diff --git a/resources/views/products/edit.blade.php b/resources/views/products/edit.blade.php
index 4f57482..9005083 100644
--- a/resources/views/products/edit.blade.php
+++ b/resources/views/products/edit.blade.php
@@ -253,6 +253,8 @@
diff --git a/resources/views/products/show.blade.php b/resources/views/products/show.blade.php
index eb54304..71283f8 100644
--- a/resources/views/products/show.blade.php
+++ b/resources/views/products/show.blade.php
@@ -282,7 +282,7 @@
-
+
diff --git a/routes/web.php b/routes/web.php
index 8961077..08233f4 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -11,6 +11,7 @@ use App\Http\Controllers\ProductController;
use App\Http\Controllers\ProfileController;
use App\Http\Controllers\TagController;
use App\Http\Controllers\UpvoteController;
+use App\Http\Controllers\UserSearchController;
use App\Http\Controllers\WaitlistController;
use Illuminate\Support\Facades\Route;
@@ -44,6 +45,9 @@ Route::middleware(['auth'])->group(function () {
Route::put('/products/{product}', [ProductController::class, 'update'])->name('products.update');
Route::delete('/products/{product}', [ProductController::class, 'destroy'])->name('products.destroy');
+ // User search (team member picker)
+ Route::get('/users/search', UserSearchController::class)->name('users.search');
+
// Upvotes
Route::post('/products/{product}/upvote', [UpvoteController::class, 'store'])->name('products.upvote');
Route::get('/upvotes', [UpvoteController::class, 'index'])->name('upvotes.index');
diff --git a/tests/Feature/ProductTeamTest.php b/tests/Feature/ProductTeamTest.php
new file mode 100644
index 0000000..d60e61c
--- /dev/null
+++ b/tests/Feature/ProductTeamTest.php
@@ -0,0 +1,150 @@
+ 'Team Product',
+ 'description' => 'A product description',
+ 'website_url' => 'https://example.com',
+ 'category_id' => makeCategory()->id,
+ ], $overrides);
+}
+
+test('user search returns matching users, requires auth', function () {
+ $this->getJson(route('users.search', ['q' => 'ali']))->assertUnauthorized();
+
+ $viewer = userWithRole('user');
+ $alice = User::factory()->create(['name' => 'Alice Wonder']);
+ User::factory()->create(['name' => 'Bob Builder']);
+
+ $response = $this->actingAs($viewer)->getJson(route('users.search', ['q' => 'lic']))->assertOk();
+
+ expect($response->json())->toHaveCount(1);
+ expect($response->json(0))->toBe(['id' => $alice->id, 'name' => 'Alice Wonder', 'slug' => $alice->slug]);
+});
+
+test('user search returns empty for one character queries', function () {
+ $viewer = userWithRole('user');
+ User::factory()->create(['name' => 'Alice Wonder']);
+
+ $this->actingAs($viewer)->getJson(route('users.search', ['q' => 'a']))->assertOk()->assertExactJson([]);
+});
+
+test('submitter adds members with roles', function () {
+ $user = userWithRole('user');
+ $a = User::factory()->create();
+ $b = User::factory()->create();
+
+ $this->actingAs($user)->post(route('products.store'), teamPayload([
+ 'members' => [
+ ['user_id' => $a->id, 'role' => 'Designer'],
+ ['user_id' => $b->id, 'role' => 'Engineer'],
+ ],
+ ]))->assertRedirect()->assertSessionHasNoErrors();
+
+ $members = Product::firstOrFail()->members;
+ expect($members->pluck('id')->all())->toEqualCanonicalizing([$a->id, $b->id]);
+ expect($members->firstWhere('id', $a->id)->pivot->role)->toBe('Designer');
+});
+
+test('update replaces members and uses the product owner for the owner rule', function () {
+ $owner = userWithRole('user');
+ $admin = userWithRole('admin');
+ $a = User::factory()->create();
+ $b = User::factory()->create();
+ $product = Product::factory()->pending()->create(['user_id' => $owner->id]);
+ $product->members()->attach($a->id, ['role' => 'Old']);
+
+ $this->actingAs($admin)->put(route('products.update', $product), teamPayload([
+ 'category_id' => $product->category_id,
+ 'members' => [['user_id' => $owner->id, 'role' => 'Founder']],
+ ]))->assertSessionHasErrors('members.0.user_id');
+ expect($product->members()->pluck('users.id')->all())->toBe([$a->id]);
+
+ $this->actingAs($admin)->put(route('products.update', $product), teamPayload([
+ 'category_id' => $product->category_id,
+ 'members' => [['user_id' => $admin->id, 'role' => 'Helper'], ['user_id' => $b->id, 'role' => 'New']],
+ ]))->assertRedirect()->assertSessionHasNoErrors();
+ expect($product->members()->pluck('users.id')->all())->toEqualCanonicalizing([$admin->id, $b->id]);
+});
+
+test('submitter cannot be added as a member', function () {
+ $user = userWithRole('user');
+
+ $this->actingAs($user)->post(route('products.store'), teamPayload([
+ 'members' => [['user_id' => $user->id, 'role' => 'Founder']],
+ ]))->assertSessionHasErrors('members.0.user_id');
+
+ expect(Product::count())->toBe(0);
+});
+
+test('same user cannot be added twice', function () {
+ $user = userWithRole('user');
+ $a = User::factory()->create();
+
+ $this->actingAs($user)->post(route('products.store'), teamPayload([
+ 'members' => [
+ ['user_id' => $a->id, 'role' => 'One'],
+ ['user_id' => $a->id, 'role' => 'Two'],
+ ],
+ ]))->assertSessionHasErrors();
+
+ expect(Product::count())->toBe(0);
+ expect(\DB::table('product_members')->count())->toBe(0);
+});
+
+test('unknown user id fails validation', function () {
+ $user = userWithRole('user');
+
+ $this->actingAs($user)->post(route('products.store'), teamPayload([
+ 'members' => [['user_id' => 999999, 'role' => 'Ghost']],
+ ]))->assertSessionHasErrors('members.0.user_id');
+
+ expect(Product::count())->toBe(0);
+});
+
+test('missing role fails validation', function () {
+ $user = userWithRole('user');
+ $a = User::factory()->create();
+
+ $this->actingAs($user)->post(route('products.store'), teamPayload([
+ 'members' => [['user_id' => $a->id, 'role' => '']],
+ ]))->assertSessionHasErrors('members.0.role');
+
+ expect(Product::count())->toBe(0);
+});
+
+test('deleting a user removes their membership', function () {
+ $product = Product::factory()->approved()->create();
+ $member = User::factory()->create();
+ $product->members()->attach($member->id, ['role' => 'Dev']);
+
+ $member->delete();
+
+ expect(\DB::table('product_members')->count())->toBe(0);
+ expect(Product::find($product->id))->not->toBeNull();
+});
+
+test('show page lists submitter first as Author then members linking to profiles', function () {
+ $product = Product::factory()->approved()->create();
+ $member = User::factory()->create(['name' => 'Zed Member']);
+ $product->members()->attach($member->id, ['role' => 'Designer']);
+
+ $this->get(route('products.show', $product))->assertOk()
+ ->assertSeeInOrder([$product->user->name, 'Author', 'Zed Member', 'Designer'])
+ ->assertSee(route('profile.show', $member), false);
+});
+
+test('no members shows only the submitter as author', function () {
+ $product = Product::factory()->approved()->create();
+
+ $this->get(route('products.show', $product))->assertOk()
+ ->assertSee('Author')
+ ->assertDontSee('data-team-members', false);
+});