add staff remove & staff invite test

app/Http/Controllers/EventController.php

@@ -110,7 +110,17 @@ class EventController extends Controller
 
         $this->authorize('delete', $event);
 
-        $event->guests()->updateExistingPivot($user, array('is_staff' => 1), false);
+        $event->guests()->updateExistingPivot($user, ['is_staff' => true], false);
+
+        return (new EventResource($event))
+            ->response()
+            ->setStatusCode(200);
+    }
+
+    public function deleteGuestToStaffEvent(Event $event, User $user) {
+        $this->authorize('delete', $event);
+
+        $event->guests()->updateExistingPivot($user, ['is_staff' => false], false);
 
         return (new EventResource($event))
             ->response()

app/Http/Resources/User.php

@@ -28,7 +28,7 @@ class User extends JsonResource
                     'last_login' => optional($this->login_at)->diffForHumans(),
                     'is_admin' => $this->isAdmin(),
                     'is_staff' => $this->whenPivotLoaded('event_guest', function() {
-                        return $this->pivot->is_staff;
+                        return (int) $this->pivot->is_staff;
                     }),
                 ],
             ],

app/Models/User.php

@@ -115,7 +115,7 @@ class User extends Authenticatable
 
     public function invitedEvent(): BelongsToMany
     {
-        return $this->belongsToMany(Event::class, 'event_guest')
+        return $this->belongsToMany(Event::class, 'event_guest', 'user_id', 'event_id')
             ->withPivot('is_staff', 'validated_at')
             ->withTimestamps();
     }

app/Policies/EventPolicy.php

@@ -53,7 +53,15 @@ class EventPolicy
      */
     public function update(User $user, Event $event)
     {
-        return $user->id == $event->user_id;
+        if($user->id == $event->user_id) {
+            return true;
+        } else {
+            $testedUser = $event->guests()->where('users.id', $user->id)->first();
+            if($testedUser !== null) {
+                return $testedUser->pivot->is_staff;
+            }
+        }
+        return false;
     }
 
     /**

routes/api.php

@@ -20,9 +20,10 @@ Route::middleware('auth:api')->group(function () {
 
     Route::get('/memos/home', 'MemosController@home');
 
-    Route::get('/events/{event}/invite/{user}', 'EventController@inviteUser');
+    Route::post('/events/{event}/invite/{user}', 'EventController@inviteUser');
     Route::delete('/events/{event}/invite/{user}', 'EventController@removeInviteUser');
-    Route::get('/events/{event}/staff/{user}', 'EventController@addGuestToStaffEvent');
+    Route::post('/events/{event}/staff/{user}', 'EventController@addGuestToStaffEvent');
+    Route::delete('/events/{event}/staff/{user}', 'EventController@deleteGuestToStaffEvent');
 
     Route::apiResources([
         '/users' => 'UserController',

tests/Feature/EventsTest.php

@@ -346,7 +346,7 @@ class EventsTest extends TestCase
     }
 
     /** @test */
-    public function only_the_owner_can_patch_the_event()
+    public function only_the_owner_or_staff_can_patch_the_event()
     {
         $user = factory(User::class)->create();
         $event = factory(Event::class)->create(['id' => 123, 'user_id' => $user->id]);
@@ -394,7 +394,7 @@ class EventsTest extends TestCase
         $event = factory(Event::class)->create(['user_id' => $user->id]);
         $userTwo = factory(User::class)->create();
 
-        $response = $this->get('api/events/'.$event->id.'/invite/'.$userTwo->id);
+        $response = $this->post('api/events/'.$event->id.'/invite/'.$userTwo->id);
         $response->assertStatus(200);
         $response->assertJson([
             'data' => [
@@ -441,7 +441,7 @@ class EventsTest extends TestCase
         $userTwo = factory(User::class)->create();
         $event->guests()->attach($userTwo);
 
-        $response = $this->get('api/events/'.$event->id.'/staff/'.$userTwo->id);
+        $response = $this->post('api/events/'.$event->id.'/staff/'.$userTwo->id);
         $response->assertStatus(200);
         $response->assertJson([
             'data' => [
@@ -468,9 +468,90 @@ class EventsTest extends TestCase
         ]);
     }
 
-    // owner_can_remove_guest_to_staff_event
+    /** @test */
+    public function owner_can_remove_guest_to_staff_event()
+    {
+        $this->withoutExceptionHandling();
+        $this->actingAs($user = factory(User::class)->create(), 'api');
+        $event = factory(Event::class)->create(['user_id' => $user->id]);
+        $userTwo = factory(User::class)->create();
+        $event->guests()->attach($userTwo);
 
-    // staff_can_add_guest
+        $response = $this->delete('api/events/'.$event->id.'/staff/'.$userTwo->id);
+        $response->assertStatus(200);
+        $response->assertJson([
+            'data' => [
+                'event_id' => $event->id,
+                'attributes' => [
+                    'data' => [
+                        'invitations' => [
+                            [
+                                'data' => [
+                                    'user_id' => $userTwo->id,
+                                    'attributes' => [
+                                        'is_staff' => false,
+                                    ]
+
+                                ],
+                                'links' => [
+                                    'self' => url('/users/'.$userTwo->id),
+                                ],
+                            ]
+                        ],
+                    ]
+                ]
+            ]
+        ]);
+    }
+
+    /** @test */
+    public function staff_can_add_guest()
+    {
+        $this->withoutExceptionHandling();
+        $user = factory(User::class)->create();
+        $event = factory(Event::class)->create(['user_id' => $user->id]);
+        $this->actingAs($userTwo = factory(User::class)->create(), 'api');
+        $event->guests()->attach($userTwo);
+        $event->guests()->updateExistingPivot($userTwo, ['is_staff' => true], false);
+
+        $nexGuestUser = factory(User::class)->create();
+
+        $response = $this->post('api/events/'.$event->id.'/invite/'.$nexGuestUser->id);
+
+        $event = $event->fresh();
+
+        $response->assertStatus(200);
+        $this->assertCount(2, $event->guests);
+        $response->assertJson([
+            'data' => [
+                'event_id' => $event->id,
+                'attributes' => [
+                    'data' => [
+                        'invitations' => [
+                            [
+                                'data' => [
+                                    'user_id' => $userTwo->id,
+                                    'attributes' => [
+                                        'is_staff' => 1,
+                                    ]
+                                ],
+                            ],
+                            [
+                                'data' => [
+                                    'user_id' => $nexGuestUser->id,
+                                    'attributes' => [
+                                        'is_staff' => 0,
+                                    ]
+                                ]
+                            ]
+                        ],
+                    ]
+                ]
+            ]
+        ]);
+    }
+
+    // guest_can_invite_another_guest_if_public_event
 
     // guest_can_validate_event_participation