(): Collection
-    {
-        return $this->realUsers->merge([$this->owner]);
-    }
-
-    public function hasRealUserWithEmail(string $email): bool
-    {
-        return $this->allRealUsers()->contains(function (User $user) use ($email): bool {
-            return $user->email === $email;
-        });
-    }
-
     /**
      * Get all the users that belong to the team.
      *
@@ -172,6 +154,14 @@ class Organization extends JetstreamTeam implements AuditableContract
             ->where('is_placeholder', false);
     }
 
+    /**
+     * @return HasMany<OrganizationInvitation, $this>
+     */
+    public function organizationInvitations(): HasMany
+    {
+        return $this->hasMany(OrganizationInvitation::class, 'organization_id');
+    }
+
     /**
      * This method prevents an unhandled exception when the ID is not a UUID.
      * Normally this can be fixed with a route pattern, but Jetstream does not use route model binding.

app/Models/User.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Enums\Role;
 use App\Enums\Weekday;
 use App\Models\Concerns\CustomAuditable;
 use App\Models\Concerns\HasUuids;
@@ -52,6 +53,7 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @property Carbon|null $updated_at
  * @property string|null $current_team_id
  * @property Collection<int, Organization> $organizations
+ * @property Collection<int, Organization> $ownedOrganizations
  * @property Collection<int, TimeEntry> $timeEntries
  * @property Member $membership
  *
@@ -131,16 +133,39 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
     {
         return Attribute::get(function (): string {
             return $this->profile_photo_path
-                ? Storage::disk($this->profilePhotoDisk())->url($this->profile_photo_path)
+                ? Storage::disk(config('filesystems.public'))->url($this->profile_photo_path)
                 : $this->defaultProfilePhotoUrl();
         });
     }
 
+    /**
+     * Get the default profile photo URL if no profile photo has been uploaded.
+     */
+    protected function defaultProfilePhotoUrl(): string
+    {
+        $name = trim(collect(explode(' ', $this->name))->map(function ($segment) {
+            return mb_substr($segment, 0, 1);
+        })->join(' '));
+
+        return 'https://ui-avatars.com/api/?name='.urlencode($name).'&color=7F9CF5&background=EBF4FF';
+    }
+
     public function canAccessPanel(Panel $panel): bool
     {
         return in_array($this->email, config('auth.super_admins', []), true) && $this->hasVerifiedEmail();
     }
 
+    public function isMemberOfOrganization(Organization $organization): bool
+    {
+        if ($this->relationLoaded('organizations')) {
+            return $this->organizations->contains(function (Organization $o) use ($organization): bool {
+                return $o->getKey() === $organization->getKey();
+            });
+        }
+
+        return $this->organizations()->whereKey($organization->getKey())->exists();
+    }
+
     public function canBeImpersonated(): bool
     {
         return $this->is_placeholder === false;
@@ -161,6 +186,14 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
             ->as('membership');
     }
 
+    /**
+     * @return BelongsToMany<Organization, $this, Pivot, 'membership'>
+     */
+    public function ownedOrganizations(): BelongsToMany
+    {
+        return $this->organizations()->wherePivot('role', Role::Owner->value);
+    }
+
     /**
      * @return HasMany<TimeEntry, $this>
      */
@@ -215,12 +248,8 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
      */
     public function scopeBelongsToOrganization(Builder $builder, Organization $organization): Builder
     {
-        return $builder->where(function (Builder $builder) use ($organization): Builder {
-            return $builder->whereHas('organizations', function (Builder $query) use ($organization): void {
-                $query->whereKey($organization->getKey());
-            })->orWhereHas('ownedTeams', function (Builder $query) use ($organization): void {
-                $query->whereKey($organization->getKey());
-            });
+        return $builder->whereHas('organizations', function (Builder $query) use ($organization): void {
+            $query->whereKey($organization->getKey());
         });
     }
 }

app/Policies/OrganizationPolicy.php

@@ -35,7 +35,7 @@ class OrganizationPolicy
             return true;
         }
 
-        return $user->belongsToTeam($organization);
+        return $user->isMemberOfOrganization($organization);
     }
 
     /**
@@ -97,6 +97,6 @@ class OrganizationPolicy
             return true;
         }
 
-        return $user->ownsTeam($organization);
+        return app(PermissionStore::class)->userHas($organization, $user, 'organizations:delete');
     }
 }

app/Service/DeletionService.php

@@ -173,7 +173,7 @@ class DeletionService
         $user->authCodes()->delete();
 
         // Note: Since the deletion of the profile photo is not reversible via a database rollback this needs to be done last
-        $user->deleteProfilePhoto();
+        $this->userService->deleteProfilePhoto($user);
 
         $user->delete();
 

app/Service/MemberService.php

@@ -97,7 +97,7 @@ class MemberService
         $isPlaceholder = $user->is_placeholder;
 
         if (! $isPlaceholder && $user->current_team_id === $member->organization_id) {
-            $user->currentTeam()->disassociate();
+            $user->currentOrganization()->disassociate();
             $user->save();
         }
 
@@ -216,7 +216,7 @@ class MemberService
     {
         $user = $member->user;
         if ($user->current_team_id === $member->organization_id) {
-            $user->currentTeam()->disassociate();
+            $user->currentOrganization()->disassociate();
             $user->save();
         }
 

app/Service/PermissionStore.php

@@ -291,7 +291,7 @@ class PermissionStore
     public function userHas(Organization $organization, User $user, string $permission): bool
     {
         if (! isset($this->permissionCache[$user->getKey().'|'.$organization->getKey()])) {
-            if (! $user->belongsToTeam($organization)) {
+            if (! $user->isMemberOfOrganization($organization)) {
                 return false;
             }
 
@@ -309,7 +309,7 @@ class PermissionStore
      */
     private function getPermissionsByUser(Organization $organization, User $user): array
     {
-        if (! $user->belongsToTeam($organization)) {
+        if (! $user->isMemberOfOrganization($organization)) {
             return [];
         }
 

app/Service/UserService.php

@@ -19,6 +19,7 @@ use App\Models\TimeEntry;
 use App\Models\User;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Storage;
 
 class UserService
 {
@@ -61,7 +62,6 @@ class UserService
                 $intervalFormat,
                 $timeFormat,
             );
-            $user->ownedTeams()->save($organization);
         }
 
         return $user;
@@ -103,13 +103,17 @@ class UserService
             true
         );
 
-        // Set the organization as the user's current organization
-        $user->currentOrganization()->associate($organization);
-        $user->save();
+        $this->switchCurrentOrganization($user, $organization);
 
         AfterCreateOrganization::dispatch($organization);
     }
 
+    public function switchCurrentOrganization(User $user, Organization $organization): void
+    {
+        $user->currentOrganization()->associate($organization);
+        $user->save();
+    }
+
     public function getOrganizationNameForUserName(string $username): string
     {
         return explode(' ', $username, 2)[0]."'s Organization";
@@ -157,4 +161,16 @@ class UserService
             $oldOwner->save();
         }
     }
+
+    public function deleteProfilePhoto(User $user): void
+    {
+        if ($user->profile_photo_path === null) {
+            return;
+        }
+
+        Storage::disk(config('filesystems.public'))->delete($user->profile_photo_path);
+
+        $user->profile_photo_path = null;
+        $user->save();
+    }
 }

database/factories/UserFactory.php

@@ -120,7 +120,7 @@ class UserFactory extends Factory
 
             $organization->owner()->associate($user);
             $organization->users()->attach($user, ['role' => Role::Owner->value]);
-            $user->currentTeam()->associate($organization);
+            $user->currentOrganization()->associate($organization);
             $user->save();
         });
     }

e2e/profile.spec.ts

@@ -8,20 +8,22 @@ import {
 import { getCurrentUserViaApi } from './utils/api';
 import { registerUser } from './utils/members';
 import type { Page } from '@playwright/test';
+import path from 'path';
 
 async function goToProfilePage(page: Page) {
     await page.goto(PLAYWRIGHT_BASE_URL + '/user/profile');
 }
 
+function profileInformationForm(page: Page) {
+    return page
+        .getByRole('heading', { name: 'Profile Information', exact: true })
+        .locator('xpath=ancestor::*[descendant::form][1]');
+}
+
 async function saveProfileForm(page: Page): Promise<void> {
-    await Promise.all([
-        page.waitForResponse(
-            (resp) =>
-                resp.url().includes('/user/profile-information') &&
-                resp.request().method() === 'POST'
-        ),
-        page.getByRole('button', { name: 'Save' }).first().click(),
-    ]);
+    const form = profileInformationForm(page);
+    await form.getByRole('button', { name: 'Save' }).click();
+    await expect(form.getByText('Saved.', { exact: true })).toBeVisible();
 }
 
 test('user name can be updated', async ({ page }) => {
@@ -48,6 +50,66 @@ test('week-start change persists across reload', async ({ page }) => {
     await expect(page.getByLabel('Start of the week')).toHaveValue('sunday');
 });
 
+test('profile photo can be uploaded, persists across reload, and can be removed', async ({
+    page,
+}) => {
+    await goToProfilePage(page);
+    const form = profileInformationForm(page);
+    const profilePhoto = form.getByRole('img', { name: 'John Doe' });
+
+    await expect(profilePhoto).toBeVisible();
+    await expect(profilePhoto).toHaveAttribute('src', /ui-avatars\.com/);
+    await expect(form.getByRole('button', { name: 'Remove Photo' })).toBeHidden();
+
+    await form.locator('#photo').setInputFiles(path.resolve('resources/testfiles/test.png'));
+    await saveProfileForm(page);
+    await expect(profilePhoto).toHaveAttribute('src', /profile-photos/);
+    await expect(form.getByRole('button', { name: 'Remove Photo' })).toBeVisible();
+
+    await page.reload();
+    const reloadedForm = profileInformationForm(page);
+    const reloadedProfilePhoto = reloadedForm.getByRole('img', { name: 'John Doe' });
+    await expect(reloadedProfilePhoto).toHaveAttribute('src', /profile-photos/);
+
+    await Promise.all([
+        page.waitForResponse(
+            (response) =>
+                response.url().includes('/api/v1/users/') &&
+                response.request().method() === 'PUT' &&
+                response.status() === 200
+        ),
+        reloadedForm.getByRole('button', { name: 'Remove Photo' }).click(),
+    ]);
+    await expect(reloadedProfilePhoto).toHaveAttribute('src', /ui-avatars\.com/);
+    await expect(reloadedForm.getByRole('button', { name: 'Remove Photo' })).toBeHidden();
+
+    await page.reload();
+    const finalForm = profileInformationForm(page);
+    await expect(finalForm.getByRole('img', { name: 'John Doe' })).toHaveAttribute(
+        'src',
+        /ui-avatars\.com/
+    );
+    await expect(finalForm.getByRole('button', { name: 'Remove Photo' })).toBeHidden();
+});
+
+test('field-level validation errors render inline when the server returns 422', async ({
+    page,
+}) => {
+    await goToProfilePage(page);
+    const form = profileInformationForm(page);
+    await form.getByLabel('Name').fill('a'.repeat(256));
+    await Promise.all([
+        page.waitForResponse(
+            (response) =>
+                response.url().includes('/api/v1/users/') &&
+                response.request().method() === 'PUT' &&
+                response.status() === 422
+        ),
+        form.getByRole('button', { name: 'Save' }).click(),
+    ]);
+    await expect(form.getByRole('alert').filter({ hasText: /255 characters/i })).toBeVisible();
+});
+
 test('submitting a new email keeps the current email displayed after reload', async ({
     page,
     ctx,
@@ -111,6 +173,94 @@ test('re-submitting the current email does not send a verification email', async
     expect(afterCount).toBe(beforeCount);
 });
 
+test('after submitting a new email the pending-email banner is shown with a resend button', async ({
+    page,
+}) => {
+    await goToProfilePage(page);
+    const newEmail = `pending+${Date.now()}@test.com`;
+    await page.getByLabel('Email').fill(newEmail);
+    await saveProfileForm(page);
+
+    await expect(page.getByText(`A verification link was sent to`)).toBeVisible();
+    await expect(page.getByText(newEmail)).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Resend verification email' })).toBeVisible();
+});
+
+test('clicking resend sends a second verification email and shows confirmation', async ({
+    page,
+    request,
+}) => {
+    await goToProfilePage(page);
+    const newEmail = `resend+${Date.now()}@test.com`;
+    await page.getByLabel('Email').fill(newEmail);
+    await saveProfileForm(page);
+
+    const beforeCount = await waitForEmailCount(request, newEmail, 'Verify Email Address', 1);
+    await page.getByRole('button', { name: 'Resend verification email' }).click();
+
+    await expect(page.getByText('Verification email sent.')).toBeVisible();
+    const afterCount = await waitForEmailCount(
+        request,
+        newEmail,
+        'Verify Email Address',
+        beforeCount + 1
+    );
+    expect(afterCount).toBeGreaterThan(beforeCount);
+});
+
+test('cancelling a pending email change clears it and hides the banner', async ({ page, ctx }) => {
+    const { email: currentEmail } = await getCurrentUserViaApi(ctx);
+    const newEmail = `cancel+${Date.now()}@test.com`;
+
+    await goToProfilePage(page);
+    await page.getByLabel('Email').fill(newEmail);
+    await saveProfileForm(page);
+
+    // The pending-email banner is shown with the cancel control.
+    await expect(page.getByText('A verification link was sent to')).toBeVisible();
+    await expect(page.getByText(newEmail)).toBeVisible();
+    const cancelButton = page.getByRole('button', { name: 'Cancel email change' });
+    await expect(cancelButton).toBeVisible();
+
+    // Cancelling clears the pending email server-side (204).
+    await Promise.all([
+        page.waitForResponse(
+            (response) =>
+                response.url().includes('/reset-pending-email') &&
+                response.request().method() === 'POST' &&
+                response.status() === 204
+        ),
+        cancelButton.click(),
+    ]);
+
+    // The banner disappears and the email field still shows the current address.
+    await expect(page.getByText('A verification link was sent to')).toBeHidden();
+    await expect(page.getByLabel('Email')).toHaveValue(currentEmail);
+
+    // The cancellation is persistent — still gone after a reload.
+    await page.reload();
+    await expect(page.getByText('A verification link was sent to')).toBeHidden();
+    await expect(page.getByLabel('Email')).toHaveValue(currentEmail);
+});
+
+test('re-submitting the same pending email does not send another verification email', async ({
+    page,
+    request,
+}) => {
+    await goToProfilePage(page);
+    const newEmail = `dup+${Date.now()}@test.com`;
+    await page.getByLabel('Email').fill(newEmail);
+    await saveProfileForm(page);
+    const beforeCount = await waitForEmailCount(request, newEmail, 'Verify Email Address', 1);
+
+    await page.getByLabel('Email').fill(newEmail);
+    await saveProfileForm(page);
+
+    await new Promise((r) => setTimeout(r, 1000));
+    const afterCount = await countEmailsWithSubject(request, newEmail, 'Verify Email Address');
+    expect(afterCount).toBe(beforeCount);
+});
+
 test('clicking the verification link swaps the email and shows a success banner', async ({
     page,
 }) => {
@@ -184,6 +334,43 @@ test('visiting the verification link while logged out redirects to login', async
     }
 });
 
+test('delete account shows an error when the password is wrong', async ({ page }) => {
+    await goToProfilePage(page);
+    await page.getByRole('button', { name: 'Delete Account' }).click();
+    const dialog = page.getByRole('dialog');
+    await dialog.getByPlaceholder('Password').fill('not-the-real-password');
+    await Promise.all([
+        page.waitForResponse(
+            (response) =>
+                response.url().includes('/user/confirm-password') &&
+                response.request().method() === 'POST' &&
+                response.status() === 422
+        ),
+        dialog.getByRole('button', { name: 'Delete Account' }).click(),
+    ]);
+    await expect(dialog.getByRole('alert')).toBeVisible();
+    await expect(dialog).toBeVisible();
+});
+
+test('delete account succeeds with the correct password and logs the user out', async ({
+    page,
+}) => {
+    await goToProfilePage(page);
+    await page.getByRole('button', { name: 'Delete Account' }).click();
+    const dialog = page.getByRole('dialog');
+    await dialog.getByPlaceholder('Password').fill(TEST_USER_PASSWORD);
+    await Promise.all([
+        page.waitForResponse(
+            (response) =>
+                response.url().includes('/api/v1/users/') &&
+                response.request().method() === 'DELETE' &&
+                response.status() === 204
+        ),
+        dialog.getByRole('button', { name: 'Delete Account' }).click(),
+    ]);
+    await page.waitForURL(/\/login/);
+});
+
 async function createNewApiToken(page) {
     await page.getByLabel('API Key Name').fill('NEW API KEY');
     await Promise.all([

resources/js/Components/Banner.vue

@@ -5,6 +5,15 @@ import { usePage } from '@inertiajs/vue3';
 const ALLOWED_STYLES = ['success', 'danger', 'info', 'warning'] as const;
 type BannerStyle = (typeof ALLOWED_STYLES)[number];
 
+withDefaults(
+    defineProps<{
+        // Render as a self-contained rounded alert that sits inside a card
+        // (e.g. the auth card on login/register) instead of a full-width page banner.
+        card?: boolean;
+    }>(),
+    { card: false }
+);
+
 const page = usePage<{
     flash: {
         bannerText?: string;
@@ -26,10 +35,16 @@ const show = ref(true);
         <div
             v-if="show && message"
             data-testid="banner"
-            class="bg-secondary border-b border-border-secondary">
-            <div class="mx-auto py-1 px-3 sm:px-6 lg:px-8">
+            :class="
+                card
+                    ? 'bg-secondary border border-border-secondary rounded-lg mb-4'
+                    : 'bg-secondary border-b border-border-secondary'
+            ">
+            <div :class="card ? 'py-2 px-3' : 'mx-auto py-1 px-3 sm:px-6 lg:px-8'">
                 <div class="flex items-center justify-between flex-wrap">
-                    <div class="w-0 flex-1 flex items-center min-w-0">
+                    <div
+                        class="w-0 flex-1 flex min-w-0"
+                        :class="card ? 'items-start' : 'items-center'">
                         <span class="flex">
                             <svg
                                 v-if="style === 'success'"
@@ -74,7 +89,9 @@ const show = ref(true);
                             </svg>
                         </span>
 
-                        <p class="ms-3 font-medium text-sm text-text-primary truncate">
+                        <p
+                            class="ms-3 font-medium text-sm text-text-primary"
+                            :class="{ truncate: !card }">
                             {{ message }}
                         </p>
                     </div>

resources/js/Pages/Auth/Login.vue

@@ -37,8 +37,6 @@ const page = usePage<{
 <template>
     <Head title="Log in" />
 
-    <Banner />
-
     <AuthenticationCard>
         <template #logo>
             <AuthenticationCardLogo />
@@ -52,6 +50,8 @@ const page = usePage<{
             </Link>
         </template>
 
+        <Banner card />
+
         <div v-if="status" class="mb-4 font-medium text-sm text-green-400">
             {{ status }}
         </div>

resources/js/Pages/Auth/Register.vue

@@ -42,8 +42,6 @@ const page = usePage<{
 <template>
     <Head title="Register" />
 
-    <Banner />
-
     <AuthenticationCard>
         <template #logo>
             <AuthenticationCardLogo />
@@ -58,6 +56,8 @@ const page = usePage<{
             </Link>
         </template>
 
+        <Banner card />
+
         <div
             v-if="page.props.flash?.message"
             class="bg-red-400 text-black text-center w-full px-3 py-1 mb-4 rounded-lg">

resources/js/Pages/Profile/Partials/DeleteUserForm.vue

@@ -1,40 +1,57 @@
 <script setup lang="ts">
 import { ref } from 'vue';
-import { useForm } from '@inertiajs/vue3';
+import axios from 'axios';
 import ActionSection from '@/Components/ActionSection.vue';
 import DangerButton from '@/packages/ui/src/Buttons/DangerButton.vue';
 import DialogModal from '@/packages/ui/src/DialogModal.vue';
 import { Field, FieldError } from '@/packages/ui/src/field';
 import SecondaryButton from '@/packages/ui/src/Buttons/SecondaryButton.vue';
 import TextInput from '@/packages/ui/src/Input/TextInput.vue';
+import { useDeleteUserMutation, useUserQuery } from '@/utils/useUserQuery';
+
+const { user } = useUserQuery();
+const deleteUserMutation = useDeleteUserMutation();
 
 const confirmingUserDeletion = ref(false);
-const passwordInput = ref<HTMLElement | null>(null);
+const passwordInput = ref<HTMLInputElement | null>(null);
+const password = ref('');
+const passwordError = ref('');
+const processing = ref(false);
 
-const form = useForm({
-    password: '',
-});
-
-const confirmUserDeletion = () => {
+function confirmUserDeletion() {
     confirmingUserDeletion.value = true;
-
     setTimeout(() => passwordInput.value?.focus(), 250);
-};
+}
 
-const deleteUser = () => {
-    form.delete(route('current-user.destroy'), {
-        preserveScroll: true,
-        onSuccess: () => closeModal(),
-        onError: () => passwordInput.value?.focus(),
-        onFinish: () => form.reset(),
-    });
-};
+async function deleteUser() {
+    if (!user.value || processing.value) return;
+    processing.value = true;
+    passwordError.value = '';
+    try {
+        await axios.post(route('password.confirm'), { password: password.value });
+    } catch (error) {
+        processing.value = false;
+        if (axios.isAxiosError(error) && error.response?.status === 422) {
+            passwordError.value = error.response.data?.errors?.password?.[0] ?? 'Invalid password.';
+        } else {
+            passwordError.value = 'Could not confirm password. Please try again.';
+        }
+        passwordInput.value?.focus();
+        return;
+    }
+    try {
+        await deleteUserMutation.mutateAsync(user.value.id);
+        window.location.href = '/';
+    } catch {
+        processing.value = false;
+    }
+}
 
-const closeModal = () => {
+function closeModal() {
     confirmingUserDeletion.value = false;
-
-    form.reset();
-};
+    password.value = '';
+    passwordError.value = '';
+}
 </script>
 
 <template>
@@ -66,16 +83,14 @@ const closeModal = () => {
                     <Field class="mt-4">
                         <TextInput
                             ref="passwordInput"
-                            v-model="form.password"
+                            v-model="password"
                             type="password"
                             class="block w-3/4"
                             placeholder="Password"
                             autocomplete="current-password"
                             @keyup.enter="deleteUser" />
 
-                        <FieldError v-if="form.errors.password">{{
-                            form.errors.password
-                        }}</FieldError>
+                        <FieldError v-if="passwordError">{{ passwordError }}</FieldError>
                     </Field>
                 </template>
 
@@ -84,8 +99,8 @@ const closeModal = () => {
 
                     <DangerButton
                         class="ms-3"
-                        :class="{ 'opacity-25': form.processing }"
-                        :disabled="form.processing"
+                        :class="{ 'opacity-25': processing }"
+                        :disabled="processing"
                         @click="deleteUser">
                         Delete Account
                     </DangerButton>

resources/js/Pages/Profile/Partials/UpdateProfileInformationForm.vue

@@ -1,93 +1,190 @@
 <script setup lang="ts">
-import { ref } from 'vue';
-import { Link, router, useForm, usePage } from '@inertiajs/vue3';
+import { computed, onBeforeUnmount, ref, watch } from 'vue';
+import { usePage } from '@inertiajs/vue3';
+import axios from 'axios';
 import ActionMessage from '@/Components/ActionMessage.vue';
 import FormSection from '@/Components/FormSection.vue';
-import { Field, FieldLabel, FieldError } from '@/packages/ui/src/field';
+import { Field, FieldError, FieldLabel } from '@/packages/ui/src/field';
+import { Button } from '@/packages/ui/src/Buttons';
 import PrimaryButton from '@/packages/ui/src/Buttons/PrimaryButton.vue';
 import SecondaryButton from '@/packages/ui/src/Buttons/SecondaryButton.vue';
 import TextInput from '@/packages/ui/src/Input/TextInput.vue';
-import type { User } from '@/types/models';
+import {
+    useResendUserEmailVerificationMutation,
+    useResetUserPendingEmailMutation,
+    useUpdateUserMutation,
+    useUserQuery,
+} from '@/utils/useUserQuery';
+import type { UpdateUserBody, User } from '@/packages/api/src';
 
-const props = defineProps<{
-    user: User;
-}>();
+const { user } = useUserQuery();
+const updateUser = useUpdateUserMutation();
+const resendVerification = useResendUserEmailVerificationMutation();
+const resetPendingEmail = useResetUserPendingEmailMutation();
 
-const form = useForm({
-    _method: 'PUT',
-    name: props.user.name,
-    email: props.user.email,
-    photo: null as File | null,
-    timezone: props.user.timezone,
-    week_start: props.user.week_start,
-});
+const name = ref('');
+const email = ref('');
+const timezone = ref('');
+const weekStart = ref('');
 
-const verificationLinkSent = ref<boolean | null>(null);
-const photoPreview = ref<ArrayBuffer | undefined | string | null>(null);
+const photoBase64 = ref<string | null>(null);
+const photoPreview = ref<string | null>(null);
 const photoInput = ref<HTMLInputElement | null>(null);
 
-const updateProfileInformation = () => {
-    if (photoInput.value && photoInput.value.files && photoInput.value.files?.length > 0) {
-        form.photo = photoInput.value?.files[0] ?? null;
+const recentlySaved = ref(false);
+const resendCooldown = ref(false);
+let resendCooldownTimer: ReturnType<typeof setTimeout> | null = null;
+
+function seedForm(u: User) {
+    name.value = u.name;
+    email.value = u.email;
+    timezone.value = u.timezone;
+    weekStart.value = u.week_start;
+}
+
+watch(
+    user,
+    (u, prev) => {
+        if (u && prev === undefined) seedForm(u);
+    },
+    { immediate: true }
+);
+
+const isUserLoaded = computed(() => user.value !== undefined);
+const isSaveDisabled = computed(() => !isUserLoaded.value || updateUser.isPending.value);
+const pendingEmail = computed(() => user.value?.pending_email ?? null);
+const hasUploadedPhoto = computed(() => {
+    const url = user.value?.profile_photo_url;
+    return !!url && !url.includes('ui-avatars.com');
+});
+
+const fieldErrors = computed<Record<string, string>>(() => {
+    const err = updateUser.error.value;
+    if (!axios.isAxiosError(err) || err.response?.status !== 422) return {};
+    const raw = err.response.data?.errors as Record<string, string[]> | undefined;
+    if (!raw) return {};
+    const flat: Record<string, string> = {};
+    for (const [key, messages] of Object.entries(raw)) {
+        if (Array.isArray(messages) && messages[0]) flat[key] = messages[0];
+    }
+    return flat;
+});
+
+function buildPayload(): UpdateUserBody {
+    if (!user.value) return {};
+    const body: UpdateUserBody = {};
+    if (name.value !== user.value.name) body.name = name.value;
+
+    const typedEmail = email.value.trim().toLowerCase();
+    const currentEmail = user.value.email.toLowerCase();
+    const currentPending = (user.value.pending_email ?? '').toLowerCase();
+    if (typedEmail !== currentEmail && typedEmail !== currentPending) {
+        body.email = email.value.trim();
     }
 
-    form.post(route('user-profile-information.update'), {
-        errorBag: 'updateProfileInformation',
-        preserveScroll: true,
-        onSuccess: () => clearPhotoFileInput(),
-    });
-};
+    if (timezone.value !== user.value.timezone) body.timezone = timezone.value;
+    if (weekStart.value !== user.value.week_start) {
+        body.week_start = weekStart.value as UpdateUserBody['week_start'];
+    }
+    if (photoBase64.value !== null) body.photo = photoBase64.value;
+    return body;
+}
 
-const sendEmailVerification = () => {
-    verificationLinkSent.value = true;
-};
+function clearPhotoInput() {
+    if (photoInput.value) photoInput.value.value = '';
+    photoBase64.value = null;
+    photoPreview.value = null;
+}
 
-const selectNewPhoto = () => {
+function selectNewPhoto() {
+    if (!isUserLoaded.value) return;
     photoInput.value?.click();
-};
+}
 
-const updatePhotoPreview = () => {
-    if (photoInput.value?.files) {
-        const photo = photoInput.value?.files[0];
-        if (!photo) return;
+function readSelectedPhoto() {
+    if (!isUserLoaded.value) return;
+    const file = photoInput.value?.files?.[0];
+    if (!file) return;
+    const reader = new FileReader();
+    reader.onload = (e) => {
+        const dataUrl = e.target?.result as string;
+        photoBase64.value = dataUrl;
+        photoPreview.value = dataUrl;
+    };
+    reader.readAsDataURL(file);
+}
 
-        const reader = new FileReader();
-
-        reader.onload = (e) => {
-            photoPreview.value = e.target?.result;
-        };
-
-        reader.readAsDataURL(photo);
+async function save() {
+    if (isSaveDisabled.value || !user.value) return;
+    const body = buildPayload();
+    if (Object.keys(body).length === 0) {
+        flashSaved();
+        return;
     }
-};
-
-const deletePhoto = () => {
-    router.delete(route('current-user-photo.destroy'), {
-        preserveScroll: true,
-        onSuccess: () => {
-            photoPreview.value = null;
-            clearPhotoFileInput();
-        },
-    });
-};
-
-const clearPhotoFileInput = () => {
-    if (photoInput.value?.value) {
-        photoInput.value.value = '';
+    try {
+        const updated = await updateUser.mutateAsync({ userId: user.value.id, body });
+        seedForm(updated);
+        clearPhotoInput();
+        flashSaved();
+    } catch {
+        // 422: field errors render via fieldErrors. Other errors: toast handled in the mutation.
     }
-};
+}
+
+async function removePhoto() {
+    if (!isUserLoaded.value || updateUser.isPending.value || !user.value) return;
+    try {
+        await updateUser.mutateAsync({ userId: user.value.id, body: { photo: null } });
+        clearPhotoInput();
+    } catch {
+        // notification handled by mutation
+    }
+}
+
+async function clickResend() {
+    if (!user.value || resendCooldown.value || resendVerification.isPending.value) return;
+    try {
+        await resendVerification.mutateAsync(user.value.id);
+        resendCooldown.value = true;
+        if (resendCooldownTimer) clearTimeout(resendCooldownTimer);
+        resendCooldownTimer = setTimeout(() => {
+            resendCooldown.value = false;
+        }, 5000);
+    } catch {
+        // notification handled by mutation
+    }
+}
+
+async function clickCancelEmailChange() {
+    if (!user.value || resetPendingEmail.isPending.value) return;
+    try {
+        // Clears pending_email on the server; the pending banner hides once the
+        // me query refetches. The email field already shows the current address.
+        await resetPendingEmail.mutateAsync(user.value.id);
+    } catch {
+        // notification handled by mutation
+    }
+}
+
+function flashSaved() {
+    recentlySaved.value = true;
+    setTimeout(() => (recentlySaved.value = false), 2000);
+}
+
+onBeforeUnmount(() => {
+    if (resendCooldownTimer) clearTimeout(resendCooldownTimer);
+});
 
 const page = usePage<{
-    jetstream: {
-        managesProfilePhotos: boolean;
-        hasEmailVerification: boolean;
-    };
+    jetstream: { managesProfilePhotos: boolean };
+    timezones: Record<string, string>;
+    weekdays: Record<string, string>;
 }>();
 </script>
 
 <template>
-    <FormSection @submitted="updateProfileInformation">
-        <template #title> Profile Information</template>
+    <FormSection @submitted="save">
+        <template #title>Profile Information</template>
 
         <template #description>
             Update your account's profile information and email address.
@@ -96,44 +193,51 @@ const page = usePage<{
         <template #form>
             <!-- Profile Photo -->
             <div v-if="page.props.jetstream.managesProfilePhotos" class="col-span-6 sm:col-span-4">
-                <!-- Profile Photo File Input -->
                 <input
                     id="photo"
                     ref="photoInput"
                     type="file"
+                    accept="image/jpeg,image/png"
                     class="hidden"
-                    @change="updatePhotoPreview" />
+                    :disabled="!isUserLoaded"
+                    @change="readSelectedPhoto" />
 
                 <FieldLabel for="photo">Photo</FieldLabel>
 
-                <!-- Current Profile Photo -->
                 <div v-show="!photoPreview" class="mt-2">
                     <img
+                        v-if="user"
                         :src="user.profile_photo_url"
                         :alt="user.name"
                         class="rounded-full h-20 w-20 object-cover" />
                 </div>
 
-                <!-- New Profile Photo Preview -->
                 <div v-show="photoPreview" class="mt-2">
                     <span
                         class="block rounded-full w-20 h-20 bg-cover bg-no-repeat bg-center"
                         :style="'background-image: url(\'' + photoPreview + '\');'" />
                 </div>
 
-                <SecondaryButton class="mt-2 me-2" type="button" @click.prevent="selectNewPhoto">
+                <SecondaryButton
+                    class="mt-2 me-2"
+                    type="button"
+                    :disabled="!isUserLoaded"
+                    @click.prevent="selectNewPhoto">
                     Select A New Photo
                 </SecondaryButton>
 
                 <SecondaryButton
-                    v-if="user.profile_photo_path"
+                    v-if="hasUploadedPhoto"
                     type="button"
                     class="mt-2"
-                    @click.prevent="deletePhoto">
+                    :disabled="!isUserLoaded || updateUser.isPending.value"
+                    @click.prevent="removePhoto">
                     Remove Photo
                 </SecondaryButton>
 
-                <FieldError v-if="form.errors.photo">{{ form.errors.photo }}</FieldError>
+                <FieldError v-if="fieldErrors.photo" class="mt-2">
+                    {{ fieldErrors.photo }}
+                </FieldError>
             </div>
 
             <!-- Name -->
@@ -141,12 +245,13 @@ const page = usePage<{
                 <FieldLabel for="name">Name</FieldLabel>
                 <TextInput
                     id="name"
-                    v-model="form.name"
+                    v-model="name"
                     type="text"
                     class="block w-full"
                     required
+                    :disabled="!isUserLoaded"
                     autocomplete="name" />
-                <FieldError v-if="form.errors.name">{{ form.errors.name }}</FieldError>
+                <FieldError v-if="fieldErrors.name">{{ fieldErrors.name }}</FieldError>
             </Field>
 
             <!-- Email -->
@@ -154,34 +259,39 @@ const page = usePage<{
                 <FieldLabel for="email">Email</FieldLabel>
                 <TextInput
                     id="email"
-                    v-model="form.email"
+                    v-model="email"
                     type="email"
                     class="block w-full"
                     required
+                    :disabled="!isUserLoaded"
                     autocomplete="username" />
-                <FieldError v-if="form.errors.email">{{ form.errors.email }}</FieldError>
+                <FieldError v-if="fieldErrors.email">{{ fieldErrors.email }}</FieldError>
 
-                <div
-                    v-if="
-                        page.props.jetstream.hasEmailVerification && user.email_verified_at === null
-                    ">
-                    <p class="text-sm mt-2 text-text-primary">
-                        Your email address is unverified.
-
-                        <Link
-                            :href="route('verification.send')"
-                            method="post"
-                            as="button"
-                            class="underline text-sm text-text-secondary hover:text-text-secondary rounded-md focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500 dark:focus:ring-offset-gray-800"
-                            @click.prevent="sendEmailVerification">
-                            Click here to re-send the verification email.
-                        </Link>
+                <div v-if="pendingEmail" class="mt-2 text-sm">
+                    <p class="text-text-primary">
+                        A verification link was sent to
+                        <span class="font-medium">{{ pendingEmail }}</span
+                        >. Click the link in the email to confirm the change.
                     </p>
-
-                    <div
-                        v-show="verificationLinkSent"
-                        class="mt-2 font-medium text-sm text-green-400">
-                        A new verification link has been sent to your email address.
+                    <div class="mt-2 -ms-3 flex flex-wrap items-center gap-x-1 gap-y-1">
+                        <Button
+                            v-if="!resendCooldown"
+                            variant="ghost"
+                            size="sm"
+                            type="button"
+                            :disabled="!isUserLoaded || resendVerification.isPending.value"
+                            @click="clickResend">
+                            Resend verification email
+                        </Button>
+                        <p v-else class="ms-3 font-medium text-green-400">Verification email sent.</p>
+                        <Button
+                            variant="ghost"
+                            size="sm"
+                            type="button"
+                            :disabled="!isUserLoaded || resetPendingEmail.isPending.value"
+                            @click="clickCancelEmailChange">
+                            Cancel email change
+                        </Button>
                     </div>
                 </div>
             </Field>
@@ -191,19 +301,20 @@ const page = usePage<{
                 <FieldLabel for="timezone">Timezone</FieldLabel>
                 <select
                     id="timezone"
-                    v-model="form.timezone"
+                    v-model="timezone"
                     name="timezone"
                     required
+                    :disabled="!isUserLoaded"
                     class="block w-full border-input-border bg-input-background text-text-primary focus:border-input-border-active rounded-md shadow-sm">
                     <option value="" disabled>Select a Timezone</option>
                     <option
-                        v-for="(timezoneTranslated, timezoneKey) in $page.props.timezones"
-                        :key="timezoneKey"
-                        :value="timezoneKey">
+                        v-for="(timezoneTranslated, timezoneValue) in page.props.timezones"
+                        :key="timezoneValue"
+                        :value="timezoneValue">
                         {{ timezoneTranslated }}
                     </option>
                 </select>
-                <FieldError v-if="form.errors.timezone">{{ form.errors.timezone }}</FieldError>
+                <FieldError v-if="fieldErrors.timezone">{{ fieldErrors.timezone }}</FieldError>
             </Field>
 
             <!-- Week start -->
@@ -211,26 +322,27 @@ const page = usePage<{
                 <FieldLabel for="week_start">Start of the week</FieldLabel>
                 <select
                     id="week_start"
-                    v-model="form.week_start"
+                    v-model="weekStart"
                     name="week_start"
                     required
+                    :disabled="!isUserLoaded"
                     class="block w-full border-input-border bg-input-background text-text-primary focus:border-input-border-active rounded-md shadow-sm">
                     <option value="" disabled>Select a week day</option>
                     <option
-                        v-for="(weekdayTranslated, weekdayKey) in $page.props.weekdays"
-                        :key="weekdayKey"
-                        :value="weekdayKey">
+                        v-for="(weekdayTranslated, weekdayValue) in page.props.weekdays"
+                        :key="weekdayValue"
+                        :value="weekdayValue">
                         {{ weekdayTranslated }}
                     </option>
                 </select>
-                <FieldError v-if="form.errors.week_start">{{ form.errors.week_start }}</FieldError>
+                <FieldError v-if="fieldErrors.week_start">{{ fieldErrors.week_start }}</FieldError>
             </Field>
         </template>
 
         <template #actions>
-            <ActionMessage :on="form.recentlySuccessful" class="me-3"> Saved. </ActionMessage>
+            <ActionMessage :on="recentlySaved" class="me-3"> Saved. </ActionMessage>
 
-            <PrimaryButton :class="{ 'opacity-25': form.processing }" :disabled="form.processing">
+            <PrimaryButton :class="{ 'opacity-25': isSaveDisabled }" :disabled="isSaveDisabled">
                 Save
             </PrimaryButton>
         </template>

resources/js/Pages/Profile/Show.vue

@@ -39,7 +39,7 @@ const page = usePage<{
         <div>
             <div class="max-w-7xl mx-auto py-10 sm:px-6 lg:px-8">
                 <div v-if="page.props.jetstream.canUpdateProfileInformation">
-                    <UpdateProfileInformationForm :user="page.props.auth.user" />
+                    <UpdateProfileInformationForm />
 
                     <SectionBorder />
                 </div>

resources/js/packages/api/src/openapi.json.client.ts

@@ -1898,6 +1898,54 @@ const endpoints = makeApi([
             },
         ],
     },
+    {
+        method: 'post',
+        path: '/v1/organizations/:organization/invoices/:invoice/copy',
+        alias: 'copyInvoice',
+        requestFormat: 'json',
+        parameters: [
+            {
+                name: 'body',
+                type: 'Body',
+                schema: z.object({ reference: z.string() }).passthrough(),
+            },
+            {
+                name: 'organization',
+                type: 'Path',
+                schema: z.string(),
+            },
+            {
+                name: 'invoice',
+                type: 'Path',
+                schema: z.string(),
+            },
+        ],
+        response: z.object({ data: DetailedInvoiceResource }).passthrough(),
+        errors: [
+            {
+                status: 401,
+                description: `Unauthenticated`,
+                schema: z.object({ message: z.string() }).passthrough(),
+            },
+            {
+                status: 403,
+                description: `Authorization error`,
+                schema: z.object({ message: z.string() }).passthrough(),
+            },
+            {
+                status: 404,
+                description: `Not found`,
+                schema: z.object({ message: z.string() }).passthrough(),
+            },
+            {
+                status: 422,
+                description: `Validation error`,
+                schema: z
+                    .object({ message: z.string(), errors: z.record(z.array(z.string())) })
+                    .passthrough(),
+            },
+        ],
+    },
     {
         method: 'get',
         path: '/v1/organizations/:organization/invoices/:invoice',
@@ -4486,6 +4534,77 @@ The report is considered public if the `is_public` field is set to &#x
             },
         ],
     },
+    {
+        method: 'delete',
+        path: '/v1/users/:user',
+        alias: 'deleteUser',
+        description: `This endpoint is independent of the organization.`,
+        requestFormat: 'json',
+        parameters: [
+            {
+                name: 'user',
+                type: 'Path',
+                schema: z.string(),
+            },
+        ],
+        response: z.void(),
+        errors: [
+            {
+                status: 400,
+                description: `API exception`,
+                schema: z
+                    .object({ error: z.boolean(), key: z.string(), message: z.string() })
+                    .passthrough(),
+            },
+            {
+                status: 401,
+                description: `Unauthenticated`,
+                schema: z.object({ message: z.string() }).passthrough(),
+            },
+            {
+                status: 403,
+                description: `Authorization error`,
+                schema: z.object({ message: z.string() }).passthrough(),
+            },
+            {
+                status: 404,
+                description: `Not found`,
+                schema: z.object({ message: z.string() }).passthrough(),
+            },
+        ],
+    },
+    {
+        method: 'post',
+        path: '/v1/users/:user/reset-pending-email',
+        alias: 'resetUserPendingEmail',
+        description: `This endpoint is independent of the organization.`,
+        requestFormat: 'json',
+        parameters: [
+            {
+                name: 'user',
+                type: 'Path',
+                schema: z.string(),
+            },
+        ],
+        response: z.void(),
+        errors: [
+            {
+                status: 401,
+                description: `Unauthenticated`,
+                schema: z.object({ message: z.string() }).passthrough(),
+            },
+            {
+                status: 403,
+                description: `Authorization error`,
+                schema: z.object({ message: z.string() }).passthrough(),
+            },
+            {
+                status: 404,
+                description: `Not found`,
+                schema: z.object({ message: z.string() }).passthrough(),
+            },
+        ],
+    },
     {
         method: 'post',
         path: '/v1/users/:user/resend-email-verification',

resources/js/utils/useUserQuery.ts

@@ -0,0 +1,113 @@
+import { useMutation, useQuery, useQueryClient } from '@tanstack/vue-query';
+import { computed } from 'vue';
+import axios from 'axios';
+import { api, type UpdateUserBody, type User } from '@/packages/api/src';
+import { useNotificationsStore } from '@/utils/notification';
+
+const ME_QUERY_KEY = ['me'] as const;
+
+export function useUserQuery() {
+    const query = useQuery({
+        queryKey: ME_QUERY_KEY,
+        queryFn: async () => {
+            const response = await api.getMe();
+            return response.data;
+        },
+        staleTime: 1000 * 30,
+    });
+
+    const user = computed<User | undefined>(() => query.data.value);
+
+    return { ...query, user };
+}
+
+export function useUpdateUserMutation() {
+    const queryClient = useQueryClient();
+    const { addNotification } = useNotificationsStore();
+
+    return useMutation({
+        mutationFn: async ({
+            userId,
+            body,
+        }: {
+            userId: string;
+            body: UpdateUserBody;
+        }): Promise<User> => {
+            try {
+                const response = await api.updateUser(body, { params: { user: userId } });
+                return response.data;
+            } catch (error) {
+                // 422 field errors are rendered inline by the form; suppress the toast for those.
+                // Re-throw the AxiosError so consumers can read response.data.errors.
+                if (!axios.isAxiosError(error) || error.response?.status !== 422) {
+                    addNotification(
+                        'error',
+                        'Failed to update profile',
+                        axios.isAxiosError(error)
+                            ? (error.response?.data?.message ?? 'Please try again later.')
+                            : 'Please try again later.'
+                    );
+                }
+                throw error;
+            }
+        },
+        onSuccess: () => {
+            queryClient.invalidateQueries({ queryKey: ME_QUERY_KEY });
+        },
+    });
+}
+
+export function useDeleteUserMutation() {
+    const { addNotification } = useNotificationsStore();
+
+    return useMutation({
+        mutationFn: async (userId: string) => {
+            try {
+                await api.deleteUser(undefined, { params: { user: userId } });
+            } catch (error) {
+                if (!axios.isAxiosError(error) || error.response?.status !== 422) {
+                    addNotification(
+                        'error',
+                        'Failed to delete account',
+                        axios.isAxiosError(error)
+                            ? (error.response?.data?.message ?? 'Please try again later.')
+                            : 'Please try again later.'
+                    );
+                }
+                throw error;
+            }
+        },
+    });
+}
+
+export function useResendUserEmailVerificationMutation() {
+    const { handleApiRequestNotifications } = useNotificationsStore();
+
+    return useMutation({
+        mutationFn: async (userId: string) => {
+            return handleApiRequestNotifications(
+                () => api.resendUserEmailVerification(undefined, { params: { user: userId } }),
+                'Verification email sent',
+                'Failed to resend verification email'
+            );
+        },
+    });
+}
+
+export function useResetUserPendingEmailMutation() {
+    const queryClient = useQueryClient();
+    const { handleApiRequestNotifications } = useNotificationsStore();
+
+    return useMutation({
+        mutationFn: async (userId: string) => {
+            return handleApiRequestNotifications(
+                () => api.resetUserPendingEmail(undefined, { params: { user: userId } }),
+                'Email change canceled',
+                'Failed to cancel email change'
+            );
+        },
+        onSuccess: () => {
+            queryClient.invalidateQueries({ queryKey: ME_QUERY_KEY });
+        },
+    });
+}

routes/api.php

@@ -64,6 +64,7 @@ Route::prefix('v1')->name('v1.')->group(static function (): void {
             Route::put('/users/{user}', [UserController::class, 'update'])->name('update');
             Route::post('/users/{user}/resend-email-verification', [UserController::class, 'resendEmailVerification'])->name('resend-email-verification');
             Route::delete('/users/{user}', [UserController::class, 'destroy'])->name('destroy');
+            Route::post('/users/{user}/reset-pending-email', [UserController::class, 'resetPendingEmail'])->name('reset-pending-email');
         });
 
         // Api token routes

tests/Feature/CreateOrganizationTest.php

@@ -34,10 +34,10 @@ class CreateOrganizationTest extends TestCase
         // Assert
         $response->assertStatus(302);
         /** @var Organization|null $newOrganization */
-        $ownedTeams = $user->fresh()->ownedTeams;
-        $this->assertCount(2, $ownedTeams);
-        $this->assertTrue($ownedTeams->contains('name', 'Test Organization'));
-        $newOrganization = $ownedTeams->firstWhere('name', 'Test Organization');
+        $ownedOrganizations = $user->fresh()->ownedOrganizations;
+        $this->assertCount(2, $ownedOrganizations);
+        $this->assertTrue($ownedOrganizations->contains('name', 'Test Organization'));
+        $newOrganization = $ownedOrganizations->firstWhere('name', 'Test Organization');
         /** @var Member $member */
         $member = Member::query()->whereBelongsTo($user, 'user')->whereBelongsTo($newOrganization, 'organization')->firstOrFail();
         $this->assertSame(Role::Owner->value, $member->role);

tests/Feature/DeleteOrganizationTest.php

@@ -36,15 +36,15 @@ class DeleteOrganizationTest extends TestCase
 
         // Assert
         $this->assertNull($organization->fresh());
-        $this->assertCount(1, $otherUser->fresh()->teams);
-        $this->assertFalse($otherUser->fresh()->teams->first()->is($organization));
+        $this->assertCount(1, $otherUser->fresh()->organizations);
+        $this->assertFalse($otherUser->fresh()->organizations->first()->is($organization));
     }
 
     public function test_personal_organizations_can_be_deleted_but_user_gets_an_new_one_if_this_is_the_only_one_left(): void
     {
         // Arrange
         $user = User::factory()->withPersonalOrganization()->create();
-        $organization = $user->currentTeam;
+        $organization = $user->currentOrganization;
         $this->actingAs($user);
 
         // Act
@@ -55,7 +55,7 @@ class DeleteOrganizationTest extends TestCase
         $this->assertDatabaseMissing(Organization::class, [
             'id' => $organization->getKey(),
         ]);
-        $this->assertTrue($user->currentTeam->isNot($organization));
+        $this->assertTrue($user->currentOrganization->isNot($organization));
     }
 
     public function test_organization_can_not_be_deleted_if_user_is_not_owner(): void

tests/Feature/InviteTeamMemberTest.php

@@ -24,7 +24,7 @@ class InviteTeamMemberTest extends TestCase
         $this->actingAs($user = User::factory()->withPersonalOrganization()->create());
 
         // Act
-        $response = $this->post('/teams/'.$user->currentTeam->id.'/members', [
+        $response = $this->post('/teams/'.$user->currentOrganization->id.'/members', [
             'email' => 'test@example.com',
             'role' => 'admin',
         ]);
@@ -42,7 +42,7 @@ class InviteTeamMemberTest extends TestCase
 
         $this->actingAs($user = User::factory()->withPersonalOrganization()->create());
 
-        $invitation = $user->currentTeam->teamInvitations()->create([
+        $invitation = $user->currentOrganization->organizationInvitations()->create([
             'email' => 'test@example.com',
             'role' => 'admin',
         ]);
@@ -52,7 +52,7 @@ class InviteTeamMemberTest extends TestCase
 
         // Assert
         $response->assertStatus(403);
-        $this->assertCount(1, $user->currentTeam->fresh()->teamInvitations);
+        $this->assertCount(1, $user->currentOrganization->fresh()->organizationInvitations);
     }
 
     public function test_team_member_invitations_can_be_accepted(): void
@@ -61,7 +61,7 @@ class InviteTeamMemberTest extends TestCase
         Mail::fake();
         $owner = User::factory()->withPersonalOrganization()->create();
         $user = User::factory()->withPersonalOrganization()->create();
-        $invitation = $owner->currentTeam->teamInvitations()->create([
+        $invitation = $owner->currentOrganization->organizationInvitations()->create([
             'email' => $user->email,
             'role' => Role::Employee->value,
         ]);
@@ -76,10 +76,10 @@ class InviteTeamMemberTest extends TestCase
         $response = $this->get($acceptUrl);
 
         // Assert
-        $this->assertCount(0, $owner->currentTeam->fresh()->teamInvitations);
+        $this->assertCount(0, $owner->currentOrganization->fresh()->organizationInvitations);
         $user->refresh();
         $this->assertCount(2, $user->organizations);
-        $this->assertContains($owner->currentTeam->getKey(), $user->organizations->pluck('id'));
+        $this->assertContains($owner->currentOrganization->getKey(), $user->organizations->pluck('id'));
     }
 
     public function test_team_member_invitations_of_placeholder_can_be_accepted_and_migrates_date_to_real_user(): void
@@ -88,15 +88,15 @@ class InviteTeamMemberTest extends TestCase
         Mail::fake();
         $placeholder = User::factory()->placeholder()->create();
         $owner = User::factory()->withPersonalOrganization()->create();
-        $placeholderMember = Member::factory()->role(Role::Placeholder)->forOrganization($owner->currentTeam)->forUser($placeholder)->create();
+        $placeholderMember = Member::factory()->role(Role::Placeholder)->forOrganization($owner->currentOrganization)->forUser($placeholder)->create();
 
-        $timeEntries = TimeEntry::factory()->forOrganization($owner->currentTeam)->forMember($placeholderMember)->createMany(5);
+        $timeEntries = TimeEntry::factory()->forOrganization($owner->currentOrganization)->forMember($placeholderMember)->createMany(5);
 
         $user = User::factory()->withPersonalOrganization()->create([
             'email' => $placeholder->email,
         ]);
 
-        $invitation = $owner->currentTeam->teamInvitations()->create([
+        $invitation = $owner->currentOrganization->organizationInvitations()->create([
             'email' => $user->email,
             'role' => Role::Employee->value,
         ]);
@@ -114,9 +114,9 @@ class InviteTeamMemberTest extends TestCase
         $response->assertRedirect();
         $user->refresh();
         $this->assertDatabaseMissing(User::class, ['id' => $placeholder->id]);
-        $this->assertCount(0, $owner->currentTeam->fresh()->teamInvitations);
+        $this->assertCount(0, $owner->currentOrganization->fresh()->organizationInvitations);
         $this->assertCount(2, $user->organizations);
-        $this->assertContains($owner->currentTeam->getKey(), $user->organizations->pluck('id'));
+        $this->assertContains($owner->currentOrganization->getKey(), $user->organizations->pluck('id'));
         $this->assertCount(5, $user->timeEntries);
     }
 
@@ -126,7 +126,7 @@ class InviteTeamMemberTest extends TestCase
         Mail::fake();
         $owner = User::factory()->withPersonalOrganization()->create();
         $user = User::factory()->withPersonalOrganization()->create();
-        $invitation = $owner->currentTeam->teamInvitations()->create([
+        $invitation = $owner->currentOrganization->organizationInvitations()->create([
             'email' => 'firstname.lastname@mail.test',
             'role' => Role::Employee->value,
         ]);
@@ -141,7 +141,7 @@ class InviteTeamMemberTest extends TestCase
         $response = $this->get($acceptUrl);
 
         // Assert
-        $this->assertCount(1, $owner->currentTeam->fresh()->teamInvitations);
+        $this->assertCount(1, $owner->currentOrganization->fresh()->organizationInvitations);
         $user->refresh();
         $this->assertCount(1, $user->organizations);
     }

tests/Feature/LeaveTeamTest.php

@@ -17,17 +17,17 @@ class LeaveTeamTest extends TestCase
         // Arrange
         $user = User::factory()->withPersonalOrganization()->create();
 
-        $user->currentTeam->users()->attach(
+        $user->currentOrganization->users()->attach(
             $otherUser = User::factory()->create(), ['role' => 'admin']
         );
 
         $this->actingAs($otherUser);
 
         // Act
-        $response = $this->delete('/teams/'.$user->currentTeam->id.'/members/'.$otherUser->id);
+        $response = $this->delete('/teams/'.$user->currentOrganization->id.'/members/'.$otherUser->id);
 
         // Assert
         $response->assertStatus(403);
-        $this->assertCount(2, $user->currentTeam->fresh()->users);
+        $this->assertCount(2, $user->currentOrganization->fresh()->users);
     }
 }

tests/Feature/RemoveTeamMemberTest.php

@@ -17,12 +17,12 @@ class RemoveTeamMemberTest extends TestCase
         // Arrange
         $this->actingAs($user = User::factory()->withPersonalOrganization()->create());
 
-        $user->currentTeam->users()->attach(
+        $user->currentOrganization->users()->attach(
             $otherUser = User::factory()->create(), ['role' => 'admin']
         );
 
         // Act
-        $response = $this->delete('/teams/'.$user->currentTeam->id.'/members/'.$otherUser->id);
+        $response = $this->delete('/teams/'.$user->currentOrganization->id.'/members/'.$otherUser->id);
 
         // Assert
         $response->assertStatus(403);

tests/Feature/UpdateTeamMemberRoleTest.php

@@ -19,12 +19,12 @@ class UpdateTeamMemberRoleTest extends TestCase
         $user = User::factory()->withPersonalOrganization()->create();
         $this->actingAs($user);
 
-        $user->currentTeam->users()->attach(
+        $user->currentOrganization->users()->attach(
             $otherUser = User::factory()->create(), ['role' => 'admin']
         );
 
         // Act
-        $response = $this->put('/teams/'.$user->currentTeam->id.'/members/'.$otherUser->id, [
+        $response = $this->put('/teams/'.$user->currentOrganization->id.'/members/'.$otherUser->id, [
             'role' => Role::Employee->value,
         ]);
 

tests/Feature/UpdateTeamTest.php

@@ -32,15 +32,15 @@ class UpdateTeamTest extends TestCase
         $this->actingAs($user);
 
         // Act
-        $response = $this->put('/teams/'.$user->currentTeam->id, [
+        $response = $this->put('/teams/'.$user->currentOrganization->id, [
             'name' => 'Test Organization',
             'currency' => 'USD',
         ]);
 
         // Assert
         $response->assertValid(errorBag: 'updateTeamName');
-        $this->assertCount(1, $user->fresh()->ownedTeams);
-        $organization = $user->currentTeam->fresh();
+        $this->assertCount(1, $user->fresh()->ownedOrganizations);
+        $organization = $user->currentOrganization->fresh();
         $this->assertEquals('Test Organization', $organization->name);
         $this->assertEquals('USD', $organization->currency);
     }

tests/Unit/Endpoint/Api/V1/UserEndpointTest.php

@@ -245,6 +245,67 @@ class UserEndpointTest extends ApiEndpointTestAbstract
         Mail::assertNotQueued(VerifyUpdatedEmailMail::class);
     }
 
+    public function test_reset_pending_email_clears_pending_email(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        $data->user->pending_email = 'new.email@example.com';
+        $data->user->save();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.users.reset-pending-email', $data->user->getKey()));
+
+        // Assert
+        $response->assertNoContent();
+        $this->assertNull($data->user->fresh()->pending_email);
+    }
+
+    public function test_reset_pending_email_fails_if_given_id_is_not_the_authenticated_user(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        $data->user->pending_email = 'new.email@example.com';
+        $data->user->save();
+        $otherData = $this->createUserWithPermission();
+        Passport::actingAs($otherData->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.users.reset-pending-email', $data->user->getKey()));
+
+        // Assert
+        $response->assertForbidden();
+        $this->assertSame('new.email@example.com', $data->user->fresh()->pending_email);
+    }
+
+    public function test_reset_pending_email_fails_when_not_authenticated(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        $data->user->pending_email = 'new.email@example.com';
+        $data->user->save();
+
+        // Act
+        $response = $this->postJson(route('api.v1.users.reset-pending-email', $data->user->getKey()));
+
+        // Assert
+        $response->assertUnauthorized();
+        $this->assertSame('new.email@example.com', $data->user->fresh()->pending_email);
+    }
+
+    public function test_reset_pending_email_fails_if_user_does_not_exist(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.users.reset-pending-email', 'not-valid'));
+
+        // Assert
+        $response->assertNotFound();
+    }
+
     public function test_update_changes_user_photo_from_base64_encoded_image(): void
     {
         // Arrange

tests/Unit/Filament/Resources/UserResourceTest.php

@@ -4,9 +4,11 @@ declare(strict_types=1);
 
 namespace Tests\Unit\Filament\Resources;
 
+use App\Enums\Role;
 use App\Exceptions\Api\CanNotDeleteUserWhoIsOwnerOfOrganizationWithMultipleMembers;
 use App\Filament\Resources\TimeEntryResource;
 use App\Filament\Resources\UserResource;
+use App\Models\Member;
 use App\Models\Organization;
 use App\Models\User;
 use App\Service\DeletionService;
@@ -103,7 +105,7 @@ class UserResourceTest extends FilamentTestCase
         $this->assertSame($userFake->email, $user->email);
         $this->assertSame($userFake->timezone, $user->timezone);
         $this->assertSame($userFake->week_start->value, $user->week_start->value);
-        $organization = $user->ownedTeams()->first();
+        $organization = $user->ownedOrganizations()->first();
         $this->assertNotNull($organization);
         $this->assertSame('EUR', $organization->currency);
         $this->assertTrue(Hash::check('password', $user->password));
@@ -152,7 +154,9 @@ class UserResourceTest extends FilamentTestCase
         // Arrange
         $user = User::factory()->create();
         $ownedOrganization = Organization::factory()->withOwner($user)->create();
+        Member::factory()->forOrganization($ownedOrganization)->forUser($user)->role(Role::Owner)->create();
         $organization = Organization::factory()->create();
+        Member::factory()->forOrganization($organization)->forUser($user)->role(Role::Employee)->create();
 
         // Act
         $response = Livewire::test(UserResource\RelationManagers\OrganizationsRelationManager::class, [
@@ -163,7 +167,7 @@ class UserResourceTest extends FilamentTestCase
         // Assert
         $response->assertSuccessful();
         $response->assertCanSeeTableRecords($user->organizations()->get());
-        $response->assertCanNotSeeTableRecords($user->ownedTeams()->get());
+        $response->assertCanSeeTableRecords($user->ownedOrganizations()->get());
     }
 
     public function test_can_list_related_owned_organizations(): void
@@ -171,7 +175,9 @@ class UserResourceTest extends FilamentTestCase
         // Arrange
         $user = User::factory()->create();
         $ownedOrganization = Organization::factory()->withOwner($user)->create();
+        Member::factory()->forOrganization($ownedOrganization)->forUser($user)->role(Role::Owner)->create();
         $organization = Organization::factory()->create();
+        Member::factory()->forOrganization($organization)->forUser($user)->role(Role::Employee)->create();
 
         // Act
         $response = Livewire::test(UserResource\RelationManagers\OwnedOrganizationsRelationManager::class, [
@@ -181,7 +187,7 @@ class UserResourceTest extends FilamentTestCase
 
         // Assert
         $response->assertSuccessful();
-        $response->assertCanSeeTableRecords($user->ownedTeams()->get());
-        $response->assertCanNotSeeTableRecords($user->organizations()->get());
+        $response->assertCanSeeTableRecords($user->ownedOrganizations()->get());
+        $response->assertCanNotSeeTableRecords([$organization]);
     }
 }

tests/Unit/Model/UserModelTest.php

@@ -62,6 +62,9 @@ class UserModelTest extends ModelTestAbstract
         $user->organizations()->attach($organization, [
             'role' => Role::Employee->value,
         ]);
+        $owner->organizations()->attach($organization, [
+            'role' => Role::Owner->value,
+        ]);
         $otherOrganization = Organization::factory()->create();
         $otherUser = User::factory()->create();
         $otherUser->organizations()->attach($otherOrganization, [
@@ -80,6 +83,70 @@ class UserModelTest extends ModelTestAbstract
         $this->assertContains($owner->getKey(), $userIds);
     }
 
+    public function test_is_member_of_organization_returns_true_for_user_attached_to_organization(): void
+    {
+        // Arrange
+        $organization = Organization::factory()->create();
+        $user = User::factory()->create();
+        $user->organizations()->attach($organization, [
+            'role' => Role::Employee->value,
+        ]);
+
+        // Act
+        $isMemberOfOrganization = $user->isMemberOfOrganization($organization);
+
+        // Assert
+        $this->assertTrue($isMemberOfOrganization);
+    }
+
+    public function test_is_member_of_organization_returns_false_for_user_not_attached_to_organization(): void
+    {
+        // Arrange
+        $organization = Organization::factory()->create();
+        $user = User::factory()->create();
+
+        // Act
+        $isMemberOfOrganization = $user->isMemberOfOrganization($organization);
+
+        // Assert
+        $this->assertFalse($isMemberOfOrganization);
+    }
+
+    public function test_is_member_of_organization_uses_loaded_organizations_relation(): void
+    {
+        // Arrange
+        $organization = Organization::factory()->create();
+        $user = User::factory()
+            ->attachToOrganization($organization, [
+                'role' => Role::Employee->value,
+            ])
+            ->create();
+        $user->load('organizations');
+
+        // Act
+        $isMemberOfOrganization = $user->isMemberOfOrganization($organization);
+
+        // Assert
+        $this->assertTrue($isMemberOfOrganization);
+    }
+
+    public function test_is_member_of_organization_does_not_query_when_organizations_relation_is_loaded(): void
+    {
+        // Arrange
+        $organization = Organization::factory()->create();
+        $user = User::factory()->create();
+        $user->load('organizations');
+        $user->organizations()->attach($organization, [
+            'role' => Role::Employee->value,
+        ]);
+
+        // Act
+        $isMemberOfOrganization = $user->isMemberOfOrganization($organization);
+
+        // Assert
+        $this->assertFalse($isMemberOfOrganization);
+    }
+
     public function test_it_has_many_time_entries(): void
     {
         // Arrange