+ Only team owners can delete this team.
+
+ @elseif (session('currentTeam.id') === 0)
The default team cannot be deleted.
@@ -49,6 +53,7 @@
@if (
session('currentTeam.id') !== 0 &&
+ auth()->user()->roleInTeam(currentTeam()->id) === 'owner' &&
auth()->user()->teams()->count() > 1 &&
!auth()->user()->currentTeam()->personal_team &&
!currentTeam()->subscription &&
@@ -69,27 +74,51 @@
- @if (session('currentTeam.id') !== 0 && !currentTeam()->subscription && !currentTeam()->isEmpty())
-
- @foreach ([
- 'Projects' => currentTeam()->projects,
- 'Servers' => currentTeam()->servers,
- 'Private keys' => currentTeam()->privateKeys,
- 'Sources' => currentTeam()->sources(),
- ] as $label => $resources)
- @if ($resources->isNotEmpty())
-
-
- {{ $label }}
-
-
- @foreach ($resources as $resource)
- - {{ $resource->name }}
- @endforeach
-
-
- @endif
- @endforeach
+ @if (session('currentTeam.id') !== 0 && !currentTeam()->subscription && (currentTeam()->projects->isNotEmpty() || currentTeam()->servers->isNotEmpty()))
+
+
+
Resources
+
+
+ Refresh
+
+
+
+
+
+ | Resource |
+ Name |
+
+
+
+ @foreach (currentTeam()->projects as $project)
+
+ |
+ Project
+ |
+
+ {{ $project->name }}
+ |
+
+ @endforeach
+ @foreach (currentTeam()->servers as $server)
+
+ |
+ Server
+ |
+
+ {{ $server->name }}
+ |
+
+ @endforeach
+
+
@endif
diff --git a/tests/Feature/Authorization/TeamAuthorizationTest.php b/tests/Feature/Authorization/TeamAuthorizationTest.php
index 63d5d3d264..eaae106ef3 100644
--- a/tests/Feature/Authorization/TeamAuthorizationTest.php
+++ b/tests/Feature/Authorization/TeamAuthorizationTest.php
@@ -1,5 +1,6 @@
user()->can('delete', $this->team))->toBeTrue();
});
-test('admin can delete team', function () {
+test('admin cannot delete team', function () {
$this->actingAs($this->admin);
session(['currentTeam' => $this->team]);
- expect(auth()->user()->can('delete', $this->team))->toBeTrue();
+ expect(auth()->user()->can('delete', $this->team))->toBeFalse();
});
test('member cannot delete team', function () {
@@ -156,24 +157,24 @@ test('team index mounts when is_mcp_server_enabled is null on the session team',
->assertSet('is_mcp_server_enabled', true);
});
-// --- Team Index Livewire: delete ---
+// --- Team Danger Zone Livewire: delete ---
-test('member cannot delete team via index', function () {
+test('member cannot delete team via danger zone', function () {
$this->actingAs($this->member);
session(['currentTeam' => $this->team]);
- Livewire::test(TeamIndex::class)
- ->call('delete', 'password')
+ Livewire::test(DangerZone::class)
+ ->call('delete')
->assertDispatched('error');
expect(Team::find($this->team->id))->not->toBeNull();
});
-test('admin can delete team via policy', function () {
+test('admin cannot delete team via policy', function () {
$this->actingAs($this->admin);
session(['currentTeam' => $this->team]);
- expect(auth()->user()->can('delete', $this->team))->toBeTrue();
+ expect(auth()->user()->can('delete', $this->team))->toBeFalse();
});
// --- Team Member Livewire: role changes ---
diff --git a/tests/Feature/Team/TeamDeletionTest.php b/tests/Feature/Team/TeamDeletionTest.php
index 6bdcaf4e8a..1c11d13802 100644
--- a/tests/Feature/Team/TeamDeletionTest.php
+++ b/tests/Feature/Team/TeamDeletionTest.php
@@ -1,11 +1,19 @@
and($sessionTeam->id)->toBe($this->personalTeam->id);
});
+test('the danger zone resource list can be refreshed', function () {
+ $this->actingAs($this->owner);
+ session(['currentTeam' => $this->teamToDelete]);
+
+ Livewire::test(DangerZone::class)
+ ->call('refreshResources')
+ ->assertSuccessful();
+});
+
+test('a team with a running application cannot be deleted', function () {
+ $server = Server::factory()->create(['team_id' => $this->teamToDelete->id]);
+ $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+ $project = Project::factory()->create(['team_id' => $this->teamToDelete->id]);
+ $environment = Environment::factory()->create(['project_id' => $project->id]);
+ Application::factory()->create([
+ 'environment_id' => $environment->id,
+ 'destination_id' => $destination->id,
+ 'destination_type' => $destination->getMorphClass(),
+ 'status' => 'running:healthy',
+ ]);
+
+ $this->actingAs($this->owner);
+ session(['currentTeam' => $this->teamToDelete]);
+
+ Livewire::test(DangerZone::class)
+ ->call('delete')
+ ->assertDispatched('error');
+
+ expect(Team::find($this->teamToDelete->id))->not->toBeNull();
+});
+
+test('a team with a server cannot be deleted', function () {
+ Server::factory()->create(['team_id' => $this->teamToDelete->id]);
+
+ $this->actingAs($this->owner);
+ session(['currentTeam' => $this->teamToDelete]);
+
+ Livewire::test(DangerZone::class)
+ ->call('delete')
+ ->assertDispatched('error', fn (string $event, array $params): bool => $params[0] === 'Delete all team servers before deleting this team.');
+
+ expect(Team::find($this->teamToDelete->id))->not->toBeNull();
+});
+
+test('a team with a project but no servers cannot be deleted', function () {
+ Project::factory()->create(['team_id' => $this->teamToDelete->id]);
+
+ $member = User::factory()->create();
+ $this->teamToDelete->members()->attach($member->id, ['role' => 'member']);
+ $privateKey = PrivateKey::factory()->create(['team_id' => $this->teamToDelete->id]);
+
+ $this->actingAs($this->owner);
+ session(['currentTeam' => $this->teamToDelete]);
+
+ Livewire::test(DangerZone::class)
+ ->call('delete')
+ ->assertDispatched('error', fn (string $event, array $params): bool => $params[0] === 'Delete all team resources before deleting this team.');
+
+ expect(Team::find($this->teamToDelete->id))->not->toBeNull()
+ ->and(PrivateKey::find($privateKey->id))->not->toBeNull()
+ ->and($this->teamToDelete->members()->whereKey($member->id)->exists())->toBeTrue();
+});
+
+test('an admin cannot delete a team through the deletion action', function () {
+ $admin = User::factory()->create();
+ $this->teamToDelete->members()->attach($admin->id, ['role' => 'admin']);
+
+ expect(fn () => app(DeleteTeam::class)->handle($this->teamToDelete, $admin))
+ ->toThrow(AuthorizationException::class);
+
+ expect(Team::find($this->teamToDelete->id))->not->toBeNull();
+});
+
+test('a stale owner relationship cannot authorize team deletion', function () {
+ $this->owner->teams;
+ $this->owner->teams()->updateExistingPivot($this->teamToDelete->id, ['role' => 'admin']);
+
+ expect(fn () => app(DeleteTeam::class)->handle($this->teamToDelete, $this->owner))
+ ->toThrow(AuthorizationException::class);
+
+ expect(Team::find($this->teamToDelete->id))->not->toBeNull();
+});
+
test('refreshSession clears session when no team exists', function () {
$user = User::factory()->create();
// Detach all teams so user has none
@@ -78,3 +169,20 @@ test('deleting a team deletes github and gitlab sources with the same primary ke
expect(GithubApp::find($githubApp->id))->toBeNull()
->and(GitlabApp::find($gitlabApp->id))->toBeNull();
});
+
+test('team deletion rolls back all database changes when an operation fails', function () {
+ $member = User::factory()->create();
+ $this->teamToDelete->members()->attach($member->id, ['role' => 'member']);
+
+ Team::deleting(function (Team $deletingTeam): void {
+ if ($deletingTeam->id === $this->teamToDelete->id) {
+ throw new RuntimeException('Simulated deletion failure.');
+ }
+ });
+
+ expect(fn () => app(DeleteTeam::class)->handle($this->teamToDelete, $this->owner))
+ ->toThrow(RuntimeException::class, 'Simulated deletion failure.');
+
+ expect(Team::find($this->teamToDelete->id))->not->toBeNull()
+ ->and($this->teamToDelete->members()->whereKey($member->id)->exists())->toBeTrue();
+});
diff --git a/tests/Feature/TeamCreateSetsMcpDefaultTest.php b/tests/Feature/TeamCreateSetsMcpDefaultTest.php
index 6f6c99c49e..b816c0609d 100644
--- a/tests/Feature/TeamCreateSetsMcpDefaultTest.php
+++ b/tests/Feature/TeamCreateSetsMcpDefaultTest.php
@@ -33,5 +33,6 @@ test('creating a team sets is_mcp_server_enabled to true on the model', function
$created = Team::query()->where('name', 'MCP Safe Team')->first();
expect($created)->not->toBeNull()
- ->and($created->is_mcp_server_enabled)->toBeTrue();
+ ->and($created->is_mcp_server_enabled)->toBeTrue()
+ ->and($this->user->fresh()->roleInTeam($created->id))->toBe('owner');
});
diff --git a/tests/Feature/TeamOwnerBackfillMigrationTest.php b/tests/Feature/TeamOwnerBackfillMigrationTest.php
new file mode 100644
index 0000000000..88e0a7e919
--- /dev/null
+++ b/tests/Feature/TeamOwnerBackfillMigrationTest.php
@@ -0,0 +1,42 @@
+create(['personal_team' => false]);
+ $firstMember = User::factory()->create();
+ $firstAdmin = User::factory()->create();
+ $teamWithoutOwner->members()->attach($firstMember, [
+ 'role' => 'member',
+ 'created_at' => now()->subMinute(),
+ 'updated_at' => now()->subMinute(),
+ ]);
+ $teamWithoutOwner->members()->attach($firstAdmin, [
+ 'role' => 'admin',
+ 'created_at' => now(),
+ 'updated_at' => now(),
+ ]);
+
+ $teamWithoutAdmin = Team::factory()->create(['personal_team' => false]);
+ $fallbackMember = User::factory()->create();
+ $teamWithoutAdmin->members()->attach($fallbackMember, ['role' => 'member']);
+
+ $teamWithOwner = Team::factory()->create(['personal_team' => false]);
+ $existingOwner = User::factory()->create();
+ $existingAdmin = User::factory()->create();
+ $teamWithOwner->members()->attach($existingOwner, ['role' => 'owner']);
+ $teamWithOwner->members()->attach($existingAdmin, ['role' => 'admin']);
+
+ $migration = require database_path('migrations/2026_08_20_070831_promote_first_team_member_when_team_has_no_owner.php');
+ $migration->up();
+
+ expect($teamWithoutOwner->members()->find($firstMember->id)->pivot->role)->toBe('member')
+ ->and($teamWithoutOwner->members()->find($firstAdmin->id)->pivot->role)->toBe('owner')
+ ->and($teamWithoutAdmin->members()->find($fallbackMember->id)->pivot->role)->toBe('owner')
+ ->and($teamWithOwner->members()->find($existingOwner->id)->pivot->role)->toBe('owner')
+ ->and($teamWithOwner->members()->find($existingAdmin->id)->pivot->role)->toBe('admin');
+});
diff --git a/tests/Feature/TeamSettingsNavigationTest.php b/tests/Feature/TeamSettingsNavigationTest.php
index d6b6f72cf2..da959b9d18 100644
--- a/tests/Feature/TeamSettingsNavigationTest.php
+++ b/tests/Feature/TeamSettingsNavigationTest.php
@@ -29,8 +29,15 @@ it('uses shared sidebar navigation for every team settings page', function () {
->toContain('Delete team')
->toContain('status="Permanent"')
->toContain('border-red-300')
- ->toContain("'Sources' => currentTeam()->sources()")
- ->not->toContain("'Sources' => currentTeam()->sources,");
+ ->toContain('
')
+ ->toContain('wire:click="refreshResources"')
+ ->not->toContain('wire:loading.class="animate-spin"')
+ ->toContain("route('project.show', ['project_uuid' => \$project->uuid])")
+ ->toContain("route('server.show', ['server_uuid' => \$server->uuid])")
+ ->toContain('target="_blank" rel="noopener noreferrer"')
+ ->toContain('Delete every server owned by this team before deleting it.')
+ ->toContain('currentTeam()->servers->isEmpty()')
+ ->not->toContain('currentTeam()->isEmpty()');
expect(file_get_contents(resource_path('views/livewire/switch-team.blade.php')))
->toContain('New team')
->toContain('team-switcher-create-expanded')
diff --git a/tests/Unit/Policies/TeamPolicyTest.php b/tests/Unit/Policies/TeamPolicyTest.php
index 3b341d4888..9da59d767c 100644
--- a/tests/Unit/Policies/TeamPolicyTest.php
+++ b/tests/Unit/Policies/TeamPolicyTest.php
@@ -56,7 +56,6 @@ it('allows target team admins to perform privileged team actions', function (str
expect((new TeamPolicy)->{$ability}($user, $team))->toBeTrue();
})->with([
'update',
- 'delete',
'manageMembers',
'viewAdmin',
'manageInvitations',
@@ -72,7 +71,6 @@ it('denies target team members even when their current session role is admin els
expect((new TeamPolicy)->{$ability}($user, $team))->toBeFalse();
})->with([
'update',
- 'delete',
'manageMembers',
'viewAdmin',
'manageInvitations',
@@ -90,3 +88,15 @@ it('denies non-members from privileged team actions', function (string $ability)
'viewAdmin',
'manageInvitations',
]);
+
+it('only allows target team owners to delete the team', function (string $role, bool $allowed) {
+ $user = teamPolicyUserWithTeams([1]);
+ $user->shouldReceive('roleInTeam')->with(1)->andReturn($role);
+ $team = teamPolicyTeam(1);
+
+ expect((new TeamPolicy)->delete($user, $team))->toBe($allowed);
+})->with([
+ 'owner' => ['owner', true],
+ 'admin' => ['admin', false],
+ 'member' => ['member', false],
+]);