What: test_only_team_owner_can_remove_team_members asserts only $response->assertStatus(403) — it never confirms $otherUser is still attached to the team afterward.
Where: tests/Feature/RemoveTeamMemberTest.php:27-41
Why it matters: The sibling UpdateTeamMemberRoleTest::test_only_team_owner_can_update_team_member_roles (tests/Feature/UpdateTeamMemberRoleTest.php:34-51) follows the exact same 403-status pattern but correctly adds a follow-up assertion that the role wasn't actually changed (assertTrue($otherUser->fresh()->hasTeamRole(...))). RemoveTeamMemberTest has no equivalent for removal. A bug where the authorization check runs after a partial or side-effecting detach (e.g. a future refactor that reorders the policy check relative to the delete) would still return 403 and this test would keep passing while the member was actually removed.
Suggested fix: Add a membership assertion after the 403 check, e.g. $this->assertCount(1, $user->currentTeam->fresh()->users);, mirroring UpdateTeamMemberRoleTest.
What:
test_only_team_owner_can_remove_team_membersasserts only$response->assertStatus(403)— it never confirms$otherUseris still attached to the team afterward.Where:
tests/Feature/RemoveTeamMemberTest.php:27-41Why it matters: The sibling
UpdateTeamMemberRoleTest::test_only_team_owner_can_update_team_member_roles(tests/Feature/UpdateTeamMemberRoleTest.php:34-51) follows the exact same 403-status pattern but correctly adds a follow-up assertion that the role wasn't actually changed (assertTrue($otherUser->fresh()->hasTeamRole(...))).RemoveTeamMemberTesthas no equivalent for removal. A bug where the authorization check runs after a partial or side-effecting detach (e.g. a future refactor that reorders the policy check relative to the delete) would still return 403 and this test would keep passing while the member was actually removed.Suggested fix: Add a membership assertion after the 403 check, e.g.
$this->assertCount(1, $user->currentTeam->fresh()->users);, mirroringUpdateTeamMemberRoleTest.