diff --git a/app/Livewire/Team/DangerZone.php b/app/Livewire/Team/DangerZone.php index 74cf3d7ef8..643477e24d 100644 --- a/app/Livewire/Team/DangerZone.php +++ b/app/Livewire/Team/DangerZone.php @@ -16,6 +16,7 @@ class DangerZone extends Component public function mount(): void { $this->team = currentTeam(); + $this->authorize('delete', $this->team); } public function delete(): mixed diff --git a/resources/views/components/team/settings-layout.blade.php b/resources/views/components/team/settings-layout.blade.php index 3b6db03c3a..be3ea573e1 100644 --- a/resources/views/components/team/settings-layout.blade.php +++ b/resources/views/components/team/settings-layout.blade.php @@ -24,13 +24,13 @@ 'active' => request()->routeIs('team.admin-view'), 'icon' => 'admin', ] : null, - [ + auth()->user()->can('delete', currentTeam()) ? [ 'label' => 'Danger Zone', 'route' => 'team.danger-zone', 'active' => request()->routeIs('team.danger-zone'), 'icon' => 'shield-alert', 'sectionStart' => true, - ], + ] : null, ])->filter(); @endphp diff --git a/tests/Feature/Authorization/TeamAuthorizationTest.php b/tests/Feature/Authorization/TeamAuthorizationTest.php index 0637a48db5..7d437c823f 100644 --- a/tests/Feature/Authorization/TeamAuthorizationTest.php +++ b/tests/Feature/Authorization/TeamAuthorizationTest.php @@ -171,17 +171,34 @@ test('team index mounts when is_mcp_server_enabled is null on the session team', // --- Team Danger Zone Livewire: delete --- -test('member cannot delete team via danger zone', function () { +test('member cannot open the team danger zone', function () { $this->actingAs($this->member); session(['currentTeam' => $this->team]); - Livewire::test(DangerZone::class) - ->call('delete') - ->assertDispatched('error'); + Livewire::test(DangerZone::class)->assertForbidden(); expect(Team::find($this->team->id))->not->toBeNull(); }); +test('owner can open the team danger zone', function () { + $this->actingAs($this->owner); + session(['currentTeam' => $this->team]); + + Livewire::test(DangerZone::class)->assertSuccessful(); +}); + +test('team settings show the danger zone link only to the team owner', function () { + session(['currentTeam' => $this->team]); + + $this->actingAs($this->owner); + Livewire::test(TeamIndex::class)->assertSee('Danger Zone'); + + foreach ([$this->admin, $this->member] as $user) { + $this->actingAs($user); + Livewire::test(TeamIndex::class)->assertDontSee('Danger Zone'); + } +}); + test('admin cannot delete team via policy', function () { $this->actingAs($this->admin); session(['currentTeam' => $this->team]);