fix diagnostics smoke test

.github/workflows/build-onpremise.yml

@@ -91,7 +91,7 @@ jobs:
         if: steps.cache-vendor.outputs.cache-hit != 'true' # Skip if cache hit
 
       - name: "Use Node.js"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '20.x'
 
@@ -177,7 +177,7 @@ jobs:
       - build
     steps:
       - name: "Download digests"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v4
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-*

.github/workflows/build-private.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: "Check out code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0 # Required for WyriHaximus/github-action-get-previous-tag
 
@@ -68,12 +68,12 @@ jobs:
         run: cat .env
 
       - name: "Use Node.js"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '20.x'
 
       - name: "Checkout billing extension"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
         with:
           repository: solidtime-io/extension-billing
           path: extensions/Billing
@@ -93,7 +93,7 @@ jobs:
         run: cd extensions/Billing && npm ci
 
       - name: "Checkout services extension"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
         with:
           repository: solidtime-io/extension-services
           path: extensions/Services
@@ -111,7 +111,7 @@ jobs:
         run: cd extensions/Services && npm ci
 
       - name: "Checkout invoicing extension"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
         with:
           repository: solidtime-io/extension-invoicing
           path: extensions/Invoicing

.github/workflows/build-public.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: "Check out code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0 # Required for WyriHaximus/github-action-get-previous-tag
 
@@ -92,7 +92,7 @@ jobs:
         if: steps.cache-vendor.outputs.cache-hit != 'true' # Skip if cache hit
 
       - name: "Use Node.js"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '20.x'
 
@@ -169,7 +169,7 @@ jobs:
       - build
     steps:
       - name: "Download digests"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v4
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-*

.github/workflows/generate-api-docs.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: "Setup PHP"
         uses: shivammathur/setup-php@v2

.github/workflows/image-smoke-test.yml

@@ -0,0 +1,258 @@
+name: Image Smoke Tests
+
+on:
+  pull_request:
+    paths:
+      - 'docker/prod/**'
+      - '.github/workflows/image-smoke-test.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  smoke:
+    name: Smoke (${{ matrix.mode }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        mode:
+          - default
+          - puid-pgid
+          - openshift
+          - drop-never
+          - diagnostic
+          - puid-mismatch-warning
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Copy .env template
+        run: |
+          cp .env.production .env
+          rm .env.production .env.ci .env.example
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: mbstring, dom, fileinfo, pgsql
+
+      - name: Composer install
+        run: composer install --no-dev --no-ansi --no-interaction --prefer-dist --ignore-platform-reqs --classmap-authoritative
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+
+      - name: NPM ci
+        run: npm ci
+
+      - name: NPM build
+        run: npm run build
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build smoke image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/prod/Dockerfile
+          build-args: |
+            DOCKER_FILES_BASE_PATH=docker/prod/
+          load: true
+          tags: solidtime-smoke:test
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: "Smoke: default (image config + fresh deploy with empty bind mounts)"
+        if: matrix.mode == 'default'
+        run: |
+          echo "[smoke] image's default USER is root (entrypoint needs root to drop privs)"
+          user=$(docker inspect --format '{{.Config.User}}' solidtime-smoke:test)
+          if [ "$user" != "root" ]; then
+            echo "Expected 'root', got '$user'. The Dockerfile must end with USER root so the entrypoint can chown/usermod and drop privileges."
+            exit 1
+          fi
+
+          echo "[smoke] storage tree is group-0 owned (OpenShift / arbitrary-UID compat)"
+          group=$(docker run --rm --entrypoint stat solidtime-smoke:test -c '%g' /var/www/html/storage)
+          if [ "$group" != "0" ]; then
+            echo "Expected group 0, got '$group'. The Dockerfile must chgrp -R 0 storage bootstrap/cache so arbitrary-UID containers can write."
+            exit 1
+          fi
+
+          mkdir -p test-storage test-cache
+          docker run --rm \
+            -v "$(pwd)/test-storage:/var/www/html/storage" \
+            -v "$(pwd)/test-cache:/var/www/html/bootstrap/cache" \
+            solidtime-smoke:test \
+            sh -c '
+              set -e
+              echo "[smoke] framework subdirs exist"
+              test -d /var/www/html/storage/framework/cache/data
+              test -d /var/www/html/storage/framework/sessions
+              test -d /var/www/html/storage/framework/views
+              test -d /var/www/html/storage/framework/testing
+              test -d /var/www/html/storage/logs
+              test -d /var/www/html/storage/app/public
+              test -d /var/www/html/storage/app/private
+              test -d /var/www/html/bootstrap/cache
+              echo "[smoke] storage is writable"
+              touch /var/www/html/storage/framework/cache/data/test-file
+              echo "[smoke] running as octane (UID 1000)"
+              [ "$(id -u)" = "1000" ]
+              echo "[smoke] PASS"
+            '
+
+      - name: "Smoke: PUID/PGID remap"
+        if: matrix.mode == 'puid-pgid'
+        run: |
+          mkdir -p test-storage test-cache
+          sudo chown -R 1501:1501 test-storage test-cache
+          docker run --rm \
+            -e PUID=1501 -e PGID=1501 \
+            -v "$(pwd)/test-storage:/var/www/html/storage" \
+            -v "$(pwd)/test-cache:/var/www/html/bootstrap/cache" \
+            solidtime-smoke:test \
+            sh -c '
+              set -e
+              echo "[smoke] running as remapped UID/GID 1501"
+              [ "$(id -u)" = "1501" ]
+              [ "$(id -g)" = "1501" ]
+              echo "[smoke] storage is writable as 1501"
+              touch /var/www/html/storage/framework/cache/data/test-file
+              echo "[smoke] PASS"
+            '
+
+      - name: "Smoke: OpenShift / arbitrary UID + group 0"
+        if: matrix.mode == 'openshift'
+        run: |
+          mkdir -p test-storage test-cache
+          sudo chown -R 2000:0 test-storage test-cache
+          sudo chmod -R g+rwX test-storage test-cache
+          docker run --rm --user 2000:0 \
+            -v "$(pwd)/test-storage:/var/www/html/storage" \
+            -v "$(pwd)/test-cache:/var/www/html/bootstrap/cache" \
+            solidtime-smoke:test \
+            sh -c '
+              set -e
+              echo "[smoke] running as arbitrary UID 2000, group 0"
+              [ "$(id -u)" = "2000" ]
+              [ "$(id -g)" = "0" ]
+              echo "[smoke] storage is writable via group 0"
+              touch /var/www/html/storage/framework/cache/data/test-file
+              echo "[smoke] PASS"
+            '
+
+      - name: "Smoke: SOLIDTIME_DROP_PRIVILEGES=never (run as root)"
+        if: matrix.mode == 'drop-never'
+        run: |
+          mkdir -p test-storage test-cache
+          docker run --rm \
+            -e SOLIDTIME_DROP_PRIVILEGES=never \
+            -v "$(pwd)/test-storage:/var/www/html/storage" \
+            -v "$(pwd)/test-cache:/var/www/html/bootstrap/cache" \
+            solidtime-smoke:test \
+            sh -c '
+              set -e
+              echo "[smoke] running as root (privilege drop disabled)"
+              [ "$(id -u)" = "0" ]
+              echo "[smoke] bootstrap still ran"
+              test -d /var/www/html/storage/framework/cache/data
+              echo "[smoke] storage writable as root"
+              touch /var/www/html/storage/framework/cache/data/test-file
+              echo "[smoke] PASS"
+            '
+
+      - name: "Smoke: PUID set + started non-root prints a warning but continues"
+        if: matrix.mode == 'puid-mismatch-warning'
+        run: |
+          mkdir -p test-storage test-cache
+          sudo chown -R 1500:1500 test-storage test-cache
+
+          set +e
+          docker run --rm \
+            --user 1500:1500 \
+            -e PUID=1500 -e PGID=1500 \
+            -v "$(pwd)/test-storage:/var/www/html/storage" \
+            -v "$(pwd)/test-cache:/var/www/html/bootstrap/cache" \
+            solidtime-smoke:test \
+            sh -c '
+              set -e
+              echo "[smoke] running as 1500 (user: directive wins)"
+              [ "$(id -u)" = "1500" ]
+              echo "[smoke] storage is writable as 1500"
+              touch /var/www/html/storage/framework/cache/data/test-file
+              echo "[smoke] container completed successfully"
+            ' \
+            >stdout.log 2>stderr.log
+          exit_code=$?
+          set -e
+
+          echo "[smoke] exit code: $exit_code"
+          echo "--- stderr ---"
+          cat stderr.log
+          echo "--- end stderr ---"
+
+          if [ "$exit_code" -ne 0 ]; then
+            echo "Expected the entrypoint to continue (warning is non-fatal)."
+            exit 1
+          fi
+
+          for needle in "PUID/PGID is set but the container started as UID" "remove any 'user:' directive" "Continuing as UID"; do
+            if ! grep -q "$needle" stderr.log; then
+              echo "Missing warning fragment: $needle"
+              exit 1
+            fi
+          done
+          echo "[smoke] PASS"
+
+      - name: "Smoke: diagnostic error path (read-only storage mount)"
+        if: matrix.mode == 'diagnostic'
+        run: |
+          # Pre-create the full storage tree on the host so the entrypoint's
+          # bootstrap_storage_tree() is a no-op (mkdir -p on existing dirs
+          # returns 0 even on a read-only mount). The write test then fires
+          # against the RO mount and triggers our diagnostic.
+          mkdir -p test-storage/framework/cache/data \
+                   test-storage/framework/sessions \
+                   test-storage/framework/views \
+                   test-storage/framework/testing \
+                   test-storage/logs \
+                   test-storage/app/public \
+                   test-storage/app/private \
+                   test-cache
+
+          set +e
+          docker run --rm \
+            -v "$(pwd)/test-storage:/var/www/html/storage:ro" \
+            -v "$(pwd)/test-cache:/var/www/html/bootstrap/cache:ro" \
+            solidtime-smoke:test \
+            true \
+            >stdout.log 2>stderr.log
+          exit_code=$?
+          set -e
+
+          echo "[smoke] exit code: $exit_code"
+          echo "--- stderr ---"
+          cat stderr.log
+          echo "--- end stderr ---"
+
+          if [ "$exit_code" -eq 0 ]; then
+            echo "Expected the entrypoint to exit non-zero on an unwritable storage mount."
+            exit 1
+          fi
+
+          for needle in "not writable" "PUID=" "permissions"; do
+            if ! grep -q "$needle" stderr.log; then
+              echo "Missing diagnostic fragment: $needle"
+              exit 1
+            fi
+          done
+          echo "[smoke] PASS"

.github/workflows/npm-build.yml

@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: "Setup PHP (for Ziggy)"
         uses: shivammathur/setup-php@v2
@@ -24,7 +24,7 @@ jobs:
         run: composer install -n --prefer-dist
 
       - name: "Use Node.js"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '20.x'
 

.github/workflows/npm-format-check.yml

@@ -9,10 +9,10 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: "Use Node.js"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '20.x'
 

.github/workflows/npm-lint.yml

@@ -11,10 +11,10 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: "Use Node.js"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '20.x'
 

.github/workflows/npm-publish-api.yml

@@ -11,11 +11,11 @@ jobs:
       id-token: write
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
       # Setup .npmrc file to publish to npm
       - name: Install root project dependencies
         run: npm ci
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v4
         with:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/npm-publish-ui.yml

@@ -11,9 +11,9 @@ jobs:
       id-token: write
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v4
         with:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/npm-typecheck.yml

@@ -10,7 +10,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: "Setup PHP (for Ziggy)"
         uses: shivammathur/setup-php@v2
@@ -23,7 +23,7 @@ jobs:
         run: composer install -n --prefer-dist
 
       - name: "Use Node.js"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '20.x'
 

.github/workflows/phpstan.yml

@@ -9,7 +9,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: "Setup PHP"
         uses: shivammathur/setup-php@v2

.github/workflows/phpunit.yml

@@ -36,7 +36,7 @@ jobs:
           --health-retries 5
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: "Setup PHP"
         uses: shivammathur/setup-php@v2
@@ -48,7 +48,7 @@ jobs:
       - name: "Run composer install"
         run: composer install -n --prefer-dist
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v4
         with:
           node-version: '20.x'
 
@@ -68,7 +68,7 @@ jobs:
         run: php artisan test --stop-on-failure --coverage-text --coverage-clover=coverage.xml
 
       - name: "Upload coverage reports to Codecov"
-        uses: codecov/codecov-action@v5.5.1
+        uses: codecov/codecov-action@v5.4.3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: solidtime-io/solidtime

.github/workflows/pint.yml

@@ -9,9 +9,9 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: "Check code style"
-        uses: aglipanci/laravel-pint-action@2.6
+        uses: aglipanci/laravel-pint-action@2.5
         with:
           configPath: "pint.json"

.github/workflows/playwright.yml

@@ -35,10 +35,10 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: "Setup node"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '20.x'
 

SECURITY.md

@@ -3,18 +3,3 @@
 ## Reporting a Vulnerability
 
 If you discover a security vulnerability regarding this project, please e-mail me to [security@solidtime.io](mailto:security@solidtime.io)!
-
-## Out of scope
-
-
-Reports we typically won't issue an advisory for:
-
-* Theoretical findings without a working PoC
-* Raw scanner output without manual validation
-* Missing/weak security headers in isolation (CSP, X-Frame-Options, HSTS, etc.)
-* SPF/DKIM/DMARC on non-mail-sending domains; missing DNSSEC/CAA; TLS cipher preferences
-* Self-XSS; CSRF on non-state-changing endpoints (logout, theme)
-* CSV / spreadsheet formula injection in exports — treated as a spreadsheet-application issue
-* Org owners or admins acting destructively within their own organization
-* Anything requiring direct DB, shell, or filesystem access on a self-hosted instance
-* Missing OAuth Scope enforcement (this is not implemented yet, but AI scanners flag it which is why it is included in this list until we actually support it)

app/Providers/JetstreamServiceProvider.php

@@ -304,8 +304,28 @@ class JetstreamServiceProvider extends ServiceProvider
                             'owner' => [
                                 'id' => $owner->getKey(),
                                 'name' => $owner->name,
+                                'email' => $owner->email,
                                 'profile_photo_url' => $owner->profile_photo_url,
                             ],
+                            'users' => $teamModel->users->map(function (User $user): array {
+                                return [
+                                    'id' => $user->getKey(),
+                                    'name' => $user->name,
+                                    'email' => $user->email,
+                                    'profile_photo_url' => $user->profile_photo_url,
+                                    'membership' => [
+                                        'id' => $user->membership->id,
+                                        'role' => $user->membership->role,
+                                    ],
+                                ];
+                            }),
+                            'team_invitations' => $teamModel->teamInvitations->map(function (OrganizationInvitation $invitation): array {
+                                return [
+                                    'id' => $invitation->getKey(),
+                                    'email' => $invitation->email,
+                                    'role' => $invitation->role,
+                                ];
+                            }),
                         ],
                         'currencies' => array_map(function (Currency $currency): string {
                             return $currency->getName();

docker/prod/Dockerfile

@@ -68,6 +68,7 @@ RUN apt-get update; \
     wget \
     vim \
     git \
+    gosu \
     ncdu \
     procps \
     unzip \
@@ -193,9 +194,20 @@ COPY --link --chown=${WWWUSER}:${WWWUSER} . .
 #COPY --link --chown=${WWWUSER}:${WWWUSER} --from=build ${ROOT}/public public
 
 RUN mkdir -p \
-    storage/framework/{sessions,views,cache,testing} \
+    storage/framework/{sessions,views,cache/data,testing} \
     storage/logs \
-    bootstrap/cache && chmod -R a+rw storage
+    storage/app/public \
+    storage/app/private \
+    bootstrap/cache && \
+    ln -s ../storage/app/public public/storage && \
+    chmod -R a+rw storage bootstrap/cache
+
+# OpenShift / arbitrary-UID compatibility: group 0 (root group) gets read+write+execute
+# on writable paths. Any UID can run the container if it joins the root group.
+# https://docs.openshift.com/container-platform/latest/openshift_images/create-images.html
+USER root
+RUN chgrp -R 0 storage bootstrap/cache && \
+    chmod -R g+rwX storage bootstrap/cache
 
 #RUN composer install \
 #    --classmap-authoritative \

docker/prod/deployment/octane/FrankenPHP/supervisord.frankenphp.conf

@@ -1,7 +1,6 @@
 [program:octane]
 process_name = %(program_name)s_%(process_num)s
 command = php %(ENV_ROOT)s/artisan octane:frankenphp --host=0.0.0.0 --port=8000 --admin-port=2019 --caddyfile=%(ENV_ROOT)s/docker/prod/deployment/octane/FrankenPHP/Caddyfile
-user = %(ENV_USER)s
 priority = 1
 autostart = true
 autorestart = true
@@ -14,7 +13,6 @@ stderr_logfile_maxbytes = 0
 [program:horizon]
 process_name = %(program_name)s_%(process_num)s
 command = php %(ENV_ROOT)s/artisan horizon
-user = %(ENV_USER)s
 priority = 3
 autostart = %(ENV_WITH_HORIZON)s
 autorestart = true
@@ -27,7 +25,6 @@ stopwaitsecs = 3600
 [program:scheduler]
 process_name = %(program_name)s_%(process_num)s
 command = supercronic -overlapping /etc/supercronic/laravel
-user = %(ENV_USER)s
 autostart = %(ENV_WITH_SCHEDULER)s
 autorestart = true
 stdout_logfile = %(ENV_ROOT)s/storage/logs/scheduler.log
@@ -38,7 +35,6 @@ stderr_logfile_maxbytes = 200MB
 [program:clear-scheduler-cache]
 process_name = %(program_name)s_%(process_num)s
 command = php %(ENV_ROOT)s/artisan schedule:clear-cache
-user = %(ENV_USER)s
 autostart = %(ENV_WITH_SCHEDULER)s
 autorestart = false
 startsecs = 0
@@ -51,7 +47,6 @@ stderr_logfile_maxbytes = 200MB
 [program:reverb]
 process_name = %(program_name)s_%(process_num)s
 command = php %(ENV_ROOT)s/artisan reverb:start
-user = %(ENV_USER)s
 priority = 2
 autostart = %(ENV_WITH_REVERB)s
 autorestart = true

docker/prod/deployment/start-container

@@ -1,6 +1,240 @@
-#!/usr/bin/env sh
+#!/bin/bash
 set -e
 
+# ============================================================================
+# Solidtime container entrypoint.
+#
+# Layout:
+#   1. Storage tree bootstrap (idempotent, runs as any user)
+#   2. UID/GID remap + chown (root only, controlled by PUID/PGID env vars)
+#   3. Pre-flight write test (fails fast with a diagnosis message)
+#   4. Privilege drop via gosu, then re-exec self as APP_USER
+#   5. Original CONTAINER_MODE routing (runs as APP_USER)
+#
+# Env vars:
+#   PUID, PGID                    UID/GID for the application user. Defaults 1000:1000.
+#                                 Only takes effect when the container starts as root
+#                                 (which is the image's default — if you set a
+#                                 `user:` directive in compose, PUID/PGID are ignored
+#                                 and a startup warning is printed).
+#   SOLIDTIME_DROP_PRIVILEGES     auto (default) | never
+#       auto:    if started as root, drop privileges to APP_USER; otherwise just exec.
+#       never:   never drop privileges. Run as whatever UID/GID was started.
+# ============================================================================
+
+APP_USER="octane"
+APP_PATH="${ROOT:-/var/www/html}"
+STORAGE_PATH="${APP_PATH}/storage"
+CACHE_PATH="${APP_PATH}/bootstrap/cache"
+DEFAULT_UID=1000
+DEFAULT_GID=1000
+TARGET_UID="${PUID:-${DEFAULT_UID}}"
+TARGET_GID="${PGID:-${DEFAULT_GID}}"
+DROP_PRIVS="${SOLIDTIME_DROP_PRIVILEGES:-auto}"
+WRITABLE_PATHS=(
+    "${STORAGE_PATH}/framework/cache/data"
+    "${STORAGE_PATH}/framework/sessions"
+    "${STORAGE_PATH}/framework/views"
+    "${STORAGE_PATH}/framework/testing"
+    "${STORAGE_PATH}/logs"
+    "${STORAGE_PATH}/app/public"
+    "${STORAGE_PATH}/app/private"
+    "${CACHE_PATH}"
+)
+
+case "${DROP_PRIVS}" in
+    never)  SHOULD_DROP=0 ;;
+    auto)
+        if [ "$(id -u)" = "0" ]; then
+            SHOULD_DROP=1
+        else
+            SHOULD_DROP=0
+        fi
+        ;;
+    *)
+        echo "[entrypoint] ERROR: invalid SOLIDTIME_DROP_PRIVILEGES='${DROP_PRIVS}'" >&2
+        echo "[entrypoint] Valid values: auto (default), never" >&2
+        exit 1
+        ;;
+esac
+
+# Warn if PUID/PGID are set but the container started non-root. PUID/PGID only
+# take effect during the drop-privileges flow, which requires starting as root.
+# A common cause is leaving `user:` in the compose file alongside PUID env vars.
+if { [ -n "${PUID}" ] || [ -n "${PGID}" ]; } \
+    && [ "$(id -u)" != "0" ] \
+    && [ "${SOLIDTIME_PRIVILEGES_DROPPED:-0}" != "1" ]; then
+    cat >&2 <<EOF
+[entrypoint] WARNING: PUID/PGID is set but the container started as UID $(id -u) (not root).
+[entrypoint] WARNING: PUID/PGID only apply when the entrypoint runs as root and drops privileges.
+[entrypoint] WARNING:
+[entrypoint] WARNING: To use PUID/PGID: remove any 'user:' directive from your compose file.
+[entrypoint] WARNING: To run as a fixed UID: remove PUID/PGID from your env.
+[entrypoint] WARNING:
+[entrypoint] WARNING: Continuing as UID $(id -u). See:
+[entrypoint] WARNING:   https://docs.solidtime.io/self-hosting/guides/permissions
+
+EOF
+fi
+
+bootstrap_storage_tree() {
+    mkdir -p "${WRITABLE_PATHS[@]}" 2>/dev/null || return 1
+}
+
+# Proactive warning when the existing storage directory is owned by a non-default
+# UID (typical on NAS systems where host users aren't UID 1000) and PUID/PGID
+# aren't set. Without this nudge, the chown step silently re-owns the files to
+# 1000:1000 and the user only discovers the mismatch later when host-side tools
+# (backup, file browser, rsync) show unfamiliar ownership.
+maybe_warn_ownership_mismatch() {
+    [ "${SHOULD_DROP}" = "1" ] || return 0
+    [ -n "${PUID}" ] && return 0
+    [ -n "${PGID}" ] && return 0
+    [ -d "${STORAGE_PATH}" ] || return 0
+
+    local owner_uid owner_gid
+    owner_uid="$(stat -c '%u' "${STORAGE_PATH}" 2>/dev/null)" || return 0
+    owner_gid="$(stat -c '%g' "${STORAGE_PATH}" 2>/dev/null)" || return 0
+
+    # Root-owned: probably freshly created by the entrypoint, will be chowned shortly.
+    [ "${owner_uid}" = "0" ] && return 0
+    # Already the target: nothing to warn about.
+    [ "${owner_uid}" = "${TARGET_UID}" ] && return 0
+
+    cat >&2 <<EOF
+[entrypoint] NOTE: ${STORAGE_PATH} is owned by UID ${owner_uid}:${owner_gid},
+[entrypoint]       but the container is starting as UID ${TARGET_UID}:${TARGET_GID}.
+[entrypoint]       Files will be chowned to ${TARGET_UID}:${TARGET_GID} and may
+[entrypoint]       appear with an unfamiliar owner on the host.
+[entrypoint]
+[entrypoint]       If you want the container to write as UID ${owner_uid} (common
+[entrypoint]       on Synology / TrueNAS / Unraid where host users aren't UID
+[entrypoint]       1000), set in your env and restart:
+[entrypoint]
+[entrypoint]           PUID=${owner_uid}
+[entrypoint]           PGID=${owner_gid}
+[entrypoint]
+[entrypoint]       More: https://docs.solidtime.io/self-hosting/guides/permissions
+
+EOF
+}
+
+print_write_test_failure() {
+    local owner
+    owner="$(stat -c '%u:%g' "${STORAGE_PATH}" 2>/dev/null || echo unknown)"
+    local runtime_uid
+    local runtime_gid
+    if [ "$(id -u)" = "0" ] && [ "${SHOULD_DROP}" = "1" ]; then
+        runtime_uid="${TARGET_UID}"
+        runtime_gid="${TARGET_GID}"
+    else
+        runtime_uid="$(id -u)"
+        runtime_gid="$(id -g)"
+    fi
+    local owner_uid
+    owner_uid="$(stat -c '%u' "${STORAGE_PATH}" 2>/dev/null || echo 1000)"
+    local owner_gid
+    owner_gid="$(stat -c '%g' "${STORAGE_PATH}" 2>/dev/null || echo 1000)"
+    cat >&2 <<EOF
+
+============================================================
+ERROR: Solidtime writable directories are not writable.
+
+Diagnosis:
+  Container will run as: UID ${runtime_uid}, GID ${runtime_gid}
+  Storage directory owner: ${owner}
+
+Likely cause: a bind-mounted host directory is owned by a different
+user than the container's application user.
+
+Fix on the host:
+
+    sudo chown -R ${runtime_uid}:${runtime_gid} <your-bind-mount-path>
+
+Or set PUID/PGID to match the host directory owner:
+
+    PUID=${owner_uid}
+    PGID=${owner_gid}
+
+To run intentionally as root, set:
+
+    SOLIDTIME_DROP_PRIVILEGES=never
+
+For more help: https://docs.solidtime.io/self-hosting/guides/permissions
+============================================================
+
+EOF
+}
+
+write_test_as_user() {
+    local user="$1"
+    local script='
+        set -e
+        for dir in "$@"; do
+            test_file="${dir}/.solidtime-write-test"
+            touch "${test_file}"
+            rm -f "${test_file}"
+        done
+    '
+    if [ -n "${user}" ]; then
+        gosu "${user}" sh -c "${script}" sh "${WRITABLE_PATHS[@]}" 2>/dev/null
+    else
+        sh -c "${script}" sh "${WRITABLE_PATHS[@]}" 2>/dev/null
+    fi
+}
+
+# ----------------------------------------------------------------------------
+# Root preamble: bootstrap, remap, chown, write-test, then drop and re-exec.
+# ----------------------------------------------------------------------------
+if [ "$(id -u)" = "0" ]; then
+    if ! bootstrap_storage_tree; then
+        echo "[entrypoint] ERROR: failed to create storage subdirectories at ${STORAGE_PATH}" >&2
+        exit 1
+    fi
+
+    if [ "${SHOULD_DROP}" = "1" ]; then
+        maybe_warn_ownership_mismatch
+        if [ "${TARGET_UID}" != "${DEFAULT_UID}" ] || [ "${TARGET_GID}" != "${DEFAULT_GID}" ]; then
+            echo "[entrypoint] Remapping ${APP_USER} to ${TARGET_UID}:${TARGET_GID}"
+            groupmod -o -g "${TARGET_GID}" "${APP_USER}"
+            usermod  -o -u "${TARGET_UID}" "${APP_USER}"
+        fi
+        # Idempotent chown: only fix entries whose owner or group is wrong.
+        # On large storage volumes (lots of user uploads) this is dramatically
+        # faster than a blanket `chown -R` every restart. Pattern borrowed from
+        # docker-library/postgres and linuxserver.io's baseimage.
+        find "${STORAGE_PATH}" "${CACHE_PATH}" \
+            \( ! -user "${TARGET_UID}" -o ! -group "${TARGET_GID}" \) \
+            -exec chown "${TARGET_UID}:${TARGET_GID}" {} + 2>/dev/null || true
+
+        if ! write_test_as_user "${APP_USER}"; then
+            print_write_test_failure
+            exit 1
+        fi
+
+        exec gosu "${APP_USER}" env SOLIDTIME_PRIVILEGES_DROPPED=1 "$0" "$@"
+    fi
+
+    if ! write_test_as_user ""; then
+        print_write_test_failure
+        exit 1
+    fi
+else
+    if ! bootstrap_storage_tree; then
+        echo "[entrypoint] WARNING: could not create some storage subdirectories at ${STORAGE_PATH} (will continue if existing tree is writable)" >&2
+    fi
+    if ! write_test_as_user ""; then
+        print_write_test_failure
+        exit 1
+    fi
+fi
+
+# ----------------------------------------------------------------------------
+# Application: runs as APP_USER (or whatever non-root UID was started).
+# ----------------------------------------------------------------------------
+
+unset SOLIDTIME_PRIVILEGES_DROPPED
+
 container_mode=${CONTAINER_MODE:-"http"}
 octane_server=${OCTANE_SERVER}
 auto_db_migrate=${AUTO_DB_MIGRATE:-false}
@@ -8,14 +242,16 @@ auto_db_migrate=${AUTO_DB_MIGRATE:-false}
 initialStuff() {
     echo "Container mode: $container_mode"
 
-    if [ ${auto_db_migrate} = "true" ]; then
+    if [ "${auto_db_migrate}" = "true" ]; then
         echo "Auto database migration enabled."
         php artisan migrate --isolated --force
     fi
 
-    php artisan storage:link; \
-    php artisan optimize:clear; \
-    php artisan optimize;
+    if [ ! -L "${APP_PATH}/public/storage" ]; then
+        php artisan storage:link
+    fi
+    php artisan optimize:clear
+    php artisan optimize
 }
 
 if [ "$1" != "" ]; then
@@ -23,11 +259,11 @@ if [ "$1" != "" ]; then
 elif [ "${container_mode}" = "http" ]; then
     initialStuff
     echo "Octane Server: $octane_server"
-    if [ "${octane_server}"  = "frankenphp" ]; then
+    if [ "${octane_server}" = "frankenphp" ]; then
         exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.frankenphp.conf
-    elif [ "${octane_server}"  = "swoole" ]; then
+    elif [ "${octane_server}" = "swoole" ]; then
         exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.swoole.conf
-    elif [ "${octane_server}"  = "roadrunner" ]; then
+    elif [ "${octane_server}" = "roadrunner" ]; then
         exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.roadrunner.conf
     else
         echo "Invalid Octane server supplied."

docker/prod/deployment/supervisord.conf

@@ -1,6 +1,5 @@
 [supervisord]
 nodaemon = true
-user = %(ENV_USER)s
 logfile = /var/log/supervisor/supervisord.log
 pidfile = /var/run/supervisord.pid
 

docker/prod/deployment/supervisord.horizon.conf

@@ -1,7 +1,6 @@
 [program:horizon]
 process_name = %(program_name)s_%(process_num)s
 command = php %(ENV_ROOT)s/artisan horizon
-user = %(ENV_USER)s
 autostart = true
 autorestart = true
 stdout_logfile = /dev/stdout

docker/prod/deployment/supervisord.reverb.conf

@@ -1,7 +1,6 @@
 [program:reverb]
 process_name = %(program_name)s_%(process_num)s
 command = php %(ENV_ROOT)s/artisan reverb:start
-user = %(ENV_USER)s
 autostart = true
 autorestart = true
 stdout_logfile = /dev/stdout

docker/prod/deployment/supervisord.scheduler.conf

@@ -1,7 +1,6 @@
 [program:scheduler]
 process_name = %(program_name)s_%(process_num)s
 command = supercronic -overlapping /etc/supercronic/laravel
-user = %(ENV_USER)s
 autostart = true
 autorestart = true
 stdout_logfile = /dev/stdout
@@ -12,7 +11,6 @@ stderr_logfile_maxbytes = 0
 [program:clear-scheduler-cache]
 process_name = %(program_name)s_%(process_num)s
 command = php %(ENV_ROOT)s/artisan schedule:clear-cache
-user = %(ENV_USER)s
 autostart = true
 autorestart = false
 startsecs = 0

docker/prod/deployment/supervisord.worker.conf

@@ -1,7 +1,6 @@
 [program:worker]
 process_name = %(program_name)s_%(process_num)s
 command = %(ENV_WORKER_COMMAND)s
-user = %(ENV_USER)s
 autostart = true
 autorestart = true
 stdout_logfile = /dev/stdout

e2e/projects.spec.ts

@@ -6,7 +6,6 @@ import { formatCentsWithOrganizationDefaults } from './utils/money';
 import {
     createProjectViaApi,
     createPublicProjectViaApi,
-    createProjectMemberViaApi,
     createTaskViaApi,
     createClientViaApi,
     createTimeEntryViaApi,
@@ -218,59 +217,6 @@ test('test that creating a non-billable project works', async ({ page }) => {
     await expect(page.getByTestId('project_table')).toContainText(newProjectName);
 });
 
-test('test that creating a public project via the modal works', async ({ page }) => {
-    const newProjectName = 'Public Project ' + Math.floor(1 + Math.random() * 10000);
-    await goToProjectsOverview(page);
-    await page.getByRole('button', { name: 'Create Project' }).click();
-    await page.getByLabel('Project Name').fill(newProjectName);
-
-    // Visibility defaults to Private — switch it to Public
-    await expect(page.getByRole('dialog').locator('#visibility')).toContainText('Private');
-    await page.getByRole('dialog').locator('#visibility').click();
-    await page.getByRole('option', { name: 'Public' }).click();
-
-    await Promise.all([
-        page.getByRole('button', { name: 'Create Project' }).click(),
-        page.waitForResponse(
-            async (response) =>
-                response.url().includes('/projects') &&
-                response.request().method() === 'POST' &&
-                response.status() === 201 &&
-                (await response.json()).data.is_public === true
-        ),
-    ]);
-
-    await expect(page.getByTestId('project_table')).toContainText(newProjectName);
-});
-
-test('test that changing a project to public via the edit modal works', async ({ page, ctx }) => {
-    const newProjectName = 'Edit Visibility Project ' + Math.floor(1 + Math.random() * 10000);
-    await createProjectViaApi(ctx, { name: newProjectName });
-
-    await goToProjectsOverview(page);
-    await expect(page.getByText(newProjectName)).toBeVisible({ timeout: 10000 });
-
-    const projectRow = page.getByRole('row').filter({ hasText: newProjectName }).first();
-    await projectRow.getByRole('button').click();
-    await page.locator(`[aria-label='Edit Project ${newProjectName}']`).click();
-
-    // Loaded as Private — switch it to Public
-    await expect(page.getByRole('dialog').locator('#visibility')).toContainText('Private');
-    await page.getByRole('dialog').locator('#visibility').click();
-    await page.getByRole('option', { name: 'Public' }).click();
-
-    await Promise.all([
-        page.getByRole('button', { name: 'Update Project' }).click(),
-        page.waitForResponse(
-            async (response) =>
-                response.url().includes('/projects/') &&
-                response.request().method() === 'PUT' &&
-                response.status() === 200 &&
-                (await response.json()).data.is_public === true
-        ),
-    ]);
-});
-
 test('test that switching from custom rate to default rate clears billable rate', async ({
     page,
     ctx,
@@ -979,39 +925,6 @@ test.describe('Employee Projects Restrictions', () => {
             employee.page.locator(`[aria-label='Delete Project ${projectName}']`)
         ).not.toBeVisible();
     });
-
-    test('employee does not see private projects they are not a member of', async ({
-        ctx,
-        employee,
-    }) => {
-        const publicName = 'EmpPublicVisible ' + Math.floor(Math.random() * 10000);
-        const privateName = 'EmpPrivateHidden ' + Math.floor(Math.random() * 10000);
-        await createPublicProjectViaApi(ctx, { name: publicName });
-        // createProjectViaApi defaults to is_public: false (private); the employee is not a member
-        await createProjectViaApi(ctx, { name: privateName });
-
-        await employee.page.goto(PLAYWRIGHT_BASE_URL + '/projects');
-        await expect(employee.page.getByTestId('projects_view')).toBeVisible({ timeout: 10000 });
-
-        // The public project is visible — confirms the list has loaded
-        await expect(employee.page.getByText(publicName)).toBeVisible({ timeout: 10000 });
-
-        // The private project the employee is not a member of must not appear
-        await expect(employee.page.getByText(privateName)).not.toBeVisible();
-    });
-
-    test('employee can see a private project they are a member of', async ({ ctx, employee }) => {
-        const projectName = 'EmpPrivateMember ' + Math.floor(Math.random() * 10000);
-        const project = await createProjectViaApi(ctx, { name: projectName });
-        // Add the employee as a project member so the private project becomes visible to them
-        await createProjectMemberViaApi(ctx, project.id, { member_id: employee.memberId });
-
-        await employee.page.goto(PLAYWRIGHT_BASE_URL + '/projects');
-        await expect(employee.page.getByTestId('projects_view')).toBeVisible({ timeout: 10000 });
-
-        // The private project is visible because the employee is a member
-        await expect(employee.page.getByText(projectName)).toBeVisible({ timeout: 10000 });
-    });
 });
 
 test.describe('Employee Billable Rate Visibility', () => {

resources/js/Components/Common/Project/ProjectEditModal.vue

@@ -19,7 +19,6 @@ import { Field, FieldGroup, FieldLabel } from '@/packages/ui/src/field';
 import ProjectBillableRateModal from '@/packages/ui/src/Project/ProjectBillableRateModal.vue';
 import { getOrganizationCurrencyString } from '@/utils/money';
 import ProjectEditBillableSection from '@/packages/ui/src/Project/ProjectEditBillableSection.vue';
-import ProjectVisibilitySelect from '@/packages/ui/src/Project/ProjectVisibilitySelect.vue';
 import { isAllowedToPerformPremiumAction } from '@/utils/billing';
 import { useOrganizationQuery } from '@/utils/useOrganizationQuery';
 import { getCurrentOrganizationId } from '@/utils/useUser';
@@ -45,7 +44,6 @@ const project = ref<CreateProjectBody>({
     billable_rate: props.originalProject.billable_rate,
     is_billable: props.originalProject.is_billable,
     estimated_time: props.originalProject.estimated_time,
-    is_public: props.originalProject.is_public,
 });
 
 async function submit() {
@@ -128,7 +126,6 @@ async function submitBillableRate() {
                     v-if="isAllowedToPerformPremiumAction()"
                     v-model="project.estimated_time"
                     @submit="submit()"></EstimatedTimeSection>
-                <ProjectVisibilitySelect v-model="project.is_public"></ProjectVisibilitySelect>
             </FieldGroup>
         </template>
         <template #footer>

resources/js/Components/Common/Project/ProjectTable.vue

@@ -13,8 +13,7 @@ export type SortColumn =
     | 'spent_time'
     | 'progress'
     | 'billable_rate'
-    | 'status'
-    | 'visibility';
+    | 'status';
 export type SortDirection = 'asc' | 'desc';
 import { canCreateProjects } from '@/utils/permissions';
 import type { CreateProjectBody, Project, Client, CreateClientBody } from '@/packages/api/src';
@@ -103,10 +102,6 @@ const columns = computed(() => [
         id: 'status',
         accessorFn: (row: Project) => (row.is_archived ? 1 : 0),
     },
-    {
-        id: 'visibility',
-        accessorFn: (row: Project) => (row.is_public ? 1 : 0),
-    },
 ]);
 
 // Columns with sortDescFirst get desc as default direction on first click.
@@ -154,7 +149,7 @@ async function createClient(client: CreateClientBody): Promise<Client | undefine
 }
 
 const gridTemplate = computed(() => {
-    return `grid-template-columns: minmax(300px, 1fr) minmax(150px, auto) minmax(140px, auto) minmax(130px, auto) ${props.showBillableRate ? 'minmax(130px, auto)' : ''} minmax(120px, auto) minmax(120px, auto) 80px;`;
+    return `grid-template-columns: minmax(300px, 1fr) minmax(150px, auto) minmax(140px, auto) minmax(130px, auto) ${props.showBillableRate ? 'minmax(130px, auto)' : ''} minmax(120px, auto) 80px;`;
 });
 </script>
 
@@ -176,7 +171,7 @@ const gridTemplate = computed(() => {
                     :sort-direction="props.sortDirection"
                     :desc-first-columns="descFirstColumns"
                     @sort="handleSort"></ProjectTableHeading>
-                <div v-if="sortedProjects.length === 0" class="col-span-full py-24 text-center">
+                <div v-if="sortedProjects.length === 0" class="col-span-5 py-24 text-center">
                     <FolderPlusIcon class="w-8 text-icon-default inline pb-2"></FolderPlusIcon>
                     <h3 class="text-text-primary font-semibold">
                         {{

resources/js/Components/Common/Project/ProjectTableHeading.vue

@@ -86,14 +86,6 @@ function isChevronUp(column: SortColumn): boolean {
             <ChevronUpIcon v-else-if="isChevronUp('status')" class="w-4 h-4" />
             <span v-else class="w-4 h-4"></span>
         </div>
-        <div
-            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
-            @click="handleSort('visibility')">
-            Visibility
-            <ChevronDownIcon v-if="isChevronDown('visibility')" class="w-4 h-4" />
-            <ChevronUpIcon v-else-if="isChevronUp('visibility')" class="w-4 h-4" />
-            <span v-else class="w-4 h-4"></span>
-        </div>
         <div class="relative py-1.5 pl-3 pr-4 sm:pr-6 lg:pr-8 3xl:pr-12">
             <span class="sr-only">Edit</span>
         </div>

resources/js/Components/Common/Project/ProjectTableRow.vue

@@ -7,8 +7,6 @@ import {
     PencilSquareIcon,
     ArchiveBoxIcon as ArchiveBoxIconSolid,
     TrashIcon,
-    GlobeAltIcon,
-    LockClosedIcon,
 } from '@heroicons/vue/20/solid';
 import { useClientsQuery } from '@/utils/useClientsQuery';
 import { useTasksQuery } from '@/utils/useTasksQuery';
@@ -143,17 +141,6 @@ const showEditProjectModal = ref(false);
                         <span>Active</span>
                     </template>
                 </div>
-                <div
-                    class="whitespace-nowrap px-3 py-4 text-sm text-text-primary flex space-x-1.5 items-center font-medium">
-                    <template v-if="project.is_public">
-                        <GlobeAltIcon class="w-4 text-icon-default"></GlobeAltIcon>
-                        <span>Public</span>
-                    </template>
-                    <template v-else>
-                        <LockClosedIcon class="w-4 text-icon-default"></LockClosedIcon>
-                        <span>Private</span>
-                    </template>
-                </div>
                 <div
                     class="relative whitespace-nowrap flex items-center pl-3 text-right text-sm font-medium pr-4 sm:pr-6 lg:pr-8 3xl:pr-12">
                     <ProjectMoreOptionsDropdown

resources/js/Components/Common/Project/ProjectVisibilityFilterBadge.vue

@@ -1,46 +0,0 @@
-<script setup lang="ts">
-import { computed } from 'vue';
-import { GlobeAltIcon } from '@heroicons/vue/16/solid';
-import { DropdownMenuItem } from '@/packages/ui/src';
-import BaseFilterBadge from './BaseFilterBadge.vue';
-
-type VisibilityValue = 'public' | 'private' | 'all';
-
-const props = defineProps<{
-    value: VisibilityValue;
-}>();
-
-const emit = defineEmits<{
-    remove: [];
-    'update:value': [value: VisibilityValue];
-}>();
-
-const visibilityOptions = [
-    { id: 'public' as const, name: 'Public' },
-    { id: 'private' as const, name: 'Private' },
-];
-
-const label = computed(() => {
-    return visibilityOptions.find((opt) => opt.id === props.value)?.name ?? 'Visibility';
-});
-
-function updateVisibility(visibility: VisibilityValue) {
-    emit('update:value', visibility);
-}
-</script>
-
-<template>
-    <BaseFilterBadge
-        :icon="GlobeAltIcon"
-        :label="label"
-        filter-name="Visibility"
-        @remove="emit('remove')">
-        <DropdownMenuItem
-            v-for="option in visibilityOptions"
-            :key="option.id"
-            :class="[value === option.id && 'bg-accent text-accent-foreground']"
-            @click="updateVisibility(option.id)">
-            {{ option.name }}
-        </DropdownMenuItem>
-    </BaseFilterBadge>
-</template>

resources/js/Components/Common/Project/ProjectsFilterDropdown.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import { computed, ref } from 'vue';
-import { UserGroupIcon, CheckCircleIcon, GlobeAltIcon } from '@heroicons/vue/16/solid';
+import { UserGroupIcon, CheckCircleIcon } from '@heroicons/vue/16/solid';
 import ListFilterIcon from '@/packages/ui/src/Icons/ListFilterIcon.vue';
 import {
     DropdownMenu,
@@ -19,7 +19,6 @@ import { NO_CLIENT_ID } from './constants';
 
 export interface ProjectFilters {
     status: 'active' | 'archived' | 'all';
-    visibility: 'public' | 'private' | 'all';
     clientIds: string[];
 }
 
@@ -37,11 +36,6 @@ const statusOptions = [
     { id: 'archived' as const, name: 'Archived' },
 ];
 
-const visibilityOptions = [
-    { id: 'public' as const, name: 'Public' },
-    { id: 'private' as const, name: 'Private' },
-];
-
 const open = ref(false);
 
 function updateStatus(status: 'active' | 'archived' | 'all') {
@@ -52,14 +46,6 @@ function updateStatus(status: 'active' | 'archived' | 'all') {
     open.value = false;
 }
 
-function updateVisibility(visibility: 'public' | 'private' | 'all') {
-    emit('update:filters', {
-        ...props.filters,
-        visibility,
-    });
-    open.value = false;
-}
-
 function toggleClient(clientId: string) {
     const clientIds = props.filters.clientIds.includes(clientId)
         ? props.filters.clientIds.filter((id) => id !== clientId)
@@ -83,11 +69,7 @@ function toggleNoClient() {
 }
 
 const hasActiveFilters = computed(() => {
-    return (
-        props.filters.status !== 'all' ||
-        props.filters.visibility !== 'all' ||
-        props.filters.clientIds.length > 0
-    );
+    return props.filters.status !== 'all' || props.filters.clientIds.length > 0;
 });
 </script>
 
@@ -120,25 +102,6 @@ const hasActiveFilters = computed(() => {
                 </DropdownMenuSubContent>
             </DropdownMenuSub>
 
-            <!-- Visibility Filter -->
-            <DropdownMenuSub>
-                <DropdownMenuSubTrigger class="gap-2">
-                    <GlobeAltIcon class="h-4 w-4 text-icon-default" />
-                    <span>Visibility</span>
-                </DropdownMenuSubTrigger>
-                <DropdownMenuSubContent>
-                    <DropdownMenuItem
-                        v-for="option in visibilityOptions"
-                        :key="option.id"
-                        :class="[
-                            filters.visibility === option.id && 'bg-accent text-accent-foreground',
-                        ]"
-                        @click="updateVisibility(option.id)">
-                        {{ option.name }}
-                    </DropdownMenuItem>
-                </DropdownMenuSubContent>
-            </DropdownMenuSub>
-
             <!-- Client Filter -->
             <DropdownMenuSub v-if="clients.length > 0">
                 <DropdownMenuSubTrigger class="gap-2">

resources/js/Pages/ProjectShow.vue

@@ -109,7 +109,7 @@ const shownTasks = computed(() => {
                         </div>
                     </li>
                 </ol>
-                <div class="px-4 space-x-1">
+                <div class="px-4">
                     <Badge v-if="project?.billable_rate">
                         {{ billableRateFormatted }}
                         / h
@@ -118,7 +118,6 @@ const shownTasks = computed(() => {
                         Default Rate
                     </Badge>
                     <Badge v-if="!project?.is_billable"> Non-Billable </Badge>
-                    <Badge>{{ project?.is_public ? 'Public' : 'Private' }}</Badge>
                 </div>
             </nav>
             <div>

resources/js/Pages/Projects.vue

@@ -20,7 +20,6 @@ import { isAllowedToPerformPremiumAction } from '@/utils/billing';
 import { useStorage } from '@vueuse/core';
 import ProjectsFilterDropdown from '@/Components/Common/Project/ProjectsFilterDropdown.vue';
 import ProjectStatusFilterBadge from '@/Components/Common/Project/ProjectStatusFilterBadge.vue';
-import ProjectVisibilityFilterBadge from '@/Components/Common/Project/ProjectVisibilityFilterBadge.vue';
 import ProjectClientFilterBadge from '@/Components/Common/Project/ProjectClientFilterBadge.vue';
 import { NO_CLIENT_ID } from '@/Components/Common/Project/constants';
 import type { SortColumn, SortDirection } from '@/Components/Common/Project/ProjectTable.vue';
@@ -37,7 +36,6 @@ interface ProjectTableState {
     filters: {
         clientIds: string[];
         status: 'active' | 'archived' | 'all';
-        visibility: 'public' | 'private' | 'all';
     };
 }
 
@@ -49,17 +47,10 @@ const tableState = useStorage<ProjectTableState>(
         filters: {
             clientIds: [],
             status: 'all',
-            visibility: 'all',
         },
     },
     undefined,
-    {
-        mergeDefaults: (storage, defaults) => ({
-            ...defaults,
-            ...storage,
-            filters: { ...defaults.filters, ...storage.filters },
-        }),
-    }
+    { mergeDefaults: true }
 );
 
 function handleSort(column: SortColumn, direction: SortDirection) {
@@ -78,14 +69,6 @@ const filteredProjects = computed(() => {
             return false;
         }
 
-        // Visibility filter
-        if (tableState.value.filters.visibility === 'public' && !project.is_public) {
-            return false;
-        }
-        if (tableState.value.filters.visibility === 'private' && project.is_public) {
-            return false;
-        }
-
         // Client filter
         const hasClientFilter = tableState.value.filters.clientIds.length > 0;
         if (hasClientFilter) {
@@ -108,10 +91,6 @@ function removeStatusFilter() {
     tableState.value.filters.status = 'all';
 }
 
-function removeVisibilityFilter() {
-    tableState.value.filters.visibility = 'all';
-}
-
 function removeClientFilter() {
     tableState.value.filters.clientIds = [];
 }
@@ -173,15 +152,6 @@ const showBillableRate = computed(() => {
                         tableState.filters.status = $event as 'active' | 'archived' | 'all'
                     " />
 
-                <ProjectVisibilityFilterBadge
-                    v-if="tableState.filters.visibility !== 'all'"
-                    data-testid="visibility-filter-badge"
-                    :value="tableState.filters.visibility"
-                    @remove="removeVisibilityFilter"
-                    @update:value="
-                        tableState.filters.visibility = $event as 'public' | 'private' | 'all'
-                    " />
-
                 <ProjectClientFilterBadge
                     v-if="tableState.filters.clientIds.length > 0"
                     data-testid="client-filter-badge"

resources/js/Pages/Teams/Partials/TeamMemberManager.vue

@@ -0,0 +1,448 @@
+<script setup lang="ts">
+import { computed, ref } from 'vue';
+import { router, useForm, usePage } from '@inertiajs/vue3';
+import ActionMessage from '@/Components/ActionMessage.vue';
+import ActionSection from '@/Components/ActionSection.vue';
+import ConfirmationModal from '@/Components/ConfirmationModal.vue';
+import DangerButton from '@/packages/ui/src/Buttons/DangerButton.vue';
+import DialogModal from '@/packages/ui/src/DialogModal.vue';
+import FormSection from '@/Components/FormSection.vue';
+import { Field, FieldLabel, FieldError } from '@/packages/ui/src/field';
+
+import PrimaryButton from '@/packages/ui/src/Buttons/PrimaryButton.vue';
+import SecondaryButton from '@/packages/ui/src/Buttons/SecondaryButton.vue';
+import SectionBorder from '@/Components/SectionBorder.vue';
+import TextInput from '@/packages/ui/src/Input/TextInput.vue';
+import type { Organization, OrganizationInvitation, User } from '@/types/models';
+import type { Membership, Permissions, Role } from '@/types/jetstream';
+import { filterRoles } from '@/utils/roles';
+
+type UserWithMembership = User & { membership: Membership };
+
+const props = defineProps<{
+    team: Organization;
+    availableRoles: Role[];
+    userPermissions: Permissions;
+}>();
+
+const users = computed(() => {
+    return props.team.users as Array<UserWithMembership>;
+});
+
+const page = usePage<{
+    auth: {
+        user: User;
+    };
+}>();
+
+const addTeamMemberForm = useForm({
+    email: '',
+    role: null as string | null,
+});
+
+const updateRoleForm = useForm({
+    role: null as string | null,
+});
+
+const leaveTeamForm = useForm({});
+const removeTeamMemberForm = useForm({});
+
+const currentlyManagingRole = ref(false);
+const managingRoleFor = ref<User | null>(null);
+const confirmingLeavingTeam = ref(false);
+const teamMemberBeingRemoved = ref<User | null>(null);
+
+const addTeamMember = () => {
+    addTeamMemberForm.post(route('team-members.store', props.team.id), {
+        errorBag: 'addTeamMember',
+        preserveScroll: true,
+        onSuccess: () => addTeamMemberForm.reset(),
+    });
+};
+
+const cancelTeamInvitation = (invitation: OrganizationInvitation) => {
+    router.delete(route('team-invitations.destroy', invitation.id), {
+        preserveScroll: true,
+    });
+};
+
+const manageRole = (teamMember: User & { membership: Membership }) => {
+    managingRoleFor.value = teamMember;
+    updateRoleForm.role = teamMember.membership.role;
+    currentlyManagingRole.value = true;
+};
+
+const updateRole = () => {
+    updateRoleForm.put(
+        route('team-members.update', {
+            team: props.team.id,
+            user: managingRoleFor.value?.id,
+        }),
+        {
+            preserveScroll: true,
+            onSuccess: () => (currentlyManagingRole.value = false),
+        }
+    );
+};
+
+const confirmLeavingTeam = () => {
+    confirmingLeavingTeam.value = true;
+};
+
+const leaveTeam = () => {
+    leaveTeamForm.delete(route('team-members.destroy', [props.team.id, page.props.auth.user.id]));
+};
+
+const confirmTeamMemberRemoval = (teamMember: User) => {
+    teamMemberBeingRemoved.value = teamMember;
+};
+
+const removeTeamMember = () => {
+    removeTeamMemberForm.delete(
+        route('team-members.destroy', {
+            team: props.team.id,
+            user: teamMemberBeingRemoved.value?.id,
+        }),
+        {
+            errorBag: 'removeTeamMember',
+            preserveScroll: true,
+            preserveState: true,
+            onSuccess: () => (teamMemberBeingRemoved.value = null),
+        }
+    );
+};
+
+const displayableRole = (role: string) => {
+    return props.availableRoles.find((r) => r.key === role)?.name;
+};
+</script>
+
+<template>
+    <div>
+        <div v-if="userPermissions.canAddTeamMembers">
+            <SectionBorder />
+
+            <!-- Add Organization Member -->
+            <FormSection @submitted="addTeamMember">
+                <template #title> Add Organization Member</template>
+
+                <template #description>
+                    Add a new member to your organization, allowing them to collaborate with you.
+                </template>
+
+                <template #form>
+                    <div class="col-span-6">
+                        <div class="max-w-xl text-sm text-muted">
+                            Please provide the email address of the person you would like to add to
+                            this organization.
+                        </div>
+                    </div>
+
+                    <!-- Member Email -->
+                    <Field class="col-span-6 sm:col-span-4">
+                        <FieldLabel for="email">Email</FieldLabel>
+                        <TextInput
+                            id="email"
+                            v-model="addTeamMemberForm.email"
+                            type="email"
+                            class="block w-full" />
+                        <FieldError v-if="addTeamMemberForm.errors.email">{{
+                            addTeamMemberForm.errors.email
+                        }}</FieldError>
+                    </Field>
+
+                    <!-- Role -->
+                    <div v-if="availableRoles.length > 0" class="col-span-6 lg:col-span-4">
+                        <FieldLabel for="roles">Role</FieldLabel>
+                        <FieldError v-if="addTeamMemberForm.errors.role">{{
+                            addTeamMemberForm.errors.role
+                        }}</FieldError>
+
+                        <div
+                            class="relative z-0 mt-1 border border-card-border rounded-lg cursor-pointer">
+                            <button
+                                v-for="(role, i) in filterRoles(availableRoles)"
+                                :key="role.key"
+                                type="button"
+                                class="relative px-4 py-3 inline-flex w-full rounded-lg focus:z-10 focus:outline-none focus:border-indigo-500 focus:ring-2 focus:ring-indigo-500"
+                                :class="{
+                                    'border-t border-card-border focus:border-none rounded-t-none':
+                                        i > 0,
+                                    'rounded-b-none': i != Object.keys(availableRoles).length - 1,
+                                }"
+                                @click="addTeamMemberForm.role = role.key">
+                                <div
+                                    :class="{
+                                        'opacity-50':
+                                            addTeamMemberForm.role &&
+                                            addTeamMemberForm.role != role.key,
+                                    }">
+                                    <!-- Role Name -->
+                                    <div class="flex items-center">
+                                        <div
+                                            class="text-sm text-text-primary"
+                                            :class="{
+                                                'font-semibold': addTeamMemberForm.role == role.key,
+                                            }">
+                                            {{ role.name }}
+                                        </div>
+
+                                        <svg
+                                            v-if="addTeamMemberForm.role == role.key"
+                                            class="ms-2 h-5 w-5 text-green-400"
+                                            xmlns="http://www.w3.org/2000/svg"
+                                            fill="none"
+                                            viewBox="0 0 24 24"
+                                            stroke-width="1.5"
+                                            stroke="currentColor">
+                                            <path
+                                                stroke-linecap="round"
+                                                stroke-linejoin="round"
+                                                d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+                                        </svg>
+                                    </div>
+
+                                    <!-- Role Description -->
+                                    <div class="mt-2 text-xs text-muted text-start">
+                                        {{ role.description }}
+                                    </div>
+                                </div>
+                            </button>
+                        </div>
+                    </div>
+                </template>
+
+                <template #actions>
+                    <ActionMessage :on="addTeamMemberForm.recentlySuccessful" class="me-3">
+                        Added.
+                    </ActionMessage>
+
+                    <PrimaryButton
+                        :class="{ 'opacity-25': addTeamMemberForm.processing }"
+                        :disabled="addTeamMemberForm.processing">
+                        Add
+                    </PrimaryButton>
+                </template>
+            </FormSection>
+        </div>
+
+        <div v-if="team.team_invitations.length > 0 && userPermissions.canAddTeamMembers">
+            <SectionBorder />
+
+            <!-- Organization Member Invitations -->
+            <ActionSection class="mt-10 sm:mt-0">
+                <template #title> Pending Organization Invitations</template>
+
+                <template #description>
+                    These people have been invited to your organization and have been sent an
+                    invitation email. They may join the organization by accepting the email
+                    invitation.
+                </template>
+
+                <!-- Pending Organization Member Invitation List -->
+                <template #content>
+                    <div class="space-y-6">
+                        <div
+                            v-for="invitation in team.team_invitations"
+                            :key="invitation.id"
+                            class="flex items-center justify-between">
+                            <div class="text-muted">
+                                {{ invitation.email }}
+                            </div>
+
+                            <div class="flex items-center">
+                                <!-- Cancel Organization Invitation -->
+                                <button
+                                    v-if="userPermissions.canRemoveTeamMembers"
+                                    class="cursor-pointer ms-6 text-sm text-red-500 focus:outline-none"
+                                    @click="cancelTeamInvitation(invitation)">
+                                    Cancel
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </template>
+            </ActionSection>
+        </div>
+
+        <div v-if="users.length > 0">
+            <SectionBorder />
+
+            <!-- Manage Organization Members -->
+            <ActionSection class="mt-10 sm:mt-0">
+                <template #title> Organization Members</template>
+
+                <template #description>
+                    All of the people that are part of this organization.
+                </template>
+
+                <!-- Organization Member List -->
+                <template #content>
+                    <div class="space-y-6">
+                        <div
+                            v-for="user in users"
+                            :key="user.id"
+                            class="flex items-center justify-between">
+                            <div class="flex items-center">
+                                <img
+                                    class="w-8 h-8 rounded-full object-cover"
+                                    :src="user.profile_photo_url"
+                                    :alt="user.name" />
+                                <div class="ms-4 text-text-primary">
+                                    {{ user.name }}
+                                </div>
+                            </div>
+
+                            <div class="flex items-center">
+                                <!-- Manage Organization Member Role -->
+                                <button
+                                    v-if="
+                                        userPermissions.canUpdateTeamMembers &&
+                                        availableRoles.length
+                                    "
+                                    class="ms-2 text-sm text-gray-400 underline"
+                                    @click="manageRole(user)">
+                                    {{ displayableRole(user.membership.role) }}
+                                </button>
+
+                                <div
+                                    v-else-if="availableRoles.length"
+                                    class="ms-2 text-sm text-gray-400">
+                                    {{ displayableRole(user.membership.role) }}
+                                </div>
+
+                                <!-- Leave Organization -->
+                                <button
+                                    v-if="page.props.auth.user.id === user.id"
+                                    class="cursor-pointer ms-6 text-sm text-red-500"
+                                    @click="confirmLeavingTeam">
+                                    Leave
+                                </button>
+
+                                <!-- Remove Organization Member -->
+                                <button
+                                    v-else-if="userPermissions.canRemoveTeamMembers"
+                                    class="cursor-pointer ms-6 text-sm text-red-500"
+                                    @click="confirmTeamMemberRemoval(user)">
+                                    Remove
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </template>
+            </ActionSection>
+        </div>
+
+        <!-- Role Management Modal -->
+        <DialogModal :show="currentlyManagingRole" @close="currentlyManagingRole = false">
+            <template #title> Manage Role</template>
+
+            <template #content>
+                <div v-if="managingRoleFor">
+                    <div
+                        class="relative z-0 mt-1 border border-card-border rounded-lg cursor-pointer">
+                        <button
+                            v-for="(role, i) in availableRoles"
+                            :key="role.key"
+                            type="button"
+                            class="relative px-4 py-3 inline-flex w-full rounded-lg focus:z-10 focus:outline-none focus:border-indigo-500 focus:ring-2 focus:ring-indigo-500"
+                            :class="{
+                                'border-t border-card-border focus:border-none rounded-t-none':
+                                    i > 0,
+                                'rounded-b-none': i !== Object.keys(availableRoles).length - 1,
+                            }"
+                            @click="updateRoleForm.role = role.key">
+                            <div
+                                :class="{
+                                    'opacity-50':
+                                        updateRoleForm.role && updateRoleForm.role !== role.key,
+                                }">
+                                <!-- Role Name -->
+                                <div class="flex items-center">
+                                    <div
+                                        class="text-sm text-muted"
+                                        :class="{
+                                            'font-semibold': updateRoleForm.role === role.key,
+                                        }">
+                                        {{ role.name }}
+                                    </div>
+
+                                    <svg
+                                        v-if="updateRoleForm.role == role.key"
+                                        class="ms-2 h-5 w-5 text-green-400"
+                                        xmlns="http://www.w3.org/2000/svg"
+                                        fill="none"
+                                        viewBox="0 0 24 24"
+                                        stroke-width="1.5"
+                                        stroke="currentColor">
+                                        <path
+                                            stroke-linecap="round"
+                                            stroke-linejoin="round"
+                                            d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+                                    </svg>
+                                </div>
+
+                                <!-- Role Description -->
+                                <div class="mt-2 text-xs text-muted">
+                                    {{ role.description }}
+                                </div>
+                            </div>
+                        </button>
+                    </div>
+                </div>
+            </template>
+
+            <template #footer>
+                <SecondaryButton @click="currentlyManagingRole = false"> Cancel </SecondaryButton>
+
+                <PrimaryButton
+                    class="ms-3"
+                    :class="{ 'opacity-25': updateRoleForm.processing }"
+                    :disabled="updateRoleForm.processing"
+                    @click="updateRole">
+                    Save
+                </PrimaryButton>
+            </template>
+        </DialogModal>
+
+        <!-- Leave Organization Confirmation Modal -->
+        <ConfirmationModal :show="confirmingLeavingTeam" @close="confirmingLeavingTeam = false">
+            <template #title> Leave Organization</template>
+
+            <template #content> Are you sure you would like to leave this organization? </template>
+
+            <template #footer>
+                <SecondaryButton @click="confirmingLeavingTeam = false"> Cancel </SecondaryButton>
+
+                <DangerButton
+                    class="ms-3"
+                    :class="{ 'opacity-25': leaveTeamForm.processing }"
+                    :disabled="leaveTeamForm.processing"
+                    @click="leaveTeam">
+                    Leave
+                </DangerButton>
+            </template>
+        </ConfirmationModal>
+
+        <!-- Remove Organization Member Confirmation Modal -->
+        <ConfirmationModal :show="!!teamMemberBeingRemoved" @close="teamMemberBeingRemoved = null">
+            <template #title> Remove Organization Member</template>
+
+            <template #content>
+                Are you sure you would like to remove this person from the organization?
+            </template>
+
+            <template #footer>
+                <SecondaryButton @click="teamMemberBeingRemoved = null"> Cancel </SecondaryButton>
+
+                <DangerButton
+                    class="ms-3"
+                    :class="{ 'opacity-25': removeTeamMemberForm.processing }"
+                    :disabled="removeTeamMemberForm.processing"
+                    @click="removeTeamMember">
+                    Remove
+                </DangerButton>
+            </template>
+        </ConfirmationModal>
+    </div>
+</template>

resources/js/Pages/Teams/Partials/UpdateTeamNameForm.vue

@@ -51,6 +51,9 @@ const updateTeamName = () => {
                             <div class="text-text-primary">
                                 {{ team.owner.name }}
                             </div>
+                            <div class="text-text-secondary text-sm">
+                                {{ team.owner.email }}
+                            </div>
                         </div>
                     </div>
                 </div>

resources/js/packages/api/src/index.ts

@@ -114,8 +114,6 @@ export type ApiToken = ApiTokenIndexResponse['data'][0];
 
 export type DetailedInvoiceResponse = ZodiosResponseByAlias<SolidTimeApi, 'getInvoice'>;
 
-export type DetailedInvoice = DetailedInvoiceResponse['data'];
-
 export type InvoiceIndexEntry = ZodiosResponseByAlias<SolidTimeApi, 'getInvoices'>['data'][0];
 
 export type UpdateInvoiceSettings = ZodiosBodyByAlias<SolidTimeApi, 'updateInvoiceSettings'>;

resources/js/packages/api/src/openapi.json.client.ts

@@ -1886,54 +1886,6 @@ const endpoints = makeApi([
             },
         ],
     },
-    {
-        method: 'post',
-        path: '/v1/organizations/:organization/invoices/:invoice/copy',
-        alias: 'copyInvoice',
-        requestFormat: 'json',
-        parameters: [
-            {
-                name: 'body',
-                type: 'Body',
-                schema: z.object({ reference: z.string() }).passthrough(),
-            },
-            {
-                name: 'organization',
-                type: 'Path',
-                schema: z.string(),
-            },
-            {
-                name: 'invoice',
-                type: 'Path',
-                schema: z.string(),
-            },
-        ],
-        response: z.object({ data: DetailedInvoiceResource }).passthrough(),
-        errors: [
-            {
-                status: 401,
-                description: `Unauthenticated`,
-                schema: z.object({ message: z.string() }).passthrough(),
-            },
-            {
-                status: 403,
-                description: `Authorization error`,
-                schema: z.object({ message: z.string() }).passthrough(),
-            },
-            {
-                status: 404,
-                description: `Not found`,
-                schema: z.object({ message: z.string() }).passthrough(),
-            },
-            {
-                status: 422,
-                description: `Validation error`,
-                schema: z
-                    .object({ message: z.string(), errors: z.record(z.array(z.string())) })
-                    .passthrough(),
-            },
-        ],
-    },
     {
         method: 'get',
         path: '/v1/organizations/:organization/invoices/:invoice',

resources/js/packages/ui/src/Input/MultiselectDropdown.vue

@@ -35,8 +35,7 @@ watch(open, (isOpen) => {
         sortedItems.value = [...props.items].sort((a, b) => {
             const aSelected = model.value.includes(props.getKeyFromItem(a)) ? 0 : 1;
             const bSelected = model.value.includes(props.getKeyFromItem(b)) ? 0 : 1;
-            if (aSelected !== bSelected) return aSelected - bSelected;
-            return props.getNameForItem(a).localeCompare(props.getNameForItem(b));
+            return aSelected - bSelected;
         });
     }
 });

resources/js/packages/ui/src/Project/ProjectCreateModal.vue

@@ -15,7 +15,6 @@ import { UserCircleIcon } from '@heroicons/vue/20/solid';
 import EstimatedTimeSection from '@/packages/ui/src/EstimatedTimeSection.vue';
 import { Field, FieldGroup, FieldLabel } from '../field';
 import ProjectEditBillableSection from '@/packages/ui/src/Project/ProjectEditBillableSection.vue';
-import ProjectVisibilitySelect from '@/packages/ui/src/Project/ProjectVisibilitySelect.vue';
 import type { Client } from '@/packages/api/src';
 
 const show = defineModel('show', { default: false });
@@ -42,7 +41,6 @@ const project = ref<CreateProjectBody>({
     billable_rate: null,
     is_billable: false,
     estimated_time: null,
-    is_public: false,
 });
 
 async function submit() {
@@ -55,7 +53,6 @@ async function submit() {
         billable_rate: null,
         is_billable: false,
         estimated_time: null,
-        is_public: false,
     };
 }
 
@@ -126,7 +123,6 @@ const currentClientName = computed(() => {
                     v-if="enableEstimatedTime"
                     v-model="project.estimated_time"
                     @submit="submit()"></EstimatedTimeSection>
-                <ProjectVisibilitySelect v-model="project.is_public"></ProjectVisibilitySelect>
             </FieldGroup>
         </template>
         <template #footer>

resources/js/packages/ui/src/Project/ProjectVisibilitySelect.vue

@@ -1,39 +0,0 @@
-<script setup lang="ts">
-import { computed } from 'vue';
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '..';
-import { Field, FieldDescription, FieldLabel } from '../field';
-import { GlobeAltIcon } from '@heroicons/vue/20/solid';
-
-const isPublic = defineModel<boolean>({ default: false });
-
-const visibility = computed({
-    get: () => (isPublic.value ? 'public' : 'private'),
-    set: (value: string) => {
-        isPublic.value = value === 'public';
-    },
-});
-
-const description = computed(() =>
-    isPublic.value
-        ? 'This project is visible to all members of the organization.'
-        : 'This project is only visible to its project members.'
-);
-</script>
-
-<template>
-    <Field>
-        <FieldLabel :icon="GlobeAltIcon" for="visibility">Visibility</FieldLabel>
-        <Select v-model="visibility">
-            <SelectTrigger id="visibility">
-                <SelectValue />
-            </SelectTrigger>
-            <SelectContent>
-                <SelectItem value="private">Private</SelectItem>
-                <SelectItem value="public">Public</SelectItem>
-            </SelectContent>
-        </Select>
-        <FieldDescription>{{ description }}</FieldDescription>
-    </Field>
-</template>
-
-<style scoped></style>

resources/js/packages/ui/src/dialog/DialogContent.vue

@@ -31,7 +31,7 @@ const forwarded = useForwardPropsEmits(delegatedProps, emits);
         <div
             :class="
                 cn(
-                    'fixed top-0 left-0 z-50 pointer-events-none w-screen h-screen flex items-start px-2 pt-3 md:pt-14 xl:pt-24 justify-center overflow-auto'
+                    'fixed top-0 left-0 z-50 pointer-events-none w-screen h-screen flex items-start px-2 pt-3 md:pt-20 xl:pt-32 justify-center overflow-auto'
                 )
             ">
             <DialogContent

resources/js/packages/ui/src/field/FieldGroup.vue

@@ -12,7 +12,7 @@ const props = defineProps<{
         data-slot="field-group"
         :class="
             cn(
-                'group/field-group @container/field-group flex w-full flex-col gap-6 data-[slot=checkbox-group]:gap-3 [&>[data-slot=field-group]]:gap-4',
+                'group/field-group @container/field-group flex w-full flex-col gap-7 data-[slot=checkbox-group]:gap-3 [&>[data-slot=field-group]]:gap-4',
                 props.class
             )
         ">

resources/js/types/models.d.ts

@@ -22,7 +22,9 @@ export interface Organization {
     currency: string;
     created_at: string | null;
     updated_at: string | null;
-    owner: Pick<User, 'id' | 'name' | 'profile_photo_url'>;
+    owner: User;
+    users: User[];
+    team_invitations: OrganizationInvitation[];
 }
 export interface OrganizationInvitation {
     id: string;

resources/js/types/models.ts

@@ -29,7 +29,9 @@ export interface Organization {
     created_at: string | null;
     updated_at: string | null;
     // relations
-    owner: Pick<User, 'id' | 'name' | 'profile_photo_url'>;
+    owner: User;
+    users: User[];
+    team_invitations: OrganizationInvitation[];
 }
 
 export interface OrganizationInvitation {

tests/Unit/Endpoint/Api/V1/ProjectEndpointTest.php

@@ -308,22 +308,6 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
         $response->assertForbidden();
     }
 
-    public function test_show_endpoint_fails_if_employee_tries_to_access_public_project(): void
-    {
-        // Arrange
-        // Employees do not have the projects:view:all permission that the show endpoint requires,
-        // so they are forbidden even from public projects (they list them via the index endpoint instead).
-        $data = $this->createUserWithRole(Role::Employee);
-        $publicProject = Project::factory()->forOrganization($data->organization)->isPublic()->create();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $publicProject->getKey()]));
-
-        // Assert
-        $response->assertForbidden();
-    }
-
     public function test_store_endpoint_fails_if_user_has_no_permission_to_create_projects(): void
     {
         // Arrange
@@ -343,29 +327,6 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
         $response->assertForbidden();
     }
 
-    public function test_store_endpoint_fails_if_user_is_employee(): void
-    {
-        // Arrange
-        $data = $this->createUserWithRole(Role::Employee);
-        $projectFake = Project::factory()->forOrganization($data->organization)->make();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->postJson(route('api.v1.projects.store', [$data->organization->getKey()]), [
-            'name' => $projectFake->name,
-            'color' => $projectFake->color,
-            'client_id' => null,
-            'is_billable' => $projectFake->is_billable,
-        ]);
-
-        // Assert
-        $response->assertForbidden();
-        $this->assertDatabaseMissing(Project::class, [
-            'name' => $projectFake->name,
-            'organization_id' => $data->organization->getKey(),
-        ]);
-    }
-
     public function test_store_endpoint_highest_possible_billable_rate_can_be_stored_in_database(): void
     {
         // Arrange
@@ -707,124 +668,6 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
         ]);
     }
 
-    public function test_store_endpoint_creates_public_project(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'projects:create',
-        ]);
-        $projectFake = Project::factory()->forOrganization($data->organization)->make();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->postJson(route('api.v1.projects.store', [$data->organization->getKey()]), [
-            'name' => $projectFake->name,
-            'color' => $projectFake->color,
-            'client_id' => null,
-            'is_billable' => $projectFake->is_billable,
-            'is_public' => true,
-        ]);
-
-        // Assert
-        $response->assertStatus(201);
-        $response->assertJson(fn (AssertableJson $json) => $json
-            ->has('data')
-            ->where('data.is_public', true)
-            ->etc()
-        );
-        $this->assertDatabaseHas(Project::class, [
-            'name' => $projectFake->name,
-            'organization_id' => $projectFake->organization_id,
-            'is_public' => true,
-        ]);
-    }
-
-    public function test_store_endpoint_creates_private_project_if_is_public_is_false(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'projects:create',
-        ]);
-        $projectFake = Project::factory()->forOrganization($data->organization)->make();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->postJson(route('api.v1.projects.store', [$data->organization->getKey()]), [
-            'name' => $projectFake->name,
-            'color' => $projectFake->color,
-            'client_id' => null,
-            'is_billable' => $projectFake->is_billable,
-            'is_public' => false,
-        ]);
-
-        // Assert
-        $response->assertStatus(201);
-        $response->assertJson(fn (AssertableJson $json) => $json
-            ->has('data')
-            ->where('data.is_public', false)
-            ->etc()
-        );
-        $this->assertDatabaseHas(Project::class, [
-            'name' => $projectFake->name,
-            'organization_id' => $projectFake->organization_id,
-            'is_public' => false,
-        ]);
-    }
-
-    public function test_store_endpoint_creates_private_project_by_default_if_is_public_is_not_given(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'projects:create',
-        ]);
-        $projectFake = Project::factory()->forOrganization($data->organization)->make();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->postJson(route('api.v1.projects.store', [$data->organization->getKey()]), [
-            'name' => $projectFake->name,
-            'color' => $projectFake->color,
-            'client_id' => null,
-            'is_billable' => $projectFake->is_billable,
-        ]);
-
-        // Assert
-        $response->assertStatus(201);
-        $response->assertJson(fn (AssertableJson $json) => $json
-            ->has('data')
-            ->where('data.is_public', false)
-            ->etc()
-        );
-        $this->assertDatabaseHas(Project::class, [
-            'name' => $projectFake->name,
-            'organization_id' => $projectFake->organization_id,
-            'is_public' => false,
-        ]);
-    }
-
-    public function test_store_endpoint_fails_if_is_public_is_not_boolean(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'projects:create',
-        ]);
-        $projectFake = Project::factory()->forOrganization($data->organization)->make();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->postJson(route('api.v1.projects.store', [$data->organization->getKey()]), [
-            'name' => $projectFake->name,
-            'color' => $projectFake->color,
-            'client_id' => null,
-            'is_billable' => $projectFake->is_billable,
-            'is_public' => 'public',
-        ]);
-
-        // Assert
-        $response->assertStatus(422);
-        $response->assertJsonValidationErrors(['is_public']);
-    }
-
     public function test_update_endpoint_fails_if_user_is_not_part_of_project_organization(): void
     {
         // Arrange
@@ -870,30 +713,6 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
         $response->assertForbidden();
     }
 
-    public function test_update_endpoint_fails_if_user_is_employee(): void
-    {
-        // Arrange
-        $data = $this->createUserWithRole(Role::Employee);
-        $project = Project::factory()->forOrganization($data->organization)->isPublic()->create();
-        $this->assertBillableRateServiceIsUnused();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->putJson(route('api.v1.projects.update', [$data->organization->getKey(), $project->getKey()]), [
-            'name' => 'Employee Updated Name',
-            'color' => $project->color,
-            'client_id' => null,
-            'is_billable' => $project->is_billable,
-        ]);
-
-        // Assert
-        $response->assertForbidden();
-        $this->assertDatabaseMissing(Project::class, [
-            'id' => $project->getKey(),
-            'name' => 'Employee Updated Name',
-        ]);
-    }
-
     public function test_update_endpoint_can_update_project_if_project_name_already_exists_in_organization_but_with_different_client(): void
     {
         // Arrange
@@ -1138,120 +957,6 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
         $this->assertFalse($project->is_archived);
     }
 
-    public function test_update_endpoint_can_make_a_private_project_public(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'projects:update',
-        ]);
-        $project = Project::factory()->forOrganization($data->organization)->isPrivate()->create();
-        $this->assertBillableRateServiceIsUnused();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->putJson(route('api.v1.projects.update', [$data->organization->getKey(), $project->getKey()]), [
-            'name' => $project->name,
-            'color' => $project->color,
-            'is_billable' => $project->is_billable,
-            'client_id' => null,
-            'is_public' => true,
-        ]);
-
-        // Assert
-        $response->assertStatus(200);
-        $response->assertJson(fn (AssertableJson $json) => $json
-            ->has('data')
-            ->where('data.is_public', true)
-            ->etc()
-        );
-        $project->refresh();
-        $this->assertTrue($project->is_public);
-    }
-
-    public function test_update_endpoint_can_make_a_public_project_private(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'projects:update',
-        ]);
-        $project = Project::factory()->forOrganization($data->organization)->isPublic()->create();
-        $this->assertBillableRateServiceIsUnused();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->putJson(route('api.v1.projects.update', [$data->organization->getKey(), $project->getKey()]), [
-            'name' => $project->name,
-            'color' => $project->color,
-            'is_billable' => $project->is_billable,
-            'client_id' => null,
-            'is_public' => false,
-        ]);
-
-        // Assert
-        $response->assertStatus(200);
-        $response->assertJson(fn (AssertableJson $json) => $json
-            ->has('data')
-            ->where('data.is_public', false)
-            ->etc()
-        );
-        $project->refresh();
-        $this->assertFalse($project->is_public);
-    }
-
-    public function test_update_endpoint_keeps_project_visibility_if_is_public_is_not_given(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'projects:update',
-        ]);
-        $project = Project::factory()->forOrganization($data->organization)->isPublic()->create();
-        $this->assertBillableRateServiceIsUnused();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->putJson(route('api.v1.projects.update', [$data->organization->getKey(), $project->getKey()]), [
-            'name' => $project->name,
-            'color' => $project->color,
-            'is_billable' => $project->is_billable,
-            'client_id' => null,
-        ]);
-
-        // Assert
-        $response->assertStatus(200);
-        $response->assertJson(fn (AssertableJson $json) => $json
-            ->has('data')
-            ->where('data.is_public', true)
-            ->etc()
-        );
-        $project->refresh();
-        $this->assertTrue($project->is_public);
-    }
-
-    public function test_update_endpoint_fails_if_is_public_is_not_boolean(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'projects:update',
-        ]);
-        $project = Project::factory()->forOrganization($data->organization)->isPublic()->create();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->putJson(route('api.v1.projects.update', [$data->organization->getKey(), $project->getKey()]), [
-            'name' => $project->name,
-            'color' => $project->color,
-            'is_billable' => $project->is_billable,
-            'client_id' => null,
-            'is_public' => 'public',
-        ]);
-
-        // Assert
-        $response->assertStatus(422);
-        $response->assertJsonValidationErrors(['is_public']);
-        $project->refresh();
-        $this->assertTrue($project->is_public);
-    }
-
     public function test_update_endpoint_ignores_estimated_time_if_pro_features_are_disabled(): void
     {
         // Arrange
@@ -1470,23 +1175,6 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
         $response->assertForbidden();
     }
 
-    public function test_destroy_endpoint_fails_if_user_is_employee(): void
-    {
-        // Arrange
-        $data = $this->createUserWithRole(Role::Employee);
-        $project = Project::factory()->forOrganization($data->organization)->isPublic()->create();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->deleteJson(route('api.v1.projects.destroy', [$data->organization->getKey(), $project->getKey()]));
-
-        // Assert
-        $response->assertForbidden();
-        $this->assertDatabaseHas(Project::class, [
-            'id' => $project->getKey(),
-        ]);
-    }
-
     public function test_destroy_endpoint_fails_if_project_is_still_in_use_by_a_task(): void
     {
         // Arrange

tests/Unit/Endpoint/Web/TeamShowEndpointTest.php

@@ -1,45 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Tests\Unit\Endpoint\Web;
-
-use App\Models\OrganizationInvitation;
-use App\Providers\JetstreamServiceProvider;
-use Inertia\Testing\AssertableInertia as Assert;
-use Laravel\Jetstream\Jetstream;
-use PHPUnit\Framework\Attributes\CoversClass;
-
-#[CoversClass(JetstreamServiceProvider::class)]
-class TeamShowEndpointTest extends EndpointTestAbstract
-{
-    protected function setUp(): void
-    {
-        Jetstream::$inertiaManager = null;
-        parent::setUp();
-    }
-
-    public function test_team_show_does_not_expose_member_roster_invitations_or_owner_email(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([]);
-        OrganizationInvitation::factory()->forOrganization($data->organization)->create([
-            'email' => 'pending@example.com',
-        ]);
-        $this->actingAs($data->user);
-
-        // Act
-        $response = $this->get('/teams/'.$data->organization->getKey());
-
-        // Assert
-        $response->assertOk();
-        $response->assertInertia(fn (Assert $page) => $page
-            ->missing('team.users')
-            ->missing('team.team_invitations')
-            ->missing('team.owner.email')
-            ->has('team.owner.id')
-            ->has('team.owner.name')
-            ->has('team.owner.profile_photo_url')
-        );
-    }
-}