fix(team): show the team danger zone only to the team owner

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Livewire/Team/DangerZone.php

@@ -16,6 +16,7 @@ class DangerZone extends Component
     public function mount(): void
     {
         $this->team = currentTeam();
+        $this->authorize('delete', $this->team);
     }
 
     public function delete(): mixed

resources/views/components/team/settings-layout.blade.php

@@ -24,13 +24,13 @@
             'active' => request()->routeIs('team.admin-view'),
             'icon' => 'admin',
         ] : null,
-        [
+        auth()->user()->can('delete', currentTeam()) ? [
             'label' => 'Danger Zone',
             'route' => 'team.danger-zone',
             'active' => request()->routeIs('team.danger-zone'),
             'icon' => 'shield-alert',
             'sectionStart' => true,
-        ],
+        ] : null,
     ])->filter();
 @endphp
 

tests/Feature/Authorization/TeamAuthorizationTest.php

@@ -171,17 +171,34 @@ test('team index mounts when is_mcp_server_enabled is null on the session team',
 
 // --- Team Danger Zone Livewire: delete ---
 
-test('member cannot delete team via danger zone', function () {
+test('member cannot open the team danger zone', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(DangerZone::class)
+    Livewire::test(DangerZone::class)->assertForbidden();
-        ->call('delete')
-        ->assertDispatched('error');
 
     expect(Team::find($this->team->id))->not->toBeNull();
 });
 
+test('owner can open the team danger zone', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(DangerZone::class)->assertSuccessful();
+});
+
+test('team settings show the danger zone link only to the team owner', function () {
+    session(['currentTeam' => $this->team]);
+
+    $this->actingAs($this->owner);
+    Livewire::test(TeamIndex::class)->assertSee('Danger Zone');
+
+    foreach ([$this->admin, $this->member] as $user) {
+        $this->actingAs($user);
+        Livewire::test(TeamIndex::class)->assertDontSee('Danger Zone');
+    }
+});
+
 test('admin cannot delete team via policy', function () {
     $this->actingAs($this->admin);
     session(['currentTeam' => $this->team]);