fix(audit): return 403 on the audit log without a session team

When the user had no session team (for example after removal from the
team), the audit log page threw an error and returned 500.

- Return 403 when there is no session team or the user is not an admin

app/Livewire/Team/AuditLog.php

@@ -22,7 +22,9 @@ class AuditLog extends Component
 
     public function boot(): void
     {
-        abort_unless(auth()->user()->isAdminOfTeam(currentTeam()->id), 403);
+        $team = currentTeam();
+
+        abort_unless($team && auth()->user()->isAdminOfTeam($team->id), 403);
     }
 
     public function updatedSearch(): void

tests/Feature/TeamAuditLogWithoutSessionTeamTest.php

@@ -0,0 +1,48 @@
+<?php
+
+use App\Livewire\Team\AuditLog;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->secondTeam = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'admin']);
+    $this->secondTeam->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+test('the audit log is forbidden when the session has no team', function () {
+    session()->forget('currentTeam');
+
+    Livewire::test(AuditLog::class)->assertForbidden();
+});
+
+test('an open audit log is forbidden after the session team is removed from the user', function () {
+    $component = Livewire::test(AuditLog::class)->assertOk();
+
+    $this->team->members()->detach($this->user->id);
+    auth()->setUser($this->user->fresh());
+
+    $component->set('search', 'deployment')->assertForbidden();
+});
+
+test('team admins can still open the audit log', function () {
+    Livewire::test(AuditLog::class)->assertOk();
+});
+
+test('team members cannot open the audit log', function () {
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    auth()->setUser($this->user->fresh());
+
+    Livewire::test(AuditLog::class)->assertForbidden();
+});