anchor cross-day calendar e2e tests to Wednesday and Thursday

The tests used today and tomorrow (or yesterday) and skipped when those fell outside the visible week. The Saturday skips were also wrong for the Monday week start e2e users get, so the tests failed whenever CI ran on a Sunday. Using Wednesday and Thursday of the current week keeps both days visible whichever day the suite runs, so the day-of-week skips are gone.

.env.example

@@ -5,7 +5,8 @@ APP_KEY=base64:UNQNf1SXeASNkWux01Rj8EnHYx8FO0kAxWNDwktclkk=
 APP_DEBUG=true
 APP_URL=https://solidtime.test
 APP_FORCE_HTTPS=false
-APP_ENABLE_REGISTRATION=true
+# Supported values: on, off, invite-only (true/false are supported for backwards compatibility)
+APP_ENABLE_REGISTRATION=on
 SUPER_ADMINS=admin@example.com
 PAGINATION_PER_PAGE_DEFAULT=500
 

app/Actions/Fortify/CreateNewUser.php

@@ -4,9 +4,11 @@ declare(strict_types=1);
 
 namespace App\Actions\Fortify;
 
+use App\Enums\RegistrationMode;
 use App\Enums\Weekday;
 use App\Events\NewsletterRegistered;
 use App\Models\User;
+use App\Service\InvitationService;
 use App\Service\IpLookup\IpLookupServiceContract;
 use App\Service\TimezoneService;
 use App\Service\UserService;
@@ -31,13 +33,14 @@ class CreateNewUser implements CreatesNewUsers
      */
     public function create(array $input): User
     {
-        if (! config('app.enable_registration')) {
+        $registrationMode = RegistrationMode::fromConfig(config('app.enable_registration'));
+        if ($registrationMode === RegistrationMode::Off) {
             throw ValidationException::withMessages([
                 'email' => [__('Registration is disabled.')],
             ]);
         }
 
-        Validator::make($input, [
+        $validated = Validator::make($input, [
             'name' => [
                 'required',
                 'string',
@@ -60,6 +63,20 @@ class CreateNewUser implements CreatesNewUsers
             ],
         ])->validate();
 
+        if ($registrationMode === RegistrationMode::InviteOnly) {
+            $invitationService = app(InvitationService::class);
+            $email = (string) $validated['email'];
+            if (! $invitationService->hasAcceptedInvitationForEmail($email)) {
+                $message = $invitationService->hasPendingInvitationForEmail($email)
+                    ? __('Please accept the organization invitation sent to your email address before registering.')
+                    : __('Registration is only available to invited users.');
+
+                throw ValidationException::withMessages([
+                    'email' => [$message],
+                ]);
+            }
+        }
+
         $timezone = null;
         if (array_key_exists('timezone', $input) && is_string($input['timezone'])) {
             if (app(TimezoneService::class)->isValid($input['timezone'])) {

app/Auth/ActiveUserProvider.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Auth;
+
+use Illuminate\Auth\EloquentUserProvider;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * User provider that only resolves non-placeholder users.
+ *
+ * Placeholder users are created by imports and when members are removed from an
+ * organization. They can share an email address with a real user, so resolving a user by
+ * email can return a placeholder instead of the real account. The login flow filters them
+ * out explicitly, but the password broker and the guard credential checks (for example the
+ * password confirmation) resolve users through the configured user provider.
+ *
+ * Registered as the "eloquent" provider driver in the AuthServiceProvider, so it replaces the
+ * built-in one for every provider in config/auth.php.
+ */
+class ActiveUserProvider extends EloquentUserProvider
+{
+    /**
+     * @param  Model|null  $model
+     * @return Builder<Model>
+     */
+    #[\Override]
+    protected function newModelQuery($model = null): Builder
+    {
+        $query = parent::newModelQuery($model);
+        $query->getQuery()->where('is_placeholder', '=', false);
+
+        return $query;
+    }
+}

app/Enums/RegistrationMode.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+enum RegistrationMode: string
+{
+    case On = 'on';
+    case InviteOnly = 'invite-only';
+    case Off = 'off';
+
+    public static function fromConfig(mixed $value): self
+    {
+        if ($value === true) {
+            return self::On;
+        }
+
+        if ($value === false || $value === null) {
+            return self::Off;
+        }
+
+        return match (strtolower(trim((string) $value))) {
+            '1', 'on', 'true' => self::On,
+            'invite-only' => self::InviteOnly,
+            default => self::Off,
+        };
+    }
+}

app/Http/Controllers/Web/OrganizationInvitationController.php

@@ -36,6 +36,7 @@ class OrganizationInvitationController extends Controller
             }
 
             return redirect(route('register'))
+                ->with('registration_email', $email)
                 ->with('bannerText', __('Please create an account to finish joining the :organization organization.', [
                     'organization' => $organization->name,
                 ]))

app/Http/Requests/V1/Import/ImportRequest.php

@@ -24,6 +24,7 @@ class ImportRequest extends BaseFormRequest
             'data' => [
                 'required',
                 'string',
+                'max:'.config('import.max_data_size'),
             ],
         ];
     }

app/Models/User.php

@@ -38,7 +38,10 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @property string|null $pending_email
  * @property Carbon|null $email_verified_at
  * @property string|null $password
+ * @property string|null $remember_token
  * @property string|null $two_factor_secret
+ * @property string|null $two_factor_recovery_codes
+ * @property Carbon|null $two_factor_confirmed_at
  * @property string $timezone
  * @property bool $is_placeholder
  * @property Weekday $week_start
@@ -150,7 +153,9 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
 
     public function canAccessPanel(Panel $panel): bool
     {
-        return in_array($this->email, config('auth.super_admins', []), true) && $this->hasVerifiedEmail();
+        return $this->is_placeholder === false
+            && in_array($this->email, config('auth.super_admins', []), true)
+            && $this->hasVerifiedEmail();
     }
 
     public function isMemberOfOrganization(Organization $organization): bool

app/Providers/AuthServiceProvider.php

@@ -4,11 +4,14 @@ declare(strict_types=1);
 
 namespace App\Providers;
 
+use App\Auth\ActiveUserProvider;
 use App\Models\Passport\AuthCode;
 use App\Models\Passport\Client;
 use App\Models\Passport\RefreshToken;
 use App\Models\Passport\Token;
+use Illuminate\Contracts\Foundation\Application;
 use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
+use Illuminate\Support\Facades\Auth;
 use Laravel\Passport\Passport;
 
 class AuthServiceProvider extends ServiceProvider
@@ -26,6 +29,13 @@ class AuthServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
+        // Replaces the built-in eloquent user provider, so that no authentication flow can
+        // resolve a placeholder user. The driver name is kept, because Passport recognizes
+        // only providers that are configured with the driver "eloquent".
+        Auth::provider('eloquent', function (Application $app, array $config): ActiveUserProvider {
+            return new ActiveUserProvider($app->make('hash'), $config['model']);
+        });
+
         // define scopes for passport tokens
         Passport::tokensCan([
             'create' => 'Create resources',

app/Providers/FortifyServiceProvider.php

@@ -45,6 +45,7 @@ class FortifyServiceProvider extends ServiceProvider
 
         Fortify::registerView(function () {
             return Inertia::render('Auth/Register', [
+                'email' => session('registration_email', ''),
                 'terms_url' => config('auth.terms_url'),
                 'privacy_policy_url' => config('auth.privacy_policy_url'),
                 'newsletter_consent' => config('auth.newsletter_consent'),

app/Service/Import/ImportService.php

@@ -9,11 +9,8 @@ use App\Service\Import\Importers\ImporterContract;
 use App\Service\Import\Importers\ImporterProvider;
 use App\Service\Import\Importers\ImportException;
 use App\Service\Import\Importers\ReportDto;
-use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Storage;
-use Illuminate\Support\Str;
 
 class ImportService
 {
@@ -25,8 +22,6 @@ class ImportService
         /** @var ImporterContract $importer */
         $importer = app(ImporterProvider::class)->getImporter($importerType);
         $importer->init($organization);
-        Storage::disk(config('filesystems.default'))
-            ->put('import/'.Carbon::now()->toDateString().'-'.$organization->getKey().'-'.Str::uuid(), $data);
 
         $lock = Cache::lock('import:'.$organization->getKey(), config('octane.max_execution_time', 60) + 1);
 

app/Service/Import/Importers/SolidtimeImporter.php

@@ -16,7 +16,6 @@ use Illuminate\Support\Str;
 use League\Csv\Reader;
 use Override;
 use Spatie\TemporaryDirectory\TemporaryDirectory;
-use ZipArchive;
 
 class SolidtimeImporter extends DefaultImporter
 {
@@ -34,16 +33,10 @@ class SolidtimeImporter extends DefaultImporter
         $temporaryDirectoryZip = null;
         $temporaryDirectory = null;
         try {
-            $zip = new ZipArchive;
             $temporaryDirectoryZip = TemporaryDirectory::make();
             file_put_contents($temporaryDirectoryZip->path('import.zip'), $data);
-            $res = $zip->open($temporaryDirectoryZip->path('import.zip'), ZipArchive::RDONLY);
-            if ($res !== true) {
-                throw new ImportException('Invalid ZIP, error code: '.$res);
-            }
             $temporaryDirectory = TemporaryDirectory::make();
-            $zip->extractTo($temporaryDirectory->path());
-            $zip->close();
+            app(ZipImportHelper::class)->extract($temporaryDirectoryZip->path('import.zip'), $temporaryDirectory->path());
 
             if (! file_exists($temporaryDirectory->path('meta.json'))) {
                 throw new ImportException('File "meta.json" missing in ZIP');

app/Service/Import/Importers/TogglDataImporter.php

@@ -13,7 +13,6 @@ use Illuminate\Support\Str;
 use Override;
 use Spatie\TemporaryDirectory\TemporaryDirectory;
 use ValueError;
-use ZipArchive;
 
 class TogglDataImporter extends DefaultImporter
 {
@@ -26,16 +25,10 @@ class TogglDataImporter extends DefaultImporter
         $temporaryDirectoryZip = null;
         $temporaryDirectory = null;
         try {
-            $zip = new ZipArchive;
             $temporaryDirectoryZip = TemporaryDirectory::make();
             file_put_contents($temporaryDirectoryZip->path('import.zip'), $data);
-            $res = $zip->open($temporaryDirectoryZip->path('import.zip'), ZipArchive::RDONLY);
-            if ($res !== true) {
-                throw new ImportException('Invalid ZIP, error code: '.$res);
-            }
             $temporaryDirectory = TemporaryDirectory::make();
-            $zip->extractTo($temporaryDirectory->path());
-            $zip->close();
+            app(ZipImportHelper::class)->extract($temporaryDirectoryZip->path('import.zip'), $temporaryDirectory->path());
             if (! file_exists($temporaryDirectory->path('clients.json'))) {
                 throw new ImportException('File "clients.json" missing in ZIP');
             }

app/Service/Import/Importers/ZipImportHelper.php

@@ -0,0 +1,129 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Service\Import\Importers;
+
+use ZipArchive;
+
+/**
+ * Extracts uploaded ZIP archives with limits on file count, total uncompressed
+ * size and entry paths, so a small malicious archive can not fill the disk
+ * (decompression bomb) or write outside the target directory (zip slip).
+ */
+class ZipImportHelper
+{
+    private const int CHUNK_SIZE = 1024 * 1024;
+
+    /**
+     * @throws ImportException
+     */
+    public function extract(string $zipPath, string $targetPath): void
+    {
+        $zip = new ZipArchive;
+        $res = $zip->open($zipPath, ZipArchive::RDONLY);
+        if ($res !== true) {
+            throw new ImportException('Invalid ZIP, error code: '.$res);
+        }
+
+        try {
+            $maxFiles = (int) config('import.zip_max_files');
+            $maxUncompressedSize = (int) config('import.zip_max_uncompressed_size');
+
+            if ($zip->numFiles > $maxFiles) {
+                throw new ImportException('ZIP contains too many files, maximum is '.$maxFiles);
+            }
+
+            // Check the sizes declared in the archive before writing anything to disk
+            $declaredSize = 0;
+            for ($index = 0; $index < $zip->numFiles; $index++) {
+                $stat = $zip->statIndex($index);
+                if ($stat === false) {
+                    throw new ImportException('Invalid ZIP entry');
+                }
+                $this->validateEntryName($stat['name']);
+                $declaredSize += $stat['size'];
+                if ($declaredSize > $maxUncompressedSize) {
+                    throw new ImportException('ZIP uncompressed size exceeds the maximum of '.$maxUncompressedSize.' bytes');
+                }
+            }
+
+            // The declared sizes can be forged, so the written bytes are counted as well
+            $writtenSize = 0;
+            for ($index = 0; $index < $zip->numFiles; $index++) {
+                $stat = $zip->statIndex($index);
+                if ($stat === false) {
+                    throw new ImportException('Invalid ZIP entry');
+                }
+                $name = $stat['name'];
+                $entryPath = $targetPath.DIRECTORY_SEPARATOR.$name;
+
+                if (str_ends_with($name, '/')) {
+                    $this->ensureDirectoryExists($entryPath);
+
+                    continue;
+                }
+                $this->ensureDirectoryExists(dirname($entryPath));
+
+                $stream = $zip->getStreamIndex($index);
+                if ($stream === false) {
+                    throw new ImportException('ZIP entry "'.$name.'" can not be read');
+                }
+                $target = fopen($entryPath, 'wb');
+                if ($target === false) {
+                    fclose($stream);
+                    throw new ImportException('ZIP entry "'.$name.'" can not be extracted');
+                }
+                try {
+                    while (! feof($stream)) {
+                        $chunk = fread($stream, self::CHUNK_SIZE);
+                        if ($chunk === false) {
+                            throw new ImportException('ZIP entry "'.$name.'" can not be read');
+                        }
+                        $writtenSize += strlen($chunk);
+                        if ($writtenSize > $maxUncompressedSize) {
+                            throw new ImportException('ZIP uncompressed size exceeds the maximum of '.$maxUncompressedSize.' bytes');
+                        }
+                        fwrite($target, $chunk);
+                    }
+                } finally {
+                    fclose($target);
+                    fclose($stream);
+                }
+            }
+        } finally {
+            $zip->close();
+        }
+    }
+
+    /**
+     * @throws ImportException
+     */
+    private function validateEntryName(string $name): void
+    {
+        if ($name === '' || str_contains($name, "\0") || str_contains($name, '\\') || str_starts_with($name, '/')) {
+            throw new ImportException('ZIP contains an invalid file path: "'.$name.'"');
+        }
+        if (preg_match('/^[a-zA-Z]:/', $name) === 1) {
+            throw new ImportException('ZIP contains an invalid file path: "'.$name.'"');
+        }
+        foreach (explode('/', rtrim($name, '/')) as $segment) {
+            if ($segment === '' || $segment === '..') {
+                throw new ImportException('ZIP contains an invalid file path: "'.$name.'"');
+            }
+        }
+    }
+
+    /**
+     * @throws ImportException
+     */
+    private function ensureDirectoryExists(string $path): void
+    {
+        if (is_dir($path)) {
+            return;
+        }
+        if (! mkdir($path, 0700, true) && ! is_dir($path)) {
+            throw new ImportException('Directory "'.$path.'" can not be created');
+        }
+    }
+}

app/Service/InvitationService.php

@@ -18,6 +18,22 @@ use Illuminate\Support\Facades\Mail;
 
 class InvitationService
 {
+    public function hasAcceptedInvitationForEmail(string $email): bool
+    {
+        return OrganizationInvitation::query()
+            ->whereRaw('lower(email) = ?', [strtolower($email)])
+            ->whereNotNull('accepted_at')
+            ->exists();
+    }
+
+    public function hasPendingInvitationForEmail(string $email): bool
+    {
+        return OrganizationInvitation::query()
+            ->whereRaw('lower(email) = ?', [strtolower($email)])
+            ->whereNull('accepted_at')
+            ->exists();
+    }
+
     /**
      * @throws UserIsAlreadyMemberOfOrganizationApiException|InvitationForTheEmailAlreadyExistsApiException
      */

app/Service/MemberService.php

@@ -218,7 +218,16 @@ class MemberService
 
         $placeholderUser = $user->replicate();
         $placeholderUser->is_placeholder = true;
-        $placeholderUser->current_team_id = $member->organization_id;
+        // Reset authentication relevant properties on the placeholder user
+        $placeholderUser->password = null;
+        $placeholderUser->remember_token = null;
+        $placeholderUser->two_factor_secret = null;
+        $placeholderUser->two_factor_recovery_codes = null;
+        $placeholderUser->two_factor_confirmed_at = null;
+        $placeholderUser->email_verified_at = null;
+        $placeholderUser->pending_email = null;
+        $placeholderUser->current_team_id = null;
+        $placeholderUser->profile_photo_path = null;
         $placeholderUser->save();
 
         $member->user()->associate($placeholderUser);

config/app.php

@@ -100,7 +100,7 @@ return [
 
     'force_https' => (bool) env('APP_FORCE_HTTPS', false),
 
-    'enable_registration' => (bool) env('APP_ENABLE_REGISTRATION', false),
+    'enable_registration' => env('APP_ENABLE_REGISTRATION', 'off'),
 
     'local_email_verification' => (bool) env('APP_LOCAL_EMAIL_VERIFICATION', false),
 

config/import.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Import payload limit
+    |--------------------------------------------------------------------------
+    |
+    | Maximum length of the base64 encoded "data" field of an import request in
+    | bytes. Requests with a larger payload are rejected with a validation error.
+    |
+    */
+
+    'max_data_size' => (int) (env('IMPORT_MAX_DATA_SIZE') ?: 50 * 1024 * 1024),
+
+    /*
+    |--------------------------------------------------------------------------
+    | ZIP extraction limits
+    |--------------------------------------------------------------------------
+    |
+    | Limits applied to ZIP based importers before and during extraction to
+    | protect the instance against decompression bombs. The uncompressed size
+    | is the sum of all files in the archive in bytes.
+    |
+    */
+
+    'zip_max_files' => (int) (env('IMPORT_ZIP_MAX_FILES') ?: 100),
+
+    'zip_max_uncompressed_size' => (int) (env('IMPORT_ZIP_MAX_UNCOMPRESSED_SIZE') ?: 500 * 1024 * 1024),
+
+];

database/migrations/2026_09_16_000001_remove_credentials_from_placeholder_users.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Query\Builder;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    /**
+     * Placeholder users used to be created as a full copy of the user they were made from,
+     * which included the credentials and the account state of that user. A placeholder is a
+     * stand-in for a person in one organization, not an account, and the row shares the email
+     * address with the real account, so these values are removed from the placeholders that
+     * already exist. The organization a placeholder belongs to is recorded on its member row.
+     */
+    public function up(): void
+    {
+        DB::table('users')
+            ->where('is_placeholder', '=', true)
+            ->where(function (Builder $builder): void {
+                $builder->whereNotNull('password')
+                    ->orWhereNotNull('remember_token')
+                    ->orWhereNotNull('two_factor_secret')
+                    ->orWhereNotNull('two_factor_recovery_codes')
+                    ->orWhereNotNull('two_factor_confirmed_at')
+                    ->orWhereNotNull('email_verified_at')
+                    ->orWhereNotNull('pending_email')
+                    ->orWhereNotNull('current_team_id')
+                    ->orWhereNotNull('profile_photo_path');
+            })
+            ->update([
+                'password' => null,
+                'remember_token' => null,
+                'two_factor_secret' => null,
+                'two_factor_recovery_codes' => null,
+                'two_factor_confirmed_at' => null,
+                'email_verified_at' => null,
+                'pending_email' => null,
+                'current_team_id' => null,
+                'profile_photo_path' => null,
+            ]);
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        //
+    }
+};

e2e/calendar.spec.ts

@@ -53,6 +53,47 @@ function todayAt(hour: number, minute: number = 0): string {
     return d.toISOString().replace(/\.\d{3}Z$/, 'Z');
 }
 
+// Cross-day tests anchor to Wednesday and Thursday of the current week instead of today and
+// tomorrow. E2E users start the week on Monday, so both days are always in the visible week,
+// whichever day the suite runs on.
+function wednesdayAt(hour: number, minute: number = 0): Date {
+    const now = new Date();
+    const daysSinceMonday = (now.getDay() + 6) % 7;
+    return new Date(
+        now.getFullYear(),
+        now.getMonth(),
+        now.getDate() - daysSinceMonday + 2,
+        hour,
+        minute,
+        0,
+        0
+    );
+}
+
+function thursdayAt(hour: number, minute: number = 0): Date {
+    const d = wednesdayAt(hour, minute);
+    d.setDate(d.getDate() + 1);
+    return d;
+}
+
+function toApiTimestamp(date: Date): string {
+    return date.toISOString().replace(/\.\d{3}Z$/, 'Z');
+}
+
+// Local calendar date (YYYY-MM-DD), matching FullCalendar's data-date attributes
+function toDateStr(date: Date): string {
+    const month = String(date.getMonth() + 1).padStart(2, '0');
+    const day = String(date.getDate()).padStart(2, '0');
+    return `${date.getFullYear()}-${month}-${day}`;
+}
+
+async function columnHeaderCenterX(page: Page, date: Date): Promise<number> {
+    const header = page.locator(`.fc-col-header-cell[data-date="${toDateStr(date)}"]`);
+    await expect(header).toBeVisible();
+    const box = await header.boundingBox();
+    return box!.x + box!.width / 2;
+}
+
 /**
  * These tests verify that changing the project on a time entry via the calendar
  * updates the billable status to match the new project's is_billable setting.
@@ -962,14 +1003,9 @@ test.describe('Drag-to-Move Events', () => {
         page,
         ctx,
     }) => {
-        const now = new Date();
-        const dayOfWeek = now.getDay();
-        // Need today to have a previous day visible in the week view (skip Sunday with Monday week start)
-        test.skip(dayOfWeek === 1, 'Skipping on Monday — previous day not visible in week view');
-
-        // Create entry: today 00:30 → today 01:30 (1 hour, near midnight)
-        const start = todayAt(0, 30);
-        const end = todayAt(1, 30);
+        // Create entry: Thursday 00:30 → Thursday 01:30 (1 hour, near midnight)
+        const start = toApiTimestamp(thursdayAt(0, 30));
+        const end = toApiTimestamp(thursdayAt(1, 30));
         await createTimeEntryWithTimestampsViaApi(ctx, {
             description: 'Drag up past midnight test',
             start,
@@ -978,11 +1014,10 @@ test.describe('Drag-to-Move Events', () => {
         await goToCalendar(page);
         await scrollCalendarToTime(page, '00:00:00');
 
-        const todayStr = new Date(now.getFullYear(), now.getMonth(), now.getDate())
-            .toISOString()
-            .split('T')[0];
-        const todayCol = page.locator(`.fc-timegrid-col[data-date="${todayStr}"]`);
-        const event = todayCol
+        const thursdayCol = page.locator(
+            `.fc-timegrid-col[data-date="${toDateStr(thursdayAt(0))}"]`
+        );
+        const event = thursdayCol
             .locator('.fc-event')
             .filter({ hasText: 'Drag up past midnight test' });
         await expect(event).toBeVisible({ timeout: 10000 });
@@ -1018,10 +1053,7 @@ test.describe('Drag-to-Move Events', () => {
         expect(newDurationMs).toBe(3600000);
 
         // The event should have moved to the previous day
-        const yesterdayStr = new Date(now.getFullYear(), now.getMonth(), now.getDate() - 1)
-            .toISOString()
-            .split('T')[0];
-        expect(newStart.toISOString().split('T')[0]).toBe(yesterdayStr);
+        expect(toDateStr(newStart)).toBe(toDateStr(wednesdayAt(0)));
     });
 });
 
@@ -1261,8 +1293,8 @@ test.describe('Resize Events', () => {
     });
 
     test('resize bottom edge across day boundary changes end date', async ({ page, ctx }) => {
-        const start = todayAt(10);
-        const end = todayAt(11);
+        const start = toApiTimestamp(wednesdayAt(10));
+        const end = toApiTimestamp(wednesdayAt(11));
         await createTimeEntryWithTimestampsViaApi(ctx, {
             description: 'Cross resize end test',
             start,
@@ -1271,26 +1303,8 @@ test.describe('Resize Events', () => {
         await goToCalendar(page);
         await scrollCalendarToTime(page, '09:00:00');
 
-        // Find a column AFTER today (for end resize, end must be > start)
-        const headers = page.locator('.fc-col-header-cell');
-        const headerCount = await headers.count();
-        let targetX: number | undefined;
-        let todayIndex = -1;
-        for (let i = 0; i < headerCount; i++) {
-            const header = headers.nth(i);
-            const isToday = await header.evaluate((el) => el.classList.contains('fc-day-today'));
-            if (isToday) {
-                todayIndex = i;
-                break;
-            }
-        }
-        // Pick first column after today, or skip if today is last
-        for (let i = todayIndex + 1; i < headerCount; i++) {
-            const box = await headers.nth(i).boundingBox();
-            targetX = box!.x + box!.width / 2;
-            break;
-        }
-        test.skip(targetX === undefined, 'No column after today to resize to');
+        // Resize into Thursday's column (for end resize, end must be > start)
+        const targetX = await columnHeaderCenterX(page, thursdayAt(0));
 
         const event = page
             .locator('.fc-event')
@@ -1318,7 +1332,7 @@ test.describe('Resize Events', () => {
                 // First drag down vertically to engage resize (like test 3.1)
                 await page.mouse.move(centerX, bottomY + slotHeight * 4, { steps: 15 });
                 // Then move horizontally to a later day column
-                await page.mouse.move(targetX!, bottomY + slotHeight * 4, { steps: 10 });
+                await page.mouse.move(targetX, bottomY + slotHeight * 4, { steps: 10 });
                 await page.mouse.up();
             })(),
         ]);
@@ -1340,8 +1354,8 @@ test.describe('Resize Events', () => {
         page,
         ctx,
     }) => {
-        const start = todayAt(10);
-        const end = todayAt(14);
+        const start = toApiTimestamp(wednesdayAt(10));
+        const end = toApiTimestamp(wednesdayAt(14));
         await createTimeEntryWithTimestampsViaApi(ctx, {
             description: 'Cross resize end test',
             start,
@@ -1350,30 +1364,8 @@ test.describe('Resize Events', () => {
         await goToCalendar(page);
         await scrollCalendarToTime(page, '09:00:00');
 
-        // Find a non-today column header that is AFTER today (later day needed for end-edge resize)
-        const headers = page.locator('.fc-col-header-cell');
-        const headerCount = await headers.count();
-        let targetX: number | undefined;
-        let foundToday = false;
-        for (let i = 0; i < headerCount; i++) {
-            const header = headers.nth(i);
-            const isToday = await header.evaluate((el) => el.classList.contains('fc-day-today'));
-            if (isToday) {
-                foundToday = true;
-                continue;
-            }
-            if (foundToday) {
-                const box = await header.boundingBox();
-                targetX = box!.x + box!.width / 2;
-                break;
-            }
-        }
-        // If today is the last column, use the one before today instead won't work for end resize,
-        // so skip this test in that edge case
-        if (targetX === undefined) {
-            test.skip();
-            return;
-        }
+        // Resize into Thursday's column (later day needed for end-edge resize)
+        const targetX = await columnHeaderCenterX(page, thursdayAt(0));
 
         const event = page
             .locator('.fc-event')
@@ -1398,7 +1390,7 @@ test.describe('Resize Events', () => {
                 await page.waitForTimeout(100);
                 await page.mouse.down();
                 // Move to a different day column at same Y position
-                await page.mouse.move(targetX!, bottomY - 3, { steps: 15 });
+                await page.mouse.move(targetX, bottomY - 3, { steps: 15 });
                 await page.mouse.up();
             })(),
         ]);
@@ -1464,22 +1456,9 @@ test.describe('Resize Events', () => {
     });
 
     test('multi-day event end resize on last day works correctly', async ({ page, ctx }) => {
-        // Create entry spanning today evening → tomorrow morning
-        const start = todayAt(20);
-        const tomorrow = new Date();
-        tomorrow.setDate(tomorrow.getDate() + 1);
-        const tomorrowStr = `${tomorrow.getFullYear()}-${String(tomorrow.getMonth() + 1).padStart(2, '0')}-${String(tomorrow.getDate()).padStart(2, '0')}`;
-        const end = new Date(
-            tomorrow.getFullYear(),
-            tomorrow.getMonth(),
-            tomorrow.getDate(),
-            10,
-            0,
-            0,
-            0
-        )
-            .toISOString()
-            .replace(/\.\d{3}Z$/, 'Z');
+        // Create entry spanning Wednesday evening → Thursday morning
+        const start = toApiTimestamp(wednesdayAt(20));
+        const end = toApiTimestamp(thursdayAt(10));
 
         await createTimeEntryWithTimestampsViaApi(ctx, {
             description: 'Multi-day end resize',
@@ -1488,14 +1467,14 @@ test.describe('Resize Events', () => {
         });
         await goToCalendar(page);
 
-        // Check if tomorrow column is visible
-        const tomorrowCol = page.locator(`.fc-timegrid-col[data-date="${tomorrowStr}"]`);
-        test.skip((await tomorrowCol.count()) === 0, 'Tomorrow not visible in current view');
+        const thursdayCol = page.locator(
+            `.fc-timegrid-col[data-date="${toDateStr(thursdayAt(0))}"]`
+        );
 
         await scrollCalendarToTime(page, '09:00:00');
 
-        // Find the event segment on tomorrow's column
-        const event = tomorrowCol
+        // Find the event segment on Thursday's column
+        const event = thursdayCol
             .locator('.fc-event')
             .filter({ hasText: 'Multi-day end resize' })
             .first();
@@ -1541,22 +1520,9 @@ test.describe('Resize Events', () => {
         page,
         ctx,
     }) => {
-        // Create entry spanning today → tomorrow
-        const start = todayAt(10);
-        const tomorrow = new Date();
-        tomorrow.setDate(tomorrow.getDate() + 1);
-        const tomorrowStr = `${tomorrow.getFullYear()}-${String(tomorrow.getMonth() + 1).padStart(2, '0')}-${String(tomorrow.getDate()).padStart(2, '0')}`;
-        const end = new Date(
-            tomorrow.getFullYear(),
-            tomorrow.getMonth(),
-            tomorrow.getDate(),
-            14,
-            0,
-            0,
-            0
-        )
-            .toISOString()
-            .replace(/\.\d{3}Z$/, 'Z');
+        // Create entry spanning Wednesday → Thursday
+        const start = toApiTimestamp(wednesdayAt(10));
+        const end = toApiTimestamp(thursdayAt(14));
 
         await createTimeEntryWithTimestampsViaApi(ctx, {
             description: 'Backward end resize multi',
@@ -1565,29 +1531,16 @@ test.describe('Resize Events', () => {
         });
         await goToCalendar(page);
 
-        // Check if tomorrow column is visible
-        const tomorrowCol = page.locator(`.fc-timegrid-col[data-date="${tomorrowStr}"]`);
-        test.skip((await tomorrowCol.count()) === 0, 'Tomorrow not visible in current view');
+        const thursdayCol = page.locator(
+            `.fc-timegrid-col[data-date="${toDateStr(thursdayAt(0))}"]`
+        );
 
         await scrollCalendarToTime(page, '12:00:00');
 
-        // Find today's column header to get its X center
-        const headers = page.locator('.fc-col-header-cell');
-        const headerCount = await headers.count();
-        let todayX: number | undefined;
-        for (let i = 0; i < headerCount; i++) {
-            const header = headers.nth(i);
-            const isToday = await header.evaluate((el) => el.classList.contains('fc-day-today'));
-            if (isToday) {
-                const box = await header.boundingBox();
-                todayX = box!.x + box!.width / 2;
-                break;
-            }
-        }
-        test.skip(todayX === undefined, 'Could not find today column header');
+        const wednesdayX = await columnHeaderCenterX(page, wednesdayAt(0));
 
-        // Find event segment on tomorrow's column and resize end backward to today
-        const event = tomorrowCol
+        // Find event segment on Thursday's column and resize end backward to Wednesday
+        const event = thursdayCol
             .locator('.fc-event')
             .filter({ hasText: 'Backward end resize multi' })
             .first();
@@ -1609,9 +1562,9 @@ test.describe('Resize Events', () => {
                 await page.mouse.move(centerX, bottomY - 3);
                 await page.waitForTimeout(100);
                 await page.mouse.down();
-                // Drag down a bit first, then move to today's column at a Y after the start
+                // Drag down a bit first, then move to Wednesday's column at a Y after the start
                 await page.mouse.move(centerX, bottomY + slotHeight, { steps: 5 });
-                await page.mouse.move(todayX!, bottomY + slotHeight, { steps: 10 });
+                await page.mouse.move(wednesdayX, bottomY + slotHeight, { steps: 10 });
                 await page.mouse.up();
             })(),
         ]);
@@ -1627,8 +1580,8 @@ test.describe('Resize Events', () => {
     });
 
     test('resize end to earlier column prevents end before start', async ({ page, ctx }) => {
-        const start = todayAt(10);
-        const end = todayAt(14);
+        const start = toApiTimestamp(thursdayAt(10));
+        const end = toApiTimestamp(thursdayAt(14));
         await createTimeEntryWithTimestampsViaApi(ctx, {
             description: 'End before start test',
             start,
@@ -1637,25 +1590,8 @@ test.describe('Resize Events', () => {
         await goToCalendar(page);
         await scrollCalendarToTime(page, '09:00:00');
 
-        // Find a column BEFORE today
-        const headers = page.locator('.fc-col-header-cell');
-        const headerCount = await headers.count();
-        let targetX: number | undefined;
-        let todayIndex = -1;
-        for (let i = 0; i < headerCount; i++) {
-            const header = headers.nth(i);
-            const isToday = await header.evaluate((el) => el.classList.contains('fc-day-today'));
-            if (isToday) {
-                todayIndex = i;
-                break;
-            }
-        }
-        for (let i = todayIndex - 1; i >= 0; i--) {
-            const box = await headers.nth(i).boundingBox();
-            targetX = box!.x + box!.width / 2;
-            break;
-        }
-        test.skip(targetX === undefined, 'No column before today to test');
+        // Target Wednesday's column, the day before the entry
+        const targetX = await columnHeaderCenterX(page, wednesdayAt(0));
 
         const event = page
             .locator('.fc-event')
@@ -1683,7 +1619,7 @@ test.describe('Resize Events', () => {
         await page.waitForTimeout(100);
         await page.mouse.down();
         // Move to earlier column at a Y position near the top of the grid (before start time)
-        await page.mouse.move(targetX!, eventBox!.y - slotHeight * 4, { steps: 15 });
+        await page.mouse.move(targetX, eventBox!.y - slotHeight * 4, { steps: 15 });
         await page.mouse.up();
 
         // Wait for any potential API call
@@ -1732,30 +1668,21 @@ test.describe('Click-Drag Selection to Create', () => {
     test('drag-to-create spanning two days opens create modal with correct cross-day times', async ({
         page,
     }) => {
-        const now = new Date();
-        const dayOfWeek = now.getDay();
-        // Need today and tomorrow both visible (skip Saturday with Monday week start)
-        test.skip(dayOfWeek === 6, 'Skipping on Saturday — tomorrow not visible in week view');
-
         await goToCalendar(page);
         await expect(page.locator('.fc')).toBeVisible();
         // Use mid-day times so both start and end slots are visible in the viewport
         await scrollCalendarToTime(page, '10:00:00');
 
-        // Find today's and tomorrow's columns
-        const todayStr = new Date(now.getFullYear(), now.getMonth(), now.getDate())
-            .toISOString()
-            .split('T')[0];
-        const tomorrowStr = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1)
-            .toISOString()
-            .split('T')[0];
+        // Find Wednesday's and Thursday's columns
+        const wednesdayStr = toDateStr(wednesdayAt(0));
+        const thursdayStr = toDateStr(thursdayAt(0));
 
-        const todayCol = page.locator(`.fc-timegrid-col[data-date="${todayStr}"]`);
-        const tomorrowCol = page.locator(`.fc-timegrid-col[data-date="${tomorrowStr}"]`);
-        await expect(todayCol).toBeVisible();
-        await expect(tomorrowCol).toBeVisible();
+        const wednesdayCol = page.locator(`.fc-timegrid-col[data-date="${wednesdayStr}"]`);
+        const thursdayCol = page.locator(`.fc-timegrid-col[data-date="${thursdayStr}"]`);
+        await expect(wednesdayCol).toBeVisible();
+        await expect(thursdayCol).toBeVisible();
 
-        // Find the 11:00 slot (start) and 13:00 slot (end on tomorrow)
+        // Find the 11:00 slot (start) and 13:00 slot (end on Thursday)
         const startSlot = page.locator('.fc-timegrid-slot-lane[data-time="11:00:00"]').first();
         const endSlot = page.locator('.fc-timegrid-slot-lane[data-time="13:00:00"]').first();
         await expect(startSlot).toBeVisible();
@@ -1763,18 +1690,18 @@ test.describe('Click-Drag Selection to Create', () => {
 
         const startSlotBox = await startSlot.boundingBox();
         const endSlotBox = await endSlot.boundingBox();
-        const todayColBox = await todayCol.boundingBox();
-        const tomorrowColBox = await tomorrowCol.boundingBox();
+        const wednesdayColBox = await wednesdayCol.boundingBox();
+        const thursdayColBox = await thursdayCol.boundingBox();
 
-        // Start drag at 11:00 on today's column
-        const startX = todayColBox!.x + todayColBox!.width / 2;
+        // Start drag at 11:00 on Wednesday's column
+        const startX = wednesdayColBox!.x + wednesdayColBox!.width / 2;
         const startY = startSlotBox!.y + 2;
 
-        // End drag at 13:00 on tomorrow's column
-        const endX = tomorrowColBox!.x + tomorrowColBox!.width / 2;
+        // End drag at 13:00 on Thursday's column
+        const endX = thursdayColBox!.x + thursdayColBox!.width / 2;
         const endY = endSlotBox!.y + 2;
 
-        // Drag from today to tomorrow — move down first, then across
+        // Drag from Wednesday to Thursday, moving down first, then across
         const slotHeight = await getSlotHeight(page);
         await page.mouse.move(startX, startY);
         await page.mouse.down();
@@ -1792,9 +1719,9 @@ test.describe('Click-Drag Selection to Create', () => {
         await expect(dialog.getByText('Start')).toBeVisible();
         await expect(dialog.getByText('End')).toBeVisible();
 
-        // Start date should be today, end date should be tomorrow
-        await expect(dialog.getByText(todayStr)).toBeVisible();
-        await expect(dialog.getByText(tomorrowStr)).toBeVisible();
+        // Start date should be Wednesday, end date should be Thursday
+        await expect(dialog.getByText(wednesdayStr)).toBeVisible();
+        await expect(dialog.getByText(thursdayStr)).toBeVisible();
     });
 });
 
@@ -1876,17 +1803,9 @@ test.describe('Timezone & Localization', () => {
 
 test.describe('Multi-Day Events', () => {
     test('event spanning 2 days renders and is visible', async ({ page, ctx }) => {
-        // Create entry that spans from today 22:00 to tomorrow 02:00
-        const now = new Date();
-        const dayOfWeek = now.getDay();
-        // If today is Saturday (6), the entry would span to next week and may not be visible
-        test.skip(dayOfWeek === 6, 'Skipping on Saturday — multi-day would span to next week');
-
-        const startDate = new Date(now.getFullYear(), now.getMonth(), now.getDate(), 22, 0, 0);
-        const endDate = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1, 2, 0, 0);
-
-        const start = startDate.toISOString().replace(/\.\d{3}Z$/, 'Z');
-        const end = endDate.toISOString().replace(/\.\d{3}Z$/, 'Z');
+        // Create entry that spans from Wednesday 22:00 to Thursday 02:00
+        const start = toApiTimestamp(wednesdayAt(22));
+        const end = toApiTimestamp(thursdayAt(2));
 
         await createTimeEntryWithTimestampsViaApi(ctx, {
             description: 'Multi day entry',
@@ -1901,14 +1820,8 @@ test.describe('Multi-Day Events', () => {
     });
 
     test('multi-day event can be edited via click', async ({ page, ctx }) => {
-        const now = new Date();
-        test.skip(now.getDay() === 6, 'Skip on Saturday');
-
-        const startDate = new Date(now.getFullYear(), now.getMonth(), now.getDate(), 22, 0, 0);
-        const endDate = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1, 2, 0, 0);
-
-        const start = startDate.toISOString().replace(/\.\d{3}Z$/, 'Z');
-        const end = endDate.toISOString().replace(/\.\d{3}Z$/, 'Z');
+        const start = toApiTimestamp(wednesdayAt(22));
+        const end = toApiTimestamp(thursdayAt(2));
 
         await createTimeEntryWithTimestampsViaApi(ctx, {
             description: 'Multi day edit test',
@@ -1927,14 +1840,8 @@ test.describe('Multi-Day Events', () => {
     });
 
     test('multi-day event context menu works', async ({ page, ctx }) => {
-        const now = new Date();
-        test.skip(now.getDay() === 6, 'Skip on Saturday');
-
-        const startDate = new Date(now.getFullYear(), now.getMonth(), now.getDate(), 22, 0, 0);
-        const endDate = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1, 2, 0, 0);
-
-        const start = startDate.toISOString().replace(/\.\d{3}Z$/, 'Z');
-        const end = endDate.toISOString().replace(/\.\d{3}Z$/, 'Z');
+        const start = toApiTimestamp(wednesdayAt(22));
+        const end = toApiTimestamp(thursdayAt(2));
 
         await createTimeEntryWithTimestampsViaApi(ctx, {
             description: 'Multi day ctx test',
@@ -1954,16 +1861,11 @@ test.describe('Multi-Day Events', () => {
         page,
         ctx,
     }) => {
-        const now = new Date();
-        const dayOfWeek = now.getDay();
-        // Need today and tomorrow both visible (skip Saturday)
-        test.skip(dayOfWeek === 6, 'Skipping on Saturday — multi-day would span to next week');
-
-        // Create entry: today 22:00 → tomorrow 02:00 (4 hours, spanning 2 days)
-        const startDate = new Date(now.getFullYear(), now.getMonth(), now.getDate(), 22, 0, 0);
-        const endDate = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1, 2, 0, 0);
-        const start = startDate.toISOString().replace(/\.\d{3}Z$/, 'Z');
-        const end = endDate.toISOString().replace(/\.\d{3}Z$/, 'Z');
+        // Create entry: Wednesday 22:00 → Thursday 02:00 (4 hours, spanning 2 days)
+        const startDate = wednesdayAt(22);
+        const endDate = thursdayAt(2);
+        const start = toApiTimestamp(startDate);
+        const end = toApiTimestamp(endDate);
 
         await createTimeEntryWithTimestampsViaApi(ctx, {
             description: 'Multi day drag test',
@@ -1973,12 +1875,9 @@ test.describe('Multi-Day Events', () => {
         await goToCalendar(page);
         await scrollCalendarToTime(page, '00:00:00');
 
-        // Find the clipped segment on tomorrow's column (00:00-02:00)
-        const tomorrowStr = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1)
-            .toISOString()
-            .split('T')[0];
-        const tomorrowCol = page.locator(`.fc-timegrid-col[data-date="${tomorrowStr}"]`);
-        const event = tomorrowCol.locator('.fc-event').filter({ hasText: 'Multi day drag test' });
+        // Find the clipped segment on Thursday's column (00:00-02:00)
+        const thursdayCol = page.locator(`.fc-timegrid-col[data-date="${toDateStr(endDate)}"]`);
+        const event = thursdayCol.locator('.fc-event').filter({ hasText: 'Multi day drag test' });
         await expect(event).toBeVisible({ timeout: 10000 });
 
         const eventBox = await event.boundingBox();
@@ -2013,27 +1912,19 @@ test.describe('Multi-Day Events', () => {
         // Duration must be preserved (4 hours)
         expect(Math.abs(newDurationMs - origDurationMs)).toBeLessThan(60000);
 
-        // The start should still be on today (not jumped to tomorrow)
-        const todayStr = new Date(now.getFullYear(), now.getMonth(), now.getDate())
-            .toISOString()
-            .split('T')[0];
-        expect(newStart.toISOString().split('T')[0]).toBe(todayStr);
+        // The start should still be on Wednesday (not jumped to Thursday)
+        expect(toDateStr(newStart)).toBe(toDateStr(startDate));
     });
 
     test('dragging clipped segment of multi-day event upward shifts event earlier', async ({
         page,
         ctx,
     }) => {
-        const now = new Date();
-        const dayOfWeek = now.getDay();
-        // Need today and tomorrow both visible (skip Saturday)
-        test.skip(dayOfWeek === 6, 'Skipping on Saturday — multi-day would span to next week');
-
-        // Create entry: today 22:00 → tomorrow 02:00 (4 hours, spanning 2 days)
-        const startDate = new Date(now.getFullYear(), now.getMonth(), now.getDate(), 22, 0, 0);
-        const endDate = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1, 2, 0, 0);
-        const start = startDate.toISOString().replace(/\.\d{3}Z$/, 'Z');
-        const end = endDate.toISOString().replace(/\.\d{3}Z$/, 'Z');
+        // Create entry: Wednesday 22:00 → Thursday 02:00 (4 hours, spanning 2 days)
+        const startDate = wednesdayAt(22);
+        const endDate = thursdayAt(2);
+        const start = toApiTimestamp(startDate);
+        const end = toApiTimestamp(endDate);
 
         await createTimeEntryWithTimestampsViaApi(ctx, {
             description: 'Multi day drag up test',
@@ -2043,12 +1934,9 @@ test.describe('Multi-Day Events', () => {
         await goToCalendar(page);
         await scrollCalendarToTime(page, '00:00:00');
 
-        // Find the clipped segment on tomorrow's column (00:00-02:00)
-        const tomorrowStr = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1)
-            .toISOString()
-            .split('T')[0];
-        const tomorrowCol = page.locator(`.fc-timegrid-col[data-date="${tomorrowStr}"]`);
-        const event = tomorrowCol
+        // Find the clipped segment on Thursday's column (00:00-02:00)
+        const thursdayCol = page.locator(`.fc-timegrid-col[data-date="${toDateStr(endDate)}"]`);
+        const event = thursdayCol
             .locator('.fc-event')
             .filter({ hasText: 'Multi day drag up test' });
         await expect(event).toBeVisible({ timeout: 10000 });

e2e/invitation-registration-prefill.spec.ts

@@ -0,0 +1,32 @@
+import { expect, test } from '../playwright/fixtures';
+import { PLAYWRIGHT_BASE_URL } from '../playwright/config';
+import { getInvitationAcceptUrl } from './utils/mailpit';
+
+test('prefills the registration email after accepting an invitation', async ({ page, browser }) => {
+    const memberId = `${Date.now()}-${Math.floor(Math.random() * 100000)}`;
+    const memberEmail = `prefill-${memberId}@invitation.test`;
+
+    await page.goto(PLAYWRIGHT_BASE_URL + '/members');
+    await page.getByRole('button', { name: 'Invite Member' }).click();
+    await page.getByPlaceholder('Member Email').fill(memberEmail);
+    await page.getByRole('button', { name: 'Employee' }).click();
+    await Promise.all([
+        page.waitForResponse(
+            (response) =>
+                response.url().includes('/invitations') &&
+                response.request().method() === 'POST' &&
+                response.status() === 204
+        ),
+        page.getByRole('button', { name: 'Invite Member', exact: true }).click(),
+    ]);
+
+    const inviteeContext = await browser.newContext();
+    const inviteePage = await inviteeContext.newPage();
+    const acceptUrl = await getInvitationAcceptUrl(inviteePage.request, memberEmail);
+    await inviteePage.goto(acceptUrl);
+    await inviteePage.waitForURL(/\/register$/);
+
+    await expect(inviteePage.getByLabel('Email')).toHaveValue(memberEmail);
+
+    await inviteeContext.close();
+});

extensions/manifest.json

@@ -9,6 +9,6 @@
     },
     "Invoicing": {
         "repository": "solidtime-io/extension-invoicing",
-        "ref": "v0.0.4"
+        "ref": "v0.0.6"
     }
 }

package-lock.json

@@ -8564,7 +8564,7 @@
         },
         "resources/js/packages/ui": {
             "name": "@solidtime/ui",
-            "version": "0.0.22",
+            "version": "0.0.23",
             "license": "AGPL-3.0",
             "devDependencies": {
                 "@types/chroma-js": "^3.1.2",

resources/js/Components/Common/Client/ClientTable.vue

@@ -7,7 +7,7 @@ import { type Client } from '@/packages/api/src';
 import ClientTableRow from '@/Components/Common/Client/ClientTableRow.vue';
 import ClientCreateModal from '@/Components/Common/Client/ClientCreateModal.vue';
 import ClientTableHeading from '@/Components/Common/Client/ClientTableHeading.vue';
-import Pagination from '@/Components/Common/Pagination.vue';
+import Pagination from '@/packages/ui/src/Pagination.vue';
 import { canCreateClients } from '@/utils/permissions';
 import { useProjectsQuery } from '@/utils/useProjectsQuery';
 import {

resources/js/Components/Common/Project/ProjectTable.vue

@@ -6,17 +6,25 @@ import { computed, ref, watch } from 'vue';
 import ProjectCreateModal from '@/packages/ui/src/Project/ProjectCreateModal.vue';
 import ProjectTableHeading from '@/Components/Common/Project/ProjectTableHeading.vue';
 import ProjectTableRow from '@/Components/Common/Project/ProjectTableRow.vue';
-import Pagination from '@/Components/Common/Pagination.vue';
+import Pagination from '@/packages/ui/src/Pagination.vue';
 import LoadingSpinner from '@/packages/ui/src/LoadingSpinner.vue';
 
 export type SortColumn =
-    'name' | 'client_name' | 'spent_time' | 'progress' | 'billable_rate' | 'status' | 'visibility';
+    | 'name'
+    | 'tasks'
+    | 'client_name'
+    | 'spent_time'
+    | 'progress'
+    | 'billable_rate'
+    | 'status'
+    | 'visibility';
 export type { SortDirection } from '@/utils/useSortableTable';
 import { canCreateProjects } from '@/utils/permissions';
 import type { CreateProjectBody, Project, Client, CreateClientBody } from '@/packages/api/src';
 import { useProjectsStore } from '@/utils/useProjects';
 import { useClientsStore } from '@/utils/useClients';
 import { useClientsQuery } from '@/utils/useClientsQuery';
+import { useTasksQuery } from '@/utils/useTasksQuery';
 import { getOrganizationCurrencyString } from '@/utils/money';
 import { isAllowedToPerformPremiumAction } from '@/utils/billing';
 import { useOrganizationQuery } from '@/utils/useOrganizationQuery';
@@ -56,6 +64,16 @@ const clientNameMap = computed(() => {
     return map;
 });
 
+const { tasks } = useTasksQuery();
+
+const taskCountMap = computed(() => {
+    const map = new Map<string, number>();
+    tasks.value.forEach((task) => {
+        map.set(task.project_id, (map.get(task.project_id) ?? 0) + 1);
+    });
+    return map;
+});
+
 // Define column accessors for sorting.
 // Numeric columns use sortDescFirst so that the first click (chevron down) sorts highest-first,
 // while text columns default to ascending (A-Z) on first click (chevron down).
@@ -64,6 +82,11 @@ const columns = computed<SortableColumnDef<Project, SortColumn>[]>(() => [
         id: 'name',
         accessorFn: (row: Project) => row.name.toLowerCase(),
     },
+    {
+        id: 'tasks',
+        sortDescFirst: true,
+        accessorFn: (row: Project) => taskCountMap.value.get(row.id) ?? 0,
+    },
     {
         id: 'client_name',
         accessorFn: (row: Project) => {
@@ -161,7 +184,7 @@ async function createClient(client: CreateClientBody): Promise<Client | undefine
 }
 
 const gridTemplate = computed(() => {
-    return `grid-template-columns: minmax(300px, 1fr) minmax(150px, auto) minmax(140px, auto) minmax(130px, auto) ${props.showBillableRate ? 'minmax(130px, auto)' : ''} minmax(120px, auto) minmax(120px, auto) 80px;`;
+    return `grid-template-columns: minmax(300px, 1fr) minmax(100px, auto) minmax(150px, auto) minmax(140px, auto) minmax(130px, auto) ${props.showBillableRate ? 'minmax(130px, auto)' : ''} minmax(120px, auto) minmax(120px, auto) 80px;`;
 });
 </script>
 

resources/js/Components/Common/Project/ProjectTableHeading.vue

@@ -36,6 +36,9 @@ function handleSort(column: SortColumn) {
             @sort="handleSort">
             Name
         </SortableTableHeaderCell>
+        <SortableTableHeaderCell column="tasks" v-bind="sortState" @sort="handleSort">
+            Tasks
+        </SortableTableHeaderCell>
         <SortableTableHeaderCell column="client_name" v-bind="sortState" @sort="handleSort">
             Client
         </SortableTableHeaderCell>

resources/js/Components/Common/Project/ProjectTableRow.vue

@@ -88,17 +88,19 @@ const showEditProjectModal = ref(false);
         <ContextMenuTrigger as-child>
             <TableRow :href="route('projects.show', { project: project.id })">
                 <div
-                    class="whitespace-nowrap min-w-0 flex items-center space-x-5 py-4 pr-3 text-sm font-medium text-text-primary pl-2 sm:pl-4 lg:pl-6">
+                    class="whitespace-nowrap min-w-0 flex items-center space-x-3 py-4 pr-3 text-sm font-medium text-text-primary pl-2 sm:pl-4 lg:pl-6">
                     <div
-                        :style="{
-                            backgroundColor: project.color,
-                            boxShadow: `var(--tw-ring-inset) 0 0 0 calc(4px + var(--tw-ring-offset-width)) ${project.color}30`,
-                        }"
-                        class="w-3 h-3 ml-1 rounded-full"></div>
+                        :style="{ backgroundColor: project.color }"
+                        class="w-2.5 h-2.5 ml-1 rounded-full"></div>
                     <span class="overflow-ellipsis overflow-hidden">
                         {{ project.name }}
                     </span>
-                    <span class="text-text-secondary"> {{ projectTasksCount }} Tasks </span>
+                </div>
+                <div class="whitespace-nowrap px-3 py-4 text-sm text-text-primary">
+                    <span v-if="projectTasksCount">
+                        {{ projectTasksCount }} {{ projectTasksCount === 1 ? 'Task' : 'Tasks' }}
+                    </span>
+                    <span v-else class="text-text-tertiary">--</span>
                 </div>
                 <div class="whitespace-nowrap min-w-0 px-3 py-4 text-sm text-text-primary">
                     <div v-if="project.client_id" class="overflow-ellipsis overflow-hidden">

resources/js/Components/Dashboard/ActivityGraphCard.vue

@@ -63,7 +63,7 @@ const max = computed(() => {
 });
 
 const backgroundColor = useCssVariable('--theme-color-card-background');
-const borderColor = useCssVariable('--color-border');
+const borderColor = useCssVariable('--color-border-secondary');
 const labelColor = useCssVariable('--color-text-secondary');
 const chartColorRaw = useCssVariable('--theme-color-chart');
 

resources/js/Pages/Auth/Register.vue

@@ -8,9 +8,13 @@ import { Field, FieldLabel, FieldError } from '@/packages/ui/src/field';
 import PrimaryButton from '@/packages/ui/src/Buttons/PrimaryButton.vue';
 import TextInput from '@/packages/ui/src/Input/TextInput.vue';
 
+const props = defineProps<{
+    email: string;
+}>();
+
 const form = useForm({
     name: '',
-    email: '',
+    email: props.email,
     password: '',
     password_confirmation: '',
     terms: false,

resources/js/Pages/ReportingDetailed.vue

@@ -9,7 +9,7 @@ import {
     ArrowDownTrayIcon,
     LockClosedIcon,
 } from '@heroicons/vue/20/solid';
-import Pagination from '@/Components/Common/Pagination.vue';
+import Pagination from '@/packages/ui/src/Pagination.vue';
 import {
     DropdownMenu,
     DropdownMenuContent,

resources/js/packages/ui/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@solidtime/ui",
-    "version": "0.0.22",
+    "version": "0.0.23",
     "description": "Package containing the solidtime ui components",
     "main": "./dist/solidtime-ui-lib.umd.cjs",
     "module": "./dist/solidtime-ui-lib.js",

resources/js/packages/ui/src/CommandPalette/CommandPalette.vue

@@ -11,6 +11,7 @@ import {
     CommandShortcut,
 } from '../command';
 import { cn } from '../utils/cn';
+import { useDialogFocusRestore } from '../utils/useDialogFocusRestore';
 import type {
     CommandPaletteCommand,
     CommandPaletteGroup,
@@ -36,6 +37,8 @@ const emit = defineEmits<{
     select: [command: CommandPaletteCommand | EntitySearchResult];
 }>();
 
+const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
+
 // Non-empty groups for rendering
 const nonEmptyGroups = computed(() => props.groups.filter((g) => g.commands.length > 0));
 
@@ -71,7 +74,9 @@ watch(open, (isOpen) => {
                     )
                 ">
                 <DialogContent
-                    class="pointer-events-auto bg-default-background w-full max-w-lg border border-border-tertiary shadow-lg sm:rounded-lg outline-none overflow-hidden p-0 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95">
+                    class="pointer-events-auto bg-default-background w-full max-w-lg border border-border-tertiary shadow-lg sm:rounded-lg outline-none overflow-hidden p-0 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95"
+                    @open-auto-focus="onOpenAutoFocus"
+                    @close-auto-focus="onCloseAutoFocus">
                     <CommandRoot
                         v-model:search-term="searchTerm"
                         class="[&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:font-medium [&_[cmdk-group-heading]]:text-muted-foreground [&_[cmdk-group]:not([hidden])_~[cmdk-group]]:pt-0 [&_[cmdk-group]]:px-2 [&_[cmdk-input-wrapper]_svg]:h-5 [&_[cmdk-input-wrapper]_svg]:w-5 [&_[cmdk-input]]:h-12 [&_[cmdk-item]]:px-2 [&_[cmdk-item]]:py-3 [&_[cmdk-item]_svg]:h-5 [&_[cmdk-item]_svg]:w-5">

resources/js/packages/ui/src/Pagination.vue

@@ -16,8 +16,8 @@ import {
     ChevronRightIcon,
     EllipsisHorizontalIcon,
 } from '@heroicons/vue/20/solid';
-import { buttonVariants } from '@/packages/ui/src';
-import { cn } from '@/lib/utils';
+import { buttonVariants } from './Buttons/index';
+import { cn } from './utils/cn';
 import { computed, watch } from 'vue';
 
 const page = defineModel<number>('page', { default: 1 });

resources/js/packages/ui/src/dialog/DialogContent.vue

@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { cn } from '../utils/cn';
+import { useDialogFocusRestore } from '../utils/useDialogFocusRestore';
 import {
     DialogContent,
     type DialogContentEmits,
@@ -20,6 +21,10 @@ const delegatedProps = computed(() => {
 });
 
 const forwarded = useForwardPropsEmits(delegatedProps, emits);
+
+// Forwarded consumer listeners run first, so a consumer can still take over
+// by calling preventDefault() on close-auto-focus.
+const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
 </script>
 
 <template>
@@ -36,7 +41,9 @@ const forwarded = useForwardPropsEmits(delegatedProps, emits);
                             'my-3 md:my-14 xl:my-24 bg-default-background grid w-full max-w-lg border border-border-tertiary shadow-lg duration-200 rounded-lg outline-none data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95',
                             props.class
                         )
-                    ">
+                    "
+                    @open-auto-focus="onOpenAutoFocus"
+                    @close-auto-focus="onCloseAutoFocus">
                     <slot />
                 </DialogContent>
             </div>

resources/js/packages/ui/src/dialog/DialogScrollContent.vue

@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { cn } from '../utils/cn';
+import { useDialogFocusRestore } from '../utils/useDialogFocusRestore';
 import { X } from '@lucide/vue';
 import {
     DialogClose,
@@ -22,6 +23,10 @@ const delegatedProps = computed(() => {
 });
 
 const forwarded = useForwardPropsEmits(delegatedProps, emits);
+
+// Forwarded consumer listeners run first, so a consumer can still take over
+// by calling preventDefault() on close-auto-focus.
+const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
 </script>
 
 <template>
@@ -36,6 +41,8 @@ const forwarded = useForwardPropsEmits(delegatedProps, emits);
                     )
                 "
                 v-bind="forwarded"
+                @open-auto-focus="onOpenAutoFocus"
+                @close-auto-focus="onCloseAutoFocus"
                 @pointer-down-outside="
                     (event) => {
                         const originalEvent = event.detail.originalEvent;

resources/js/packages/ui/src/index.ts

@@ -32,6 +32,7 @@ import InputLabel from './Input/InputLabel.vue';
 import TextInput from './Input/TextInput.vue';
 import LoadingSpinner from './LoadingSpinner.vue';
 import Modal from './Modal.vue';
+import Pagination from './Pagination.vue';
 import ProjectBadge from './Project/ProjectBadge.vue';
 import TimeEntryCreateModal from './TimeEntry/TimeEntryCreateModal.vue';
 import TimeEntryEditModal from './TimeEntry/TimeEntryEditModal.vue';
@@ -257,6 +258,7 @@ export {
     NumberFieldDecrement,
     NumberFieldIncrement,
     NumberFieldInput,
+    Pagination,
     Popover,
     PopoverAnchor,
     PopoverContent,

resources/js/packages/ui/src/utils/useDialogFocusRestore.test.ts

@@ -0,0 +1,87 @@
+import { describe, expect, it, vi } from 'vitest';
+import { useDialogFocusRestore } from './useDialogFocusRestore';
+
+function closeEvent() {
+    return new CustomEvent('focusScope.autoFocusOnUnmount', { cancelable: true });
+}
+
+describe('useDialogFocusRestore', () => {
+    it('restores focus to the element focused when the dialog opened', () => {
+        vi.useFakeTimers();
+        const button = document.createElement('button');
+        document.body.appendChild(button);
+        button.focus();
+
+        const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
+        onOpenAutoFocus();
+        button.blur();
+
+        const event = closeEvent();
+        onCloseAutoFocus(event);
+        expect(event.defaultPrevented).toBe(true);
+        vi.runAllTimers();
+        expect(document.activeElement).toBe(button);
+
+        button.remove();
+        vi.useRealTimers();
+    });
+
+    it('focuses nothing when the dialog was opened with nothing focused', () => {
+        vi.useFakeTimers();
+        const stale = document.createElement('button');
+        document.body.appendChild(stale);
+        const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
+
+        // First open from the button, then close
+        stale.focus();
+        onOpenAutoFocus();
+        onCloseAutoFocus(closeEvent());
+        vi.runAllTimers();
+        stale.blur();
+
+        // Second open from the body must not refocus the stale button
+        onOpenAutoFocus();
+        const event = closeEvent();
+        onCloseAutoFocus(event);
+        expect(event.defaultPrevented).toBe(true);
+        vi.runAllTimers();
+        expect(document.activeElement).toBe(document.body);
+
+        stale.remove();
+        vi.useRealTimers();
+    });
+
+    it('does not restore focus to an element that was removed', () => {
+        vi.useFakeTimers();
+        const button = document.createElement('button');
+        document.body.appendChild(button);
+        button.focus();
+        const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
+        onOpenAutoFocus();
+        button.remove();
+
+        onCloseAutoFocus(closeEvent());
+        vi.runAllTimers();
+        expect(document.activeElement).toBe(document.body);
+        vi.useRealTimers();
+    });
+
+    it('leaves control to a consumer that already prevented the event', () => {
+        vi.useFakeTimers();
+        const button = document.createElement('button');
+        document.body.appendChild(button);
+        button.focus();
+        const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
+        onOpenAutoFocus();
+        button.blur();
+
+        const event = closeEvent();
+        event.preventDefault();
+        onCloseAutoFocus(event);
+        vi.runAllTimers();
+        expect(document.activeElement).toBe(document.body);
+
+        button.remove();
+        vi.useRealTimers();
+    });
+});

resources/js/packages/ui/src/utils/useDialogFocusRestore.ts

@@ -0,0 +1,41 @@
+/**
+ * Restores focus to the element that was focused when a dialog opened.
+ *
+ * reka-ui remembers the active element at content mount as the dialog's
+ * "trigger" (only when it is not the body) and refocuses it on every close,
+ * but it never clears that value. A dialog opened while nothing is focused
+ * (e.g. the command palette via Cmd+K from the body) therefore refocuses
+ * whatever triggered a *previous* open. Bind these handlers to
+ * `DialogContent`'s `open-auto-focus` / `close-auto-focus` events to restore
+ * exactly the previously focused element, or nothing.
+ *
+ * A consumer handler that already called `preventDefault()` on
+ * `close-auto-focus` keeps control; this composable then does nothing.
+ */
+export function useDialogFocusRestore() {
+    let previouslyFocused: HTMLElement | null = null;
+
+    function onOpenAutoFocus() {
+        const active = document.activeElement;
+        previouslyFocused =
+            active instanceof HTMLElement && active !== document.body ? active : null;
+    }
+
+    function onCloseAutoFocus(event: Event) {
+        const target = previouslyFocused;
+        previouslyFocused = null;
+        if (event.defaultPrevented) {
+            return;
+        }
+        // Prevents both FocusScope's default restore and reka-ui's trigger refocus
+        event.preventDefault();
+        // Same tick reka-ui uses, so the dialog content is fully gone first
+        setTimeout(() => {
+            if (target?.isConnected) {
+                target.focus({ preventScroll: true });
+            }
+        }, 0);
+    }
+
+    return { onOpenAutoFocus, onCloseAutoFocus };
+}

resources/js/utils/useCurrentTimeEntry.ts

@@ -1,5 +1,5 @@
 import { defineStore } from 'pinia';
-import { computed, ref } from 'vue';
+import { computed, ref, watch } from 'vue';
 import { api } from '@/packages/api/src';
 import type { TimeEntry } from '@/packages/api/src';
 import dayjs, { Dayjs } from 'dayjs';
@@ -57,7 +57,6 @@ export const useCurrentTimeEntryStore = defineStore('currentTimeEntry', () => {
     const currentTimeEntry = ref<TimeEntry>({ ...emptyTimeEntry });
     const { handleApiRequestNotifications } = useNotificationsStore();
     const queryClient = useQueryClient();
-
     useLocalStorage('solidtime/current-time-entry', currentTimeEntry, {
         deep: true,
     });
@@ -89,23 +88,12 @@ export const useCurrentTimeEntryStore = defineStore('currentTimeEntry', () => {
             try {
                 const timeEntriesResponse = await api.getMyActiveTimeEntry({});
                 if (timeEntriesResponse?.data) {
-                    if (timeEntriesResponse.data) {
-                        currentTimeEntry.value = timeEntriesResponse.data;
-                        if (
-                            currentTimeEntry.value.start !== '' &&
-                            currentTimeEntry.value.end === null
-                        ) {
-                            startLiveTimer();
-                        }
-                    } else {
-                        // No active time entry on server
-                        // Only reset if we had a previously started timer (has an ID)
-                        // Don't reset if user is preparing a new time entry (no ID yet)
-                        if (currentTimeEntry.value.id !== '') {
-                            currentTimeEntry.value = { ...emptyTimeEntry };
-                            stopLiveTimer();
-                        }
-                    }
+                    currentTimeEntry.value = timeEntriesResponse.data;
+                } else if (currentTimeEntry.value.id !== '') {
+                    // No active time entry on server
+                    // Only reset if we had a previously started timer (has an ID)
+                    // Don't reset if user is preparing a new time entry (no ID yet)
+                    currentTimeEntry.value = { ...emptyTimeEntry };
                 }
             } catch {
                 // API error (e.g., 404 when no active time entry)
@@ -113,7 +101,6 @@ export const useCurrentTimeEntryStore = defineStore('currentTimeEntry', () => {
                 // Don't reset if user is preparing a new time entry (no ID yet)
                 if (currentTimeEntry.value.id !== '') {
                     currentTimeEntry.value = { ...emptyTimeEntry };
-                    stopLiveTimer();
                 }
             }
         } else {
@@ -294,6 +281,18 @@ export const useCurrentTimeEntryStore = defineStore('currentTimeEntry', () => {
         return isActive.value && currentTimeEntry.value.type === 'break';
     });
 
+    watch(
+        isActive,
+        (active) => {
+            if (active) {
+                startLiveTimer();
+            } else {
+                stopLiveTimer();
+            }
+        },
+        { immediate: true }
+    );
+
     async function setActiveState(newState: boolean) {
         if (newState) {
             startLiveTimer();

tests/Feature/PasswordConfirmationTest.php

@@ -6,6 +6,7 @@ namespace Tests\Feature;
 
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
 use Tests\TestCase;
 
 class PasswordConfirmationTest extends TestCase
@@ -43,4 +44,43 @@ class PasswordConfirmationTest extends TestCase
 
         $response->assertSessionHasErrors();
     }
+
+    public function test_password_can_be_confirmed_if_a_placeholder_user_with_the_same_email_exists(): void
+    {
+        // Arrange
+        // Placeholders created by an import have no password at all. The placeholder is created
+        // first so that it would be returned by an unordered lookup by email.
+        $email = 'shared@example.com';
+        User::factory()->placeholder()->create(['email' => $email, 'password' => null]);
+        $user = User::factory()->create(['email' => $email, 'password' => Hash::make('secret-password')]);
+
+        // Act
+        $response = $this->actingAs($user)->post('/user/confirm-password', [
+            'password' => 'secret-password',
+        ]);
+
+        // Assert
+        $response->assertRedirect();
+        $response->assertSessionHasNoErrors();
+        $this->assertTrue($this->app['session']->has('auth.password_confirmed_at'));
+    }
+
+    public function test_password_confirmation_ignores_the_password_of_a_placeholder_user_with_the_same_email(): void
+    {
+        // Arrange
+        // Placeholders created by removing a member copy the password hash as of the removal,
+        // so the placeholder holds a password that the real user has since replaced.
+        $email = 'shared@example.com';
+        User::factory()->placeholder()->create(['email' => $email, 'password' => Hash::make('outdated-password')]);
+        $user = User::factory()->create(['email' => $email, 'password' => Hash::make('current-password')]);
+
+        // Act
+        $response = $this->actingAs($user)->post('/user/confirm-password', [
+            'password' => 'outdated-password',
+        ]);
+
+        // Assert
+        $response->assertSessionHasErrors();
+        $this->assertFalse($this->app['session']->has('auth.password_confirmed_at'));
+    }
 }

tests/Feature/PasswordResetTest.php

@@ -7,6 +7,7 @@ namespace Tests\Feature;
 use App\Models\User;
 use Illuminate\Auth\Notifications\ResetPassword;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Notification;
 use Laravel\Fortify\Features;
 use Tests\TestCase;
@@ -93,4 +94,62 @@ class PasswordResetTest extends TestCase
             return true;
         });
     }
+
+    public function test_password_reset_targets_the_real_user_when_a_placeholder_user_with_the_same_email_exists(): void
+    {
+
+        Notification::fake();
+
+        // The placeholder is created first so that it would be returned by an unordered lookup by email
+        $email = 'shared@example.com';
+        $placeholder = User::factory()->placeholder()->create(['email' => $email]);
+        $user = User::factory()->create(['email' => $email]);
+        $placeholderPasswordBefore = $placeholder->password;
+
+        $response = $this->post('/forgot-password', [
+            'email' => $email,
+        ]);
+
+        $response->assertSessionHasNoErrors();
+        Notification::assertNotSentTo($placeholder, ResetPassword::class);
+        Notification::assertSentTo($user, ResetPassword::class, function (ResetPassword $notification) use ($email) {
+            $response = $this->post('/reset-password', [
+                'token' => $notification->token,
+                'email' => $email,
+                'password' => 'new-password-123',
+                'password_confirmation' => 'new-password-123',
+            ]);
+
+            $response->assertSessionHasNoErrors();
+
+            return true;
+        });
+
+        $placeholder->refresh();
+        $user->refresh();
+        $this->assertSame($placeholderPasswordBefore, $placeholder->password);
+        $this->assertTrue(Hash::check('new-password-123', $user->password));
+
+        $response = $this->post('/login', [
+            'email' => $email,
+            'password' => 'new-password-123',
+        ]);
+
+        $response->assertSessionHasNoErrors();
+        $this->assertAuthenticatedAs($user);
+    }
+
+    public function test_password_reset_link_is_not_sent_if_only_a_placeholder_user_with_the_email_exists(): void
+    {
+        Notification::fake();
+
+        $placeholder = User::factory()->placeholder()->create();
+
+        $response = $this->post('/forgot-password', [
+            'email' => $placeholder->email,
+        ]);
+
+        $response->assertSessionHasErrors('email');
+        Notification::assertNothingSent();
+    }
 }

tests/Feature/RegistrationTest.php

@@ -22,6 +22,13 @@ use TiMacDonald\Log\LogEntry;
 
 class RegistrationTest extends TestCaseWithDatabase
 {
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Config::set('app.enable_registration', 'on');
+    }
+
     public function test_registration_screen_can_be_rendered(): void
     {
         if (! Features::enabled(Features::registration())) {
@@ -89,6 +96,77 @@ class RegistrationTest extends TestCaseWithDatabase
         Event::assertNotDispatched(NewsletterRegistered::class);
     }
 
+    public function test_user_registration_fails_without_an_invitation_if_registration_is_invite_only(): void
+    {
+        Config::set('app.enable_registration', 'invite-only');
+
+        $response = $this->post('/register', [
+            'name' => 'Test User',
+            'email' => 'test@example.com',
+            'password' => 'password',
+            'password_confirmation' => 'password',
+            'terms' => true,
+        ]);
+
+        $response->assertInvalid([
+            'email' => 'Registration is only available to invited users.',
+        ]);
+        $this->assertFalse(User::query()->where('email', 'test@example.com')->exists());
+    }
+
+    public function test_invited_user_can_register_if_registration_is_invite_only(): void
+    {
+        Config::set('app.enable_registration', 'invite-only');
+        $user = $this->createUserWithPermission();
+        OrganizationInvitation::factory()
+            ->forOrganization($user->organization)
+            ->role(Role::Employee)
+            ->accepted()
+            ->create([
+                'email' => 'Invited.User@example.com',
+            ]);
+
+        $response = $this->post('/register', [
+            'name' => 'Invited User',
+            'email' => 'invited.user@example.com',
+            'password' => 'password',
+            'password_confirmation' => 'password',
+            'terms' => true,
+        ]);
+
+        $response->assertValid();
+        $this->assertAuthenticated();
+        $response->assertRedirect(RouteServiceProvider::HOME);
+        $newUser = User::query()->where('email', 'invited.user@example.com')->firstOrFail();
+        $this->assertSame($user->organization->getKey(), $newUser->organizations()->firstOrFail()->getKey());
+    }
+
+    public function test_user_must_accept_pending_invitation_before_registration_if_registration_is_invite_only(): void
+    {
+        Config::set('app.enable_registration', 'invite-only');
+        $user = $this->createUserWithPermission();
+        OrganizationInvitation::factory()
+            ->forOrganization($user->organization)
+            ->role(Role::Employee)
+            ->create([
+                'email' => 'test@example.com',
+            ]);
+
+        $response = $this->post('/register', [
+            'name' => 'Test User',
+            'email' => 'test@example.com',
+            'password' => 'password',
+            'password_confirmation' => 'password',
+            'terms' => true,
+        ]);
+
+        $response->assertInvalid([
+            'email' => 'Please accept the organization invitation sent to your email address before registering.',
+        ]);
+        $this->assertGuest();
+        $this->assertFalse(User::query()->where('email', 'test@example.com')->exists());
+    }
+
     public function test_new_user_can_not_register_with_likely_invalid_domain(): void
     {
         // Act

tests/Unit/Auth/ActiveUserProviderTest.php

@@ -0,0 +1,90 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Auth;
+
+use App\Auth\ActiveUserProvider;
+use App\Models\User;
+use Illuminate\Support\Facades\Auth;
+use PHPUnit\Framework\Attributes\CoversClass;
+use Tests\TestCaseWithDatabase;
+
+#[CoversClass(ActiveUserProvider::class)]
+class ActiveUserProviderTest extends TestCaseWithDatabase
+{
+    public function test_password_broker_uses_the_active_user_provider(): void
+    {
+        // Act
+        $brokerProvider = Auth::createUserProvider(config('auth.passwords.users.provider'));
+
+        // Assert
+        $this->assertInstanceOf(ActiveUserProvider::class, $brokerProvider);
+    }
+
+    public function test_api_guard_uses_the_active_user_provider(): void
+    {
+        // Act
+        $guardProvider = Auth::createUserProvider(config('auth.guards.api.provider'));
+
+        // Assert
+        $this->assertInstanceOf(ActiveUserProvider::class, $guardProvider);
+    }
+
+    public function test_web_guard_uses_the_active_user_provider(): void
+    {
+        // Act
+        $guardProvider = Auth::createUserProvider(config('auth.guards.web.provider'));
+
+        // Assert
+        $this->assertInstanceOf(ActiveUserProvider::class, $guardProvider);
+    }
+
+    public function test_retrieve_by_credentials_ignores_placeholder_users_with_the_same_email(): void
+    {
+        // Arrange
+        $email = 'shared@example.com';
+        $placeholder = User::factory()->placeholder()->create(['email' => $email]);
+        $user = User::factory()->create(['email' => $email]);
+        $provider = Auth::createUserProvider('users');
+
+        // Act
+        $result = $provider->retrieveByCredentials(['email' => $email]);
+
+        // Assert
+        $this->assertInstanceOf(User::class, $result);
+        $this->assertTrue($user->is($result));
+        $this->assertFalse($placeholder->is($result));
+    }
+
+    public function test_retrieve_by_credentials_returns_null_if_only_a_placeholder_user_exists(): void
+    {
+        // Arrange
+        $email = 'placeholder-only@example.com';
+        User::factory()->placeholder()->create(['email' => $email]);
+        $provider = Auth::createUserProvider('users');
+
+        // Act
+        $result = $provider->retrieveByCredentials(['email' => $email]);
+
+        // Assert
+        $this->assertNull($result);
+    }
+
+    public function test_retrieve_by_id_returns_null_for_placeholder_users(): void
+    {
+        // Arrange
+        $placeholder = User::factory()->placeholder()->create();
+        $user = User::factory()->create();
+        $provider = Auth::createUserProvider('users');
+
+        // Act
+        $placeholderResult = $provider->retrieveById($placeholder->getKey());
+        $userResult = $provider->retrieveById($user->getKey());
+
+        // Assert
+        $this->assertNull($placeholderResult);
+        $this->assertInstanceOf(User::class, $userResult);
+        $this->assertTrue($user->is($userResult));
+    }
+}

tests/Unit/Endpoint/Api/V1/ImportEndpointTest.php

@@ -97,6 +97,29 @@ class ImportEndpointTest extends ApiEndpointTestAbstract
         ]);
     }
 
+    public function test_import_fails_if_data_exceeds_maximum_size(): void
+    {
+        // Arrange
+        config(['import.max_data_size' => 16]);
+        $user = $this->createUserWithPermission([
+            'import',
+        ]);
+        $this->mock(ImportService::class, function (MockInterface $mock): void {
+            $mock->shouldNotReceive('import');
+        });
+        Passport::actingAs($user->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.import.import', ['organization' => $user->organization->getKey()]), [
+            'type' => 'toggl_time_entries',
+            'data' => base64_encode(str_repeat('a', 15)),
+        ]);
+
+        // Assert
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors(['data']);
+    }
+
     public function test_import_return_error_message_if_import_fails(): void
     {
         // Arrange

tests/Unit/Endpoint/Web/OrganizationInvitationEndpointTest.php

@@ -38,6 +38,7 @@ class OrganizationInvitationEndpointTest extends EndpointTestAbstract
         $response->assertRedirect(route('register'));
         $response->assertSessionHas('bannerText', 'Please create an account to finish joining the '.$user->organization->name.' organization.');
         $response->assertSessionHas('bannerStyle', 'info');
+        $response->assertSessionHas('registration_email', strtolower($invitation->email));
         $invitation->refresh();
         $this->assertNotNull($invitation->accepted_at);
     }
@@ -64,6 +65,7 @@ class OrganizationInvitationEndpointTest extends EndpointTestAbstract
         $response->assertRedirect(route('register'));
         $response->assertSessionHas('bannerText', 'Please create an account to finish joining the '.$user->organization->name.' organization.');
         $response->assertSessionHas('bannerStyle', 'info');
+        $response->assertSessionHas('registration_email', strtolower($invitation->email));
         $invitation->refresh();
         $this->assertNotNull($invitation->accepted_at);
     }
@@ -103,6 +105,9 @@ class OrganizationInvitationEndpointTest extends EndpointTestAbstract
         $this->assertDatabaseMissing(OrganizationInvitation::class, [
             'id' => $invitation->getKey(),
         ]);
+        // Joining sets the organization as the current one for the user, independently of the
+        // placeholders that were merged into them
+        $this->assertSame($user->organization->getKey(), $user2->user->fresh()->current_team_id);
     }
 
     public function test_accepting_invitation_while_logged_out_redirects_to_login(): void

tests/Unit/Enums/RegistrationModeTest.php

@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Enums;
+
+use App\Enums\RegistrationMode;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+#[CoversClass(RegistrationMode::class)]
+class RegistrationModeTest extends TestCase
+{
+    /**
+     * @return array<string, array{mixed, RegistrationMode}>
+     */
+    public static function configValueProvider(): array
+    {
+        return [
+            'boolean true' => [true, RegistrationMode::On],
+            'on' => ['on', RegistrationMode::On],
+            'true' => ['true', RegistrationMode::On],
+            'invite-only' => ['invite-only', RegistrationMode::InviteOnly],
+            'boolean false' => [false, RegistrationMode::Off],
+            'off' => ['off', RegistrationMode::Off],
+            'false' => ['false', RegistrationMode::Off],
+            'unsupported invite alias' => ['invite', RegistrationMode::Off],
+            'unknown' => ['unknown', RegistrationMode::Off],
+        ];
+    }
+
+    #[DataProvider('configValueProvider')]
+    public function test_registration_mode_is_created_from_config_value(mixed $value, RegistrationMode $expected): void
+    {
+        $this->assertSame($expected, RegistrationMode::fromConfig($value));
+    }
+}

tests/Unit/Model/UserModelTest.php

@@ -53,6 +53,23 @@ class UserModelTest extends ModelTestAbstract
         $this->assertTrue($canAccess);
     }
 
+    public function test_placeholder_user_with_a_super_admin_email_can_not_access_admin_panel(): void
+    {
+        // Arrange
+        Config::set('auth.super_admins', ['some@email.test', 'other@email.test']);
+        $user = User::factory()->placeholder()->create([
+            'email' => 'some@email.test',
+        ]);
+        $panelProvider = new AdminPanelProvider(app());
+        $mainPanel = $panelProvider->panel(Panel::make());
+
+        // Act
+        $canAccess = $user->canAccessPanel($mainPanel);
+
+        // Assert
+        $this->assertFalse($canAccess);
+    }
+
     public function test_scope_belongs_to_organization_returns_only_users_of_organization_including_owners(): void
     {
         // Arrange

tests/Unit/Service/DeletionServiceTest.php

@@ -412,10 +412,11 @@ class DeletionServiceTest extends TestCaseWithDatabase
         $this->assertDatabaseHas(Organization::class, [
             'id' => $organizationOfA->getKey(),
         ]);
-        // The placeholder user should exist with current_team_id set to the org where they are a placeholder
+        // The placeholder user should exist and must not reference the deleted organization,
+        // which is what caused the foreign key violation in #989
         $placeholderUser = User::query()->where('is_placeholder', true)->first();
         $this->assertNotNull($placeholderUser);
-        $this->assertSame($organizationOfA->getKey(), $placeholderUser->current_team_id);
+        $this->assertNull($placeholderUser->current_team_id);
         $this->assertDatabaseHas(Member::class, [
             'id' => $memberBInOrgA->getKey(),
             'user_id' => $placeholderUser->getKey(),

tests/Unit/Service/Import/ImportServiceTest.php

@@ -41,6 +41,7 @@ class ImportServiceTest extends TestCase
         $this->assertSame(1, $report->usersCreated);
         $this->assertSame(2, $report->projectsCreated);
         $this->assertSame(1, $report->clientsCreated);
+        Storage::disk(config('filesystems.default'))->assertDirectoryEmpty('import');
     }
 
     public function test_import_releases_lock_if_an_exception_happens_during_the_import(): void

tests/Unit/Service/Import/Importers/SolidtimeImporterTest.php

@@ -42,6 +42,31 @@ class SolidtimeImporterTest extends ImporterTestAbstract
         $this->fail();
     }
 
+    public function test_import_throws_exception_if_zip_exceeds_uncompressed_size_limit(): void
+    {
+        // Arrange
+        config(['import.zip_max_uncompressed_size' => 10]);
+        $zipPath = $this->createTestZip('solidtime_import_test_1');
+        $timezone = 'Europe/Vienna';
+        $organization = Organization::factory()->create();
+        $importer = new SolidtimeImporter;
+        $importer->init($organization);
+        $data = file_get_contents($zipPath);
+
+        // Act
+        try {
+            $importer->importData($data, $timezone);
+        } catch (Exception $e) {
+            // Assert
+            $this->assertInstanceOf(ImportException::class, $e);
+            $this->assertSame('ZIP uncompressed size exceeds the maximum of 10 bytes', $e->getMessage());
+            $this->assertSame(0, $importer->getReport()->timeEntriesCreated);
+
+            return;
+        }
+        $this->fail();
+    }
+
     public function test_import_of_test_file_succeeds(): void
     {
         // Arrange

tests/Unit/Service/Import/Importers/TogglDataImporterTest.php

@@ -39,6 +39,31 @@ class TogglDataImporterTest extends ImporterTestAbstract
         $this->fail();
     }
 
+    public function test_import_throws_exception_if_zip_contains_too_many_files(): void
+    {
+        // Arrange
+        config(['import.zip_max_files' => 1]);
+        $zipPath = $this->createTestZip('toggl_data_import_test_1');
+        $timezone = 'Europe/Vienna';
+        $organization = Organization::factory()->create();
+        $importer = new TogglDataImporter;
+        $importer->init($organization);
+        $data = file_get_contents($zipPath);
+
+        // Act
+        try {
+            $importer->importData($data, $timezone);
+        } catch (Exception $e) {
+            // Assert
+            $this->assertInstanceOf(ImportException::class, $e);
+            $this->assertSame('ZIP contains too many files, maximum is 1', $e->getMessage());
+            $this->assertSame(0, $importer->getReport()->projectsCreated);
+
+            return;
+        }
+        $this->fail();
+    }
+
     public function test_import_of_test_file_succeeds(): void
     {
         // Arrange

tests/Unit/Service/Import/Importers/ZipImportHelperTest.php

@@ -0,0 +1,254 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Service\Import\Importers;
+
+use App\Service\Import\Importers\ImportException;
+use App\Service\Import\Importers\ZipImportHelper;
+use PHPUnit\Framework\Attributes\CoversClass;
+use Spatie\TemporaryDirectory\TemporaryDirectory;
+use Tests\TestCase;
+use ZipArchive;
+
+#[CoversClass(ZipImportHelper::class)]
+class ZipImportHelperTest extends TestCase
+{
+    private TemporaryDirectory $sourceDirectory;
+
+    private TemporaryDirectory $targetDirectory;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->sourceDirectory = TemporaryDirectory::make();
+        $this->targetDirectory = TemporaryDirectory::make();
+    }
+
+    protected function tearDown(): void
+    {
+        $this->sourceDirectory->delete();
+        $this->targetDirectory->delete();
+        parent::tearDown();
+    }
+
+    /**
+     * @param  array<string, string>  $files
+     */
+    private function createZip(array $files): string
+    {
+        $zipPath = $this->sourceDirectory->path('test.zip');
+        $zip = new ZipArchive;
+        $zip->open($zipPath, ZipArchive::CREATE);
+        foreach ($files as $name => $content) {
+            $zip->addFromString($name, $content);
+        }
+        $zip->close();
+
+        return $zipPath;
+    }
+
+    private function assertNothingExtracted(): void
+    {
+        $this->assertSame([], array_values(array_diff(scandir($this->targetDirectory->path()), ['.', '..'])));
+    }
+
+    public function test_extract_extracts_files_and_nested_directories(): void
+    {
+        // Arrange
+        $zipPath = $this->createZip([
+            'meta.json' => '{"version":"1.0"}',
+            'nested/dir/file.csv' => 'a,b',
+        ]);
+
+        // Act
+        app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
+
+        // Assert
+        $this->assertSame('{"version":"1.0"}', file_get_contents($this->targetDirectory->path('meta.json')));
+        $this->assertSame('a,b', file_get_contents($this->targetDirectory->path('nested/dir/file.csv')));
+    }
+
+    public function test_extract_throws_exception_if_file_is_not_a_zip(): void
+    {
+        // Arrange
+        $path = $this->sourceDirectory->path('not-a-zip.txt');
+        file_put_contents($path, 'not a zip');
+
+        // Act
+        try {
+            app(ZipImportHelper::class)->extract($path, $this->targetDirectory->path());
+        } catch (ImportException $e) {
+            // Assert
+            $this->assertSame('Invalid ZIP, error code: 19', $e->getMessage());
+            $this->assertNothingExtracted();
+
+            return;
+        }
+        $this->fail();
+    }
+
+    public function test_extract_throws_exception_if_zip_contains_too_many_files(): void
+    {
+        // Arrange
+        config(['import.zip_max_files' => 2]);
+        $zipPath = $this->createZip([
+            'a.txt' => 'a',
+            'b.txt' => 'b',
+            'c.txt' => 'c',
+        ]);
+
+        // Act
+        try {
+            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
+        } catch (ImportException $e) {
+            // Assert
+            $this->assertSame('ZIP contains too many files, maximum is 2', $e->getMessage());
+            $this->assertNothingExtracted();
+
+            return;
+        }
+        $this->fail();
+    }
+
+    public function test_extract_throws_exception_before_writing_if_declared_uncompressed_size_exceeds_limit(): void
+    {
+        // Arrange
+        config(['import.zip_max_uncompressed_size' => 100]);
+        $zipPath = $this->createZip([
+            'a.txt' => str_repeat('a', 60),
+            'b.txt' => str_repeat('b', 60),
+        ]);
+
+        // Act
+        try {
+            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
+        } catch (ImportException $e) {
+            // Assert
+            $this->assertSame('ZIP uncompressed size exceeds the maximum of 100 bytes', $e->getMessage());
+            $this->assertNothingExtracted();
+
+            return;
+        }
+        $this->fail();
+    }
+
+    public function test_extract_throws_exception_if_actual_uncompressed_size_exceeds_limit_despite_forged_headers(): void
+    {
+        // Arrange
+        config(['import.zip_max_uncompressed_size' => 1000]);
+        $zipPath = $this->createZip([
+            'bomb.bin' => str_repeat("\0", 100000),
+        ]);
+        // Forge the uncompressed size in the local file header (offset 22) and central directory header (offset 24)
+        $content = file_get_contents($zipPath);
+        $forgedSize = pack('V', 10);
+        $localHeaderOffset = strpos($content, "PK\x03\x04");
+        $centralHeaderOffset = strpos($content, "PK\x01\x02");
+        $this->assertNotFalse($localHeaderOffset);
+        $this->assertNotFalse($centralHeaderOffset);
+        $content = substr_replace($content, $forgedSize, $localHeaderOffset + 22, 4);
+        $content = substr_replace($content, $forgedSize, $centralHeaderOffset + 24, 4);
+        file_put_contents($zipPath, $content);
+        $zip = new ZipArchive;
+        $this->assertTrue($zip->open($zipPath, ZipArchive::RDONLY));
+        $this->assertSame(10, $zip->statIndex(0)['size']);
+        $zip->close();
+
+        // Act
+        try {
+            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
+        } catch (ImportException $e) {
+            // Assert
+            $this->assertSame('ZIP uncompressed size exceeds the maximum of 1000 bytes', $e->getMessage());
+            $extracted = $this->targetDirectory->path('bomb.bin');
+            if (file_exists($extracted)) {
+                $this->assertLessThanOrEqual(1000, filesize($extracted));
+            }
+
+            return;
+        }
+        $this->fail();
+    }
+
+    public function test_extract_throws_exception_if_zip_contains_path_traversal(): void
+    {
+        // Arrange
+        $zipPath = $this->createZip([
+            '../evil.txt' => 'evil',
+        ]);
+
+        // Act
+        try {
+            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
+        } catch (ImportException $e) {
+            // Assert
+            $this->assertSame('ZIP contains an invalid file path: "../evil.txt"', $e->getMessage());
+            $this->assertFileDoesNotExist(dirname($this->targetDirectory->path()).'/evil.txt');
+            $this->assertNothingExtracted();
+
+            return;
+        }
+        $this->fail();
+    }
+
+    public function test_extract_throws_exception_if_zip_contains_nested_path_traversal(): void
+    {
+        // Arrange
+        $zipPath = $this->createZip([
+            'sub/../../evil.txt' => 'evil',
+        ]);
+
+        // Act
+        try {
+            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
+        } catch (ImportException $e) {
+            // Assert
+            $this->assertSame('ZIP contains an invalid file path: "sub/../../evil.txt"', $e->getMessage());
+            $this->assertNothingExtracted();
+
+            return;
+        }
+        $this->fail();
+    }
+
+    public function test_extract_throws_exception_if_zip_contains_absolute_path(): void
+    {
+        // Arrange
+        $zipPath = $this->createZip([
+            '/tmp/evil.txt' => 'evil',
+        ]);
+
+        // Act
+        try {
+            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
+        } catch (ImportException $e) {
+            // Assert
+            $this->assertSame('ZIP contains an invalid file path: "/tmp/evil.txt"', $e->getMessage());
+            $this->assertNothingExtracted();
+
+            return;
+        }
+        $this->fail();
+    }
+
+    public function test_extract_throws_exception_if_zip_contains_backslash_path(): void
+    {
+        // Arrange
+        $zipPath = $this->createZip([
+            '..\\evil.txt' => 'evil',
+        ]);
+
+        // Act
+        try {
+            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
+        } catch (ImportException $e) {
+            // Assert
+            $this->assertSame('ZIP contains an invalid file path: "..\\evil.txt"', $e->getMessage());
+            $this->assertNothingExtracted();
+
+            return;
+        }
+        $this->fail();
+    }
+}

tests/Unit/Service/MemberServiceTest.php

@@ -13,6 +13,7 @@ use App\Models\TimeEntry;
 use App\Models\User;
 use App\Service\MemberService;
 use App\Service\UserService;
+use Illuminate\Support\Facades\Hash;
 use InvalidArgumentException;
 use PHPUnit\Framework\Attributes\CoversClass;
 use Tests\TestCaseWithDatabase;
@@ -64,6 +65,48 @@ class MemberServiceTest extends TestCaseWithDatabase
         $this->assertSame(Role::Admin->value, $oldOwnerMember->refresh()->role);
     }
 
+    public function test_make_member_to_placeholder_does_not_copy_the_credentials_and_account_state_of_the_user(): void
+    {
+        // Arrange
+        $user = User::factory()->create([
+            'password' => Hash::make('secret-password'),
+            'remember_token' => 'remember-me-token',
+            'two_factor_secret' => 'two-factor-secret',
+            'two_factor_recovery_codes' => 'two-factor-recovery-codes',
+            'two_factor_confirmed_at' => '2026-09-16 10:00:00',
+            'email_verified_at' => '2026-09-16 09:00:00',
+            'pending_email' => 'pending@example.com',
+            'profile_photo_path' => 'profile-photos/photo.png',
+        ]);
+        $organization = Organization::factory()->create();
+        $member = Member::factory()->forOrganization($organization)->forUser($user)->role(Role::Employee)->create();
+
+        // Act
+        $this->memberService->makeMemberToPlaceholder($member);
+
+        // Assert
+        $member->refresh();
+        $placeholderUser = $member->user;
+        $this->assertTrue($placeholderUser->is_placeholder);
+        $this->assertSame($user->email, $placeholderUser->email);
+        $this->assertNull($placeholderUser->password);
+        $this->assertNull($placeholderUser->remember_token);
+        $this->assertNull($placeholderUser->two_factor_secret);
+        $this->assertNull($placeholderUser->two_factor_recovery_codes);
+        $this->assertNull($placeholderUser->two_factor_confirmed_at);
+        $this->assertNull($placeholderUser->email_verified_at);
+        $this->assertNull($placeholderUser->pending_email);
+        $this->assertNull($placeholderUser->current_team_id);
+        $this->assertNull($placeholderUser->profile_photo_path);
+        // the user the placeholder was created from keeps their own credentials and state
+        $user->refresh();
+        $this->assertTrue(Hash::check('secret-password', (string) $user->password));
+        $this->assertSame('two-factor-secret', $user->two_factor_secret);
+        $this->assertNotNull($user->email_verified_at);
+        $this->assertSame('pending@example.com', $user->pending_email);
+        $this->assertSame('profile-photos/photo.png', $user->profile_photo_path);
+    }
+
     public function test_make_member_to_placeholder_creates_new_user_based_on_member_and_changes_member_to_placeholder(): void
     {
         // Arrange