From dc70eb7130ce98aced704bc6052ea41e3fbab874 Mon Sep 17 00:00:00 2001
From: Constantin Graf <constantin@solidtime.io>
Date: Fri, 22 May 2026 16:06:51 +0200
Subject: [PATCH] Add more tests

---
 .../Unit/Endpoint/Api/V1/UserEndpointTest.php | 16 +++++++++++++
 .../OrganizationInvitationEndpointTest.php    | 23 +++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php b/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php
index ec36b38d..b2bb6404 100644
--- a/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php
+++ b/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php
@@ -240,6 +240,22 @@ class UserEndpointTest extends ApiEndpointTestAbstract
         $response->assertJsonValidationErrors(['name']);
     }
 
+    public function test_update_fails_if_given_user_is_not_the_authenticated_user(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        $otherData = $this->createUserWithPermission();
+        Passport::actingAs($otherData->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'name' => 'Updated Name',
+        ]);
+
+        // Assert
+        $response->assertForbidden();
+    }
+
     public function test_update_fails_if_name_is_too_long(): void
     {
         // Arrange
diff --git a/tests/Unit/Endpoint/Web/OrganizationInvitationEndpointTest.php b/tests/Unit/Endpoint/Web/OrganizationInvitationEndpointTest.php
index c67bd55b..87de0a00 100644
--- a/tests/Unit/Endpoint/Web/OrganizationInvitationEndpointTest.php
+++ b/tests/Unit/Endpoint/Web/OrganizationInvitationEndpointTest.php
@@ -251,4 +251,27 @@ class OrganizationInvitationEndpointTest extends EndpointTestAbstract
         // Assert
         $response->assertForbidden();
     }
+
+    public function test_fails_if_invitation_has_owner_role(): void
+    {
+        // Arrange
+        $user = $this->createUserWithPermission();
+        $invitation = OrganizationInvitation::factory()
+            ->forOrganization($user->organization)
+            ->create([
+                'role' => Role::Owner->value,
+            ]);
+
+        // Act
+        $acceptUrl = URL::to(URL::temporarySignedRoute(
+            'organization-invitations.accept',
+            now()->addMinutes(60),
+            [$invitation->getKey()],
+            false
+        ));
+        $response = $this->get($acceptUrl);
+
+        // Assert
+        $response->assertStatus(500);
+    }
 }