From 74bd88d3d63ea6de1eb996032666324533034f39 Mon Sep 17 00:00:00 2001
From: Paulo Castellano <paulo@castellanos.llc>
Date: Tue, 19 May 2026 11:45:16 -0300
Subject: [PATCH 1/3] feat(auth): self-hosted registration gate + admin seeder
 (closes #46)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Self-hosted installs (SELF_HOSTED=true, the default) now close /register
to the public. Workspace invites still work — the AcceptInvite page
links into /register with ?invite={id}, the middleware persists that
into the session, and POST /register passes through.

- EnsureRegistrationEnabled middleware gates GET/POST /register.
  Accepts ?invite=… (URL) or pending_invite_id (session) as the pass.
- RegisteredUserController::store clears the marker after signup.
- AcceptInvite.vue passes invite.id in the register link's query string.
- Login.vue hides the "Sign up" link when self_hosted.
- UserSeeder bootstraps a single admin (admin@trypost.it / password).
  Idempotent; not wired into DatabaseSeeder — operator runs
  `php artisan db:seed --class=UserSeeder` per the install docs.
- Tests cover both flag values for every changed surface.

Docs PR: see trypost-docs self-hosting/installation.mdx step 3.
---
 .../Auth/RegisteredUserController.php         |  2 +
 .../App/EnsureRegistrationEnabled.php         | 27 +++++++
 bootstrap/app.php                             |  2 +
 database/seeders/UserSeeder.php               | 36 +++++++++
 resources/js/pages/auth/AcceptInvite.vue      |  2 +-
 resources/js/pages/auth/Login.vue             |  8 +-
 routes/auth.php                               |  6 +-
 tests/Feature/AcceptInviteControllerTest.php  | 24 +++++-
 tests/Feature/Auth/RegistrationTest.php       | 73 +++++++++++++++++++
 tests/Feature/Auth/SignupUtmTrackingTest.php  |  2 +
 tests/Feature/GitHubAuthToggleTest.php        | 15 ++++
 tests/Feature/GoogleAuthToggleTest.php        | 15 ++++
 12 files changed, 206 insertions(+), 6 deletions(-)
 create mode 100644 app/Http/Middleware/App/EnsureRegistrationEnabled.php
 create mode 100644 database/seeders/UserSeeder.php

diff --git a/app/Http/Controllers/Auth/RegisteredUserController.php b/app/Http/Controllers/Auth/RegisteredUserController.php
index b030065a..dd13f0f5 100644
--- a/app/Http/Controllers/Auth/RegisteredUserController.php
+++ b/app/Http/Controllers/Auth/RegisteredUserController.php
@@ -57,6 +57,8 @@ public function store(Request $request): RedirectResponse
 
         Auth::login($user);
 
+        $request->session()->forget('pending_invite_id');
+
         if ($redirect = $request->input('redirect')) {
             if (str_starts_with($redirect, '/') && ! str_starts_with($redirect, '//')) {
                 return redirect($redirect);
diff --git a/app/Http/Middleware/App/EnsureRegistrationEnabled.php b/app/Http/Middleware/App/EnsureRegistrationEnabled.php
new file mode 100644
index 00000000..82d04c4c
--- /dev/null
+++ b/app/Http/Middleware/App/EnsureRegistrationEnabled.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware\App;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+class EnsureRegistrationEnabled
+{
+    public function handle(Request $request, Closure $next): mixed
+    {
+        if (! config('trypost.self_hosted')) {
+            return $next($request);
+        }
+
+        if ($inviteId = $request->query('invite') ?? $request->session()->get('pending_invite_id')) {
+            $request->session()->put('pending_invite_id', $inviteId);
+
+            return $next($request);
+        }
+
+        throw new NotFoundHttpException;
+    }
+}
diff --git a/bootstrap/app.php b/bootstrap/app.php
index 12e6c57c..03691e8c 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Http\Middleware\Api\LoadWorkspaceFromToken;
+use App\Http\Middleware\App\EnsureRegistrationEnabled;
 use App\Http\Middleware\App\HandleInertiaRequests;
 use App\Http\Middleware\App\SetLocale;
 use Illuminate\Foundation\Application;
@@ -32,6 +33,7 @@
 
         $middleware->alias([
             'workspace.token' => LoadWorkspaceFromToken::class,
+            'registration.enabled' => EnsureRegistrationEnabled::class,
         ]);
 
         $middleware->preventRequestForgery(except: [
diff --git a/database/seeders/UserSeeder.php b/database/seeders/UserSeeder.php
new file mode 100644
index 00000000..a3a28b5d
--- /dev/null
+++ b/database/seeders/UserSeeder.php
@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Database\Seeders;
+
+use App\Actions\User\CreateUser;
+use App\Actions\Workspace\CreateWorkspace;
+use App\Models\User;
+use Illuminate\Database\Seeder;
+
+class UserSeeder extends Seeder
+{
+    public function run(): void
+    {
+        if (User::query()->exists()) {
+            $this->command->info('UserSeeder: a user already exists, skipping.');
+
+            return;
+        }
+
+        $user = CreateUser::execute([
+            'name' => 'Admin',
+            'email' => 'admin@trypost.it',
+            'password' => 'password',
+            'email_verified_at' => now(),
+            'timezone' => 'UTC',
+        ]);
+
+        CreateWorkspace::execute($user, ['name' => 'My Workspace']);
+
+        $this->command->info('Admin account created — change the password on first login:');
+        $this->command->line('  email:    admin@trypost.it');
+        $this->command->line('  password: password');
+    }
+}
diff --git a/resources/js/pages/auth/AcceptInvite.vue b/resources/js/pages/auth/AcceptInvite.vue
index 278ee462..d168ef32 100644
--- a/resources/js/pages/auth/AcceptInvite.vue
+++ b/resources/js/pages/auth/AcceptInvite.vue
@@ -96,7 +96,7 @@ const inviteUrl = computed(() => `/invites/${props.invite.id}`);
                                 </Link>
                             </Button>
                             <Button as-child variant="outline" size="lg" class="w-full">
-                                <Link :href="register({ query: { redirect: inviteUrl, email: invite.email } })">
+                                <Link :href="register({ query: { redirect: inviteUrl, email: invite.email, invite: invite.id } })">
                                     {{ $t('auth.accept_invite.create_account') }}
                                 </Link>
                             </Button>
diff --git a/resources/js/pages/auth/Login.vue b/resources/js/pages/auth/Login.vue
index 6a3376f7..3b25e1d9 100644
--- a/resources/js/pages/auth/Login.vue
+++ b/resources/js/pages/auth/Login.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
-import { Form, Head } from '@inertiajs/vue3';
+import { Form, Head, usePage } from '@inertiajs/vue3';
+import { computed } from 'vue';
 
 import SocialLogin from '@/components/auth/SocialLogin.vue';
 import InputError from '@/components/InputError.vue';
@@ -19,6 +20,9 @@ defineProps<{
     email?: string | null;
     redirect?: string | null;
 }>();
+
+const page = usePage();
+const isSelfHosted = computed(() => Boolean(page.props.selfHosted));
 </script>
 
 <template>
@@ -69,7 +73,7 @@ defineProps<{
                     </Button>
                 </div>
 
-                <div class="text-center text-sm text-muted-foreground">
+                <div v-if="!isSelfHosted" class="text-center text-sm text-muted-foreground">
                     {{ $t('auth.login.no_account') }}
                     <TextLink :href="register()" :tabindex="5">{{ $t('auth.login.sign_up') }}</TextLink>
                 </div>
diff --git a/routes/auth.php b/routes/auth.php
index da4e5de0..f50f4a3a 100644
--- a/routes/auth.php
+++ b/routes/auth.php
@@ -18,8 +18,10 @@
 Route::get('/invites/{invite}', [AcceptInviteController::class, 'show'])->name('app.invites.show');
 
 Route::middleware(['guest'])->group(function () {
-    Route::get('/register', [RegisteredUserController::class, 'create'])->name('register');
-    Route::post('/register', [RegisteredUserController::class, 'store'])->name('register.store');
+    Route::middleware('registration.enabled')->group(function () {
+        Route::get('/register', [RegisteredUserController::class, 'create'])->name('register');
+        Route::post('/register', [RegisteredUserController::class, 'store'])->name('register.store');
+    });
 
     Route::get('/login', [AuthenticatedSessionController::class, 'create'])->name('login');
     Route::post('/login', [AuthenticatedSessionController::class, 'store'])->name('login.store');
diff --git a/tests/Feature/AcceptInviteControllerTest.php b/tests/Feature/AcceptInviteControllerTest.php
index 6ad786d1..6d78840d 100644
--- a/tests/Feature/AcceptInviteControllerTest.php
+++ b/tests/Feature/AcceptInviteControllerTest.php
@@ -19,7 +19,9 @@
     ]);
 });
 
-test('show invite displays invite details for guest', function () {
+test('show invite displays invite details for guest when not self_hosted', function () {
+    config()->set('trypost.self_hosted', false);
+
     $invite = Invite::factory()->create([
         'account_id' => $this->account->id,
         'invited_by' => $this->owner->id,
@@ -39,6 +41,26 @@
     );
 });
 
+test('show invite displays invite details for guest when self_hosted (page renders, gate happens on /register)', function () {
+    config()->set('trypost.self_hosted', true);
+
+    $invite = Invite::factory()->create([
+        'account_id' => $this->account->id,
+        'invited_by' => $this->owner->id,
+        'email' => 'newuser@example.com',
+        'workspaces' => [$this->workspace->id],
+    ]);
+
+    $response = $this->get(route('app.invites.show', $invite));
+
+    $response->assertOk();
+    $response->assertInertia(fn ($page) => $page
+        ->component('auth/AcceptInvite', false)
+        ->has('invite')
+        ->where('invite.id', $invite->id)
+    );
+});
+
 test('show invite displays invite details for authenticated user', function () {
     $user = User::factory()->create([
         'email' => 'invitee@example.com',
diff --git a/tests/Feature/Auth/RegistrationTest.php b/tests/Feature/Auth/RegistrationTest.php
index 7382ce13..466a40d2 100644
--- a/tests/Feature/Auth/RegistrationTest.php
+++ b/tests/Feature/Auth/RegistrationTest.php
@@ -4,6 +4,8 @@
 
 use App\Models\User;
 
+beforeEach(fn () => config()->set('trypost.self_hosted', false));
+
 test('registration screen can be rendered', function () {
     $response = $this->get(route('register'));
 
@@ -111,3 +113,74 @@
 
     expect($user->email_verified_at)->not->toBeNull();
 });
+
+test('register page returns 404 when self_hosted and no pending invite in session', function () {
+    config()->set('trypost.self_hosted', true);
+
+    $response = $this->get(route('register'));
+
+    $response->assertNotFound();
+});
+
+test('register POST returns 404 when self_hosted and no pending invite in session', function () {
+    config()->set('trypost.self_hosted', true);
+
+    $response = $this->post(route('register.store'), [
+        'name' => 'Test User',
+        'email' => 'test@example.com',
+        'password' => 'Password123!',
+    ]);
+
+    $response->assertNotFound();
+    expect(User::where('email', 'test@example.com')->exists())->toBeFalse();
+});
+
+test('register page renders when self_hosted but session has pending invite', function () {
+    config()->set('trypost.self_hosted', true);
+
+    $response = $this
+        ->withSession(['pending_invite_id' => 'invite-abc'])
+        ->get(route('register'));
+
+    $response->assertOk();
+});
+
+test('register page renders when self_hosted with invite query param and persists it to session', function () {
+    config()->set('trypost.self_hosted', true);
+
+    $response = $this->get(route('register', ['invite' => 'invite-xyz']));
+
+    $response->assertOk();
+    $response->assertSessionHas('pending_invite_id', 'invite-xyz');
+});
+
+test('signup clears pending_invite_id from session', function () {
+    config()->set('trypost.self_hosted', true);
+
+    $this->withSession(['pending_invite_id' => 'invite-abc'])
+        ->post(route('register.store'), [
+            'name' => 'Invitee',
+            'email' => 'invitee@example.com',
+            'password' => 'Password123!',
+        ]);
+
+    expect(session('pending_invite_id'))->toBeNull();
+    expect(User::where('email', 'invitee@example.com')->exists())->toBeTrue();
+});
+
+test('register works normally when not self_hosted even with pending invite in session', function () {
+    config()->set('trypost.self_hosted', false);
+
+    $response = $this
+        ->withSession(['pending_invite_id' => 'invite-abc'])
+        ->post(route('register.store'), [
+            'name' => 'Invitee',
+            'email' => 'invitee@example.com',
+            'password' => 'Password123!',
+        ]);
+
+    $response->assertSessionHasNoErrors();
+    expect(User::where('email', 'invitee@example.com')->exists())->toBeTrue();
+    // Cleared regardless of mode, since signup consumes the marker.
+    expect(session('pending_invite_id'))->toBeNull();
+});
diff --git a/tests/Feature/Auth/SignupUtmTrackingTest.php b/tests/Feature/Auth/SignupUtmTrackingTest.php
index ab346071..9a80e10e 100644
--- a/tests/Feature/Auth/SignupUtmTrackingTest.php
+++ b/tests/Feature/Auth/SignupUtmTrackingTest.php
@@ -6,6 +6,8 @@
 use Laravel\Socialite\Facades\Socialite;
 use Laravel\Socialite\Two\User as SocialiteUser;
 
+beforeEach(fn () => config()->set('trypost.self_hosted', false));
+
 test('email registration saves utm parameters from the register page query string', function () {
     $utms = [
         'utm_source' => 'peerlist',
diff --git a/tests/Feature/GitHubAuthToggleTest.php b/tests/Feature/GitHubAuthToggleTest.php
index 8d24829f..4defbd5b 100644
--- a/tests/Feature/GitHubAuthToggleTest.php
+++ b/tests/Feature/GitHubAuthToggleTest.php
@@ -2,6 +2,8 @@
 
 declare(strict_types=1);
 
+beforeEach(fn () => config()->set('trypost.self_hosted', false));
+
 test('login page shares github auth enabled prop as false when disabled', function () {
     config(['trypost.github_auth_enabled' => false]);
 
@@ -52,3 +54,16 @@
     // Should redirect to login on failure (no OAuth code), not 404
     $response->assertRedirect(route('login'));
 });
+
+test('register page still shares github auth enabled prop when self_hosted (via pending invite)', function () {
+    config()->set('trypost.self_hosted', true);
+    config()->set('trypost.github_auth_enabled', true);
+
+    $response = $this
+        ->withSession(['pending_invite_id' => 'invite-abc'])
+        ->get(route('register'));
+
+    $response->assertOk();
+    $page = $response->original->getData()['page'];
+    expect($page['props']['githubAuthEnabled'])->toBeTrue();
+});
diff --git a/tests/Feature/GoogleAuthToggleTest.php b/tests/Feature/GoogleAuthToggleTest.php
index bb01975e..05b42d13 100644
--- a/tests/Feature/GoogleAuthToggleTest.php
+++ b/tests/Feature/GoogleAuthToggleTest.php
@@ -2,6 +2,8 @@
 
 declare(strict_types=1);
 
+beforeEach(fn () => config()->set('trypost.self_hosted', false));
+
 test('login page loads when google auth is disabled', function () {
     config(['trypost.google_auth_enabled' => false]);
 
@@ -69,3 +71,16 @@
     // Should redirect to login on failure (no OAuth code), not 404
     $response->assertRedirect(route('login'));
 });
+
+test('register page still shares google auth enabled prop when self_hosted (via pending invite)', function () {
+    config()->set('trypost.self_hosted', true);
+    config()->set('trypost.google_auth_enabled', true);
+
+    $response = $this
+        ->withSession(['pending_invite_id' => 'invite-abc'])
+        ->get(route('register'));
+
+    $response->assertOk();
+    $page = $response->original->getData()['page'];
+    expect($page['props']['googleAuthEnabled'])->toBeTrue();
+});

From e4bc6f1d5c550a78872f5d460edcca866e85acd0 Mon Sep 17 00:00:00 2001
From: Paulo Castellano <paulo@castellanos.llc>
Date: Tue, 19 May 2026 12:03:41 -0300
Subject: [PATCH 2/3] test(auth): cover remaining surfaces of the registration
 gate

- POST /register with ?invite query and no prior session passes the gate.
- UserSeeder seeds the admin + workspace on an empty DB and skips when a
  user already exists.
- Login page exposes selfHosted prop in both modes (proves the flag the
  frontend uses to hide the "Sign up" link reaches the client).
---
 tests/Feature/Auth/AuthenticationTest.php | 20 +++++++++++++++++
 tests/Feature/Auth/RegistrationTest.php   | 13 ++++++++++++
 tests/Feature/Database/UserSeederTest.php | 26 +++++++++++++++++++++++
 3 files changed, 59 insertions(+)
 create mode 100644 tests/Feature/Database/UserSeederTest.php

diff --git a/tests/Feature/Auth/AuthenticationTest.php b/tests/Feature/Auth/AuthenticationTest.php
index 060b1218..8a49a676 100644
--- a/tests/Feature/Auth/AuthenticationTest.php
+++ b/tests/Feature/Auth/AuthenticationTest.php
@@ -12,6 +12,26 @@
     $response->assertOk();
 });
 
+test('login page exposes selfHosted as false when SELF_HOSTED is off', function () {
+    config()->set('trypost.self_hosted', false);
+
+    $response = $this->get(route('login'));
+
+    $response->assertOk();
+    $page = $response->original->getData()['page'];
+    expect($page['props']['selfHosted'])->toBeFalse();
+});
+
+test('login page exposes selfHosted as true when SELF_HOSTED is on', function () {
+    config()->set('trypost.self_hosted', true);
+
+    $response = $this->get(route('login'));
+
+    $response->assertOk();
+    $page = $response->original->getData()['page'];
+    expect($page['props']['selfHosted'])->toBeTrue();
+});
+
 test('users can authenticate using the login screen', function () {
     $user = User::factory()->create();
 
diff --git a/tests/Feature/Auth/RegistrationTest.php b/tests/Feature/Auth/RegistrationTest.php
index 466a40d2..495791ca 100644
--- a/tests/Feature/Auth/RegistrationTest.php
+++ b/tests/Feature/Auth/RegistrationTest.php
@@ -168,6 +168,19 @@
     expect(User::where('email', 'invitee@example.com')->exists())->toBeTrue();
 });
 
+test('register POST passes when self_hosted with invite query param even without prior session', function () {
+    config()->set('trypost.self_hosted', true);
+
+    $response = $this->post(route('register.store', ['invite' => 'invite-xyz']), [
+        'name' => 'Invitee',
+        'email' => 'invitee@example.com',
+        'password' => 'Password123!',
+    ]);
+
+    $response->assertSessionHasNoErrors();
+    expect(User::where('email', 'invitee@example.com')->exists())->toBeTrue();
+});
+
 test('register works normally when not self_hosted even with pending invite in session', function () {
     config()->set('trypost.self_hosted', false);
 
diff --git a/tests/Feature/Database/UserSeederTest.php b/tests/Feature/Database/UserSeederTest.php
new file mode 100644
index 00000000..b8a98dfa
--- /dev/null
+++ b/tests/Feature/Database/UserSeederTest.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\User;
+use Database\Seeders\UserSeeder;
+
+test('seeder creates the admin user and a workspace when database is empty', function () {
+    expect(User::count())->toBe(0);
+
+    $this->seed(UserSeeder::class);
+
+    $admin = User::where('email', 'admin@trypost.it')->first();
+
+    expect($admin)->not->toBeNull();
+    expect($admin->account_id)->not->toBeNull();
+    expect($admin->workspaces()->count())->toBe(1);
+});
+
+test('seeder is idempotent when a user already exists', function () {
+    User::factory()->create();
+
+    $this->seed(UserSeeder::class);
+
+    expect(User::where('email', 'admin@trypost.it')->exists())->toBeFalse();
+});

From 166018706727aca57b8bc2997d64fefcab237b38 Mon Sep 17 00:00:00 2001
From: Paulo Castellano <paulo@castellanos.llc>
Date: Tue, 19 May 2026 12:20:49 -0300
Subject: [PATCH 3/3] fix(profile): member delete must not destroy the shared
 account (closes #50)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Members joining via workspace invite share the owner's account_id.
ProfileController::destroy was unconditionally calling $account->delete()
in every profile-deletion path, so any member could wipe the whole
organization (cascade: workspaces, posts, social accounts, signatures,
labels) just by clicking Delete on their own profile.

Gate the account/subscription teardown behind isAccountOwner(). For
members the path now only detaches them from workspaces and deletes
the user row — owner's data is untouched.

Tested in both SELF_HOSTED=true and false.
---
 .../App/Settings/ProfileController.php        | 17 +++--
 tests/Feature/Settings/ProfileUpdateTest.php  | 63 +++++++++++++++++++
 2 files changed, 70 insertions(+), 10 deletions(-)

diff --git a/app/Http/Controllers/App/Settings/ProfileController.php b/app/Http/Controllers/App/Settings/ProfileController.php
index 0d7273be..880927ab 100644
--- a/app/Http/Controllers/App/Settings/ProfileController.php
+++ b/app/Http/Controllers/App/Settings/ProfileController.php
@@ -94,15 +94,7 @@ public function destroy(ProfileDeleteRequest $request): RedirectResponse
             $user->update(['current_workspace_id' => null]);
 
             $account = $user->account;
-
-            // Cancel account subscription if exists
-            if ($account && $account->subscribed(Account::SUBSCRIPTION_NAME)) {
-                $account->subscription(Account::SUBSCRIPTION_NAME)->cancelNow();
-            }
-
-            if ($account) {
-                $account->subscriptions()->delete();
-            }
+            $isOwner = $user->isAccountOwner();
 
             $ownedWorkspaces = Workspace::where('user_id', $user->id)->get();
 
@@ -126,7 +118,12 @@ public function destroy(ProfileDeleteRequest $request): RedirectResponse
 
             $user->workspaces()->detach();
 
-            if ($account) {
+            if ($account && $isOwner) {
+                if ($account->subscribed(Account::SUBSCRIPTION_NAME)) {
+                    $account->subscription(Account::SUBSCRIPTION_NAME)->cancelNow();
+                }
+
+                $account->subscriptions()->delete();
                 $account->delete();
             }
         });
diff --git a/tests/Feature/Settings/ProfileUpdateTest.php b/tests/Feature/Settings/ProfileUpdateTest.php
index 1955360a..60786517 100644
--- a/tests/Feature/Settings/ProfileUpdateTest.php
+++ b/tests/Feature/Settings/ProfileUpdateTest.php
@@ -3,6 +3,7 @@
 declare(strict_types=1);
 
 use App\Enums\UserWorkspace\Role;
+use App\Models\Account;
 use App\Models\User;
 use App\Models\Workspace;
 use Illuminate\Http\UploadedFile;
@@ -250,3 +251,65 @@
 
     $response->assertRedirect(route('login'));
 });
+
+test('member deleting profile does NOT destroy the shared account', function (bool $selfHosted) {
+    config()->set('trypost.self_hosted', $selfHosted);
+
+    $owner = User::factory()->create();
+    $member = User::factory()->create(['account_id' => $owner->account_id]);
+
+    $workspace = Workspace::factory()->create([
+        'account_id' => $owner->account_id,
+        'user_id' => $owner->id,
+    ]);
+    $owner->workspaces()->attach($workspace->id, ['role' => Role::Member->value]);
+    $member->workspaces()->attach($workspace->id, ['role' => Role::Member->value]);
+
+    $this->actingAs($member)->delete(route('app.profile.destroy'), [
+        'password' => 'password',
+    ]);
+
+    expect($member->fresh())->toBeNull();
+    expect(Account::find($owner->account_id))->not->toBeNull();
+    expect(Workspace::find($workspace->id))->not->toBeNull();
+    expect($owner->fresh())->not->toBeNull();
+})->with([true, false]);
+
+test('member deleting profile detaches them from workspaces', function (bool $selfHosted) {
+    config()->set('trypost.self_hosted', $selfHosted);
+
+    $owner = User::factory()->create();
+    $member = User::factory()->create(['account_id' => $owner->account_id]);
+
+    $workspace = Workspace::factory()->create([
+        'account_id' => $owner->account_id,
+        'user_id' => $owner->id,
+    ]);
+    $member->workspaces()->attach($workspace->id, ['role' => Role::Member->value]);
+
+    $this->actingAs($member)->delete(route('app.profile.destroy'), [
+        'password' => 'password',
+    ]);
+
+    expect($workspace->fresh()->members()->where('users.id', $member->id)->exists())->toBeFalse();
+})->with([true, false]);
+
+test('owner deleting profile destroys the account and cascades', function (bool $selfHosted) {
+    config()->set('trypost.self_hosted', $selfHosted);
+
+    $owner = User::factory()->create();
+    $accountId = $owner->account_id;
+
+    $workspace = Workspace::factory()->create([
+        'account_id' => $accountId,
+        'user_id' => $owner->id,
+    ]);
+    $owner->workspaces()->attach($workspace->id, ['role' => Role::Member->value]);
+
+    $this->actingAs($owner)->delete(route('app.profile.destroy'), [
+        'password' => 'password',
+    ]);
+
+    expect(Account::find($accountId))->toBeNull();
+    expect(Workspace::find($workspace->id))->toBeNull();
+})->with([true, false]);