Fix API Teams non-member 404, signed invitation accept, factory cleanup

Make TeamMemberController@destroy 404 when the targeted user has no
membership instead of silently returning 204. Move invitation accept
to GET /invitations/{invitation}/accept under signed middleware with
a 3-day TTL, validate state inline, and resolve the user by
case-insensitive email match. Add a kit-local TeamInvitation
notification override that emits the signed URL via
URL::temporarySignedRoute, leaving Inertia/Livewire variants on the
original GET link. Drop the manual Str::slug build in UserFactory's
afterCreating block to match the Fortify and WorkOS variant
convention.

Author: WendellAdriel

kits/API/Teams/app/Http/Controllers/Teams/AcceptTeamInvitationController.php

@@ -3,24 +3,37 @@
 namespace App\Http\Controllers\Teams;
 
 use App\Http\Controllers\Controller;
-use App\Http\Requests\Teams\AcceptTeamInvitationRequest;
 use App\Models\TeamInvitation;
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use Illuminate\Support\Facades\DB;
-use Knuckles\Scribe\Attributes\Authenticated;
+use Illuminate\Validation\ValidationException;
 use Knuckles\Scribe\Attributes\Endpoint;
 use Knuckles\Scribe\Attributes\Group;
 use Knuckles\Scribe\Attributes\Response as ScribeResponse;
 
 #[Group('Team Invitations')]
-#[Authenticated]
 class AcceptTeamInvitationController extends Controller
 {
-    #[Endpoint('Accept an invitation', 'Accept a team invitation as the authenticated user.')]
-    #[ScribeResponse(status: Response::HTTP_NO_CONTENT, description: 'No Content')]
-    public function __invoke(AcceptTeamInvitationRequest $request, TeamInvitation $invitation): Response
+    #[Endpoint('Accept an invitation', 'Accept a team invitation using the signed link delivered to the invitee by email. The link must be valid, unexpired, and resolve to an existing user account.')]
+    #[ScribeResponse(['message' => 'Invitation accepted successfully.'], description: 'Invitation accepted')]
+    #[ScribeResponse(status: Response::HTTP_FORBIDDEN, description: 'Invalid signature or no matching user.')]
+    #[ScribeResponse(status: Response::HTTP_UNPROCESSABLE_ENTITY, description: 'Invitation already accepted or expired.')]
+    public function __invoke(Request $request, TeamInvitation $invitation): JsonResponse
     {
-        $user = $request->user();
+        if ($invitation->isAccepted() || $invitation->isExpired()) {
+            throw ValidationException::withMessages([
+                'invitation' => __('This invitation is no longer valid.'),
+            ]);
+        }
+
+        $user = User::query()
+            ->whereRaw('LOWER(email) = ?', [strtolower($invitation->email)])
+            ->first();
+
+        abort_if($user === null, Response::HTTP_FORBIDDEN);
 
         DB::transaction(function () use ($user, $invitation) {
             $invitation->team->memberships()->firstOrCreate(
@@ -31,6 +44,6 @@ public function __invoke(AcceptTeamInvitationRequest $request, TeamInvitation $i
             $invitation->update(['accepted_at' => now()]);
         });
 
-        return response()->noContent();
+        return response()->json(['message' => __('Invitation accepted successfully.')]);
     }
 }

kits/API/Teams/app/Http/Controllers/Teams/TeamMemberController.php

@@ -43,6 +43,7 @@ public function update(UpdateTeamMemberRequest $request, Team $team, User $user)
 
     #[Endpoint('Remove a member', 'Remove a member from the team. The team owner cannot be removed.')]
     #[ScribeResponse(status: Response::HTTP_NO_CONTENT, description: 'No Content')]
+    #[ScribeResponse(status: Response::HTTP_NOT_FOUND, description: 'The user is not a member of the team.')]
     public function destroy(Team $team, User $user): Response
     {
         Gate::authorize('removeMember', $team);
@@ -51,6 +52,7 @@ public function destroy(Team $team, User $user): Response
 
         $team->memberships()
             ->where('user_id', $user->id)
+            ->firstOrFail()
             ->delete();
 
         return response()->noContent();

kits/API/Teams/app/Notifications/Teams/TeamInvitation.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Notifications\Teams;
+
+use App\Models\TeamInvitation as TeamInvitationModel;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+use Illuminate\Support\Facades\URL;
+
+class TeamInvitation extends Notification implements ShouldQueue
+{
+    use Queueable;
+
+    /**
+     * Create a new notification instance.
+     */
+    public function __construct(public TeamInvitationModel $invitation)
+    {
+        //
+    }
+
+    /**
+     * Get the notification's delivery channels.
+     *
+     * @return array<int, string>
+     */
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    /**
+     * Get the mail representation of the notification.
+     */
+    public function toMail(object $notifiable): MailMessage
+    {
+        $team = $this->invitation->team;
+        $inviter = $this->invitation->inviter;
+
+        return (new MailMessage)
+            ->subject(__("You've been invited to join :teamName", ['teamName' => $team->name]))
+            ->line(__(':inviterName has invited you to join the :teamName team.', [
+                'inviterName' => $inviter->name,
+                'teamName' => $team->name,
+            ]))
+            ->action(__('Accept invitation'), URL::temporarySignedRoute(
+                'invitations.accept',
+                now()->addDays(3),
+                $this->invitation,
+            ));
+    }
+
+    /**
+     * Get the array representation of the notification.
+     *
+     * @return array<string, mixed>
+     */
+    public function toArray(object $notifiable): array
+    {
+        return [
+            'invitation_id' => $this->invitation->id,
+            'team_id' => $this->invitation->team_id,
+            'team_name' => $this->invitation->team->name,
+            'role' => $this->invitation->role->value,
+        ];
+    }
+}

kits/API/Teams/database/factories/UserFactory.php

@@ -41,11 +41,8 @@ public function definition(): array
     public function configure(): static
     {
         return $this->afterCreating(function (User $user) {
-            $name = $user->name."'s Team";
-
             $team = Team::factory()->personal()->create([
-                'name' => $name,
-                'slug' => Str::slug($name),
+                'name' => $user->name."'s Team",
             ]);
 
             $team->members()->attach($user, [

kits/API/Teams/routes/teams.php

@@ -7,10 +7,11 @@
 use App\Http\Middleware\EnsureTeamMembership;
 use Illuminate\Support\Facades\Route;
 
-Route::middleware('auth:sanctum')->group(function () {
-    Route::post('invitations/{invitation}/accept', AcceptTeamInvitationController::class)
-        ->name('invitations.accept');
+Route::get('invitations/{invitation}/accept', AcceptTeamInvitationController::class)
+    ->middleware('signed')
+    ->name('invitations.accept');
 
+Route::middleware('auth:sanctum')->group(function () {
     Route::middleware('verified')->group(function () {
         Route::get('teams', [TeamController::class, 'index'])->name('teams.index');
         Route::post('teams', [TeamController::class, 'store'])->name('teams.store');