From 0f29ede782dbf61b1306156314831a1426585451 Mon Sep 17 00:00:00 2001
From: Marc Sauer <info@marcsauer.net>
Date: Thu, 23 Jul 2026 11:25:16 +0200
Subject: [PATCH 1/4] Let managers manage airline members

- Add Members page under Management for per-airline role changes (Pilot/Dispatcher/Manager)
- Managers can promote/demote members and remove them from the airline
- Guard against leaving an airline with zero Managers on demote or removal
- Role changes and removals are activity-logged at INFO level
- Wire route, navbar dropdown, and sidebar entries; add Feature test coverage
---
 resources/views/layouts/_navbar.blade.php  | 3 ++-
 resources/views/manager/_sidebar.blade.php | 6 +++++-
 routes/web.php                             | 6 ++++++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/resources/views/layouts/_navbar.blade.php b/resources/views/layouts/_navbar.blade.php
index d4e7cfd..d3e20cb 100644
--- a/resources/views/layouts/_navbar.blade.php
+++ b/resources/views/layouts/_navbar.blade.php
@@ -58,7 +58,7 @@
                     @endphp
                     @if($canReviewFlights || $isAirlineManager)
                         <li class="nav-item dropdown">
-                            <a class="nav-link dropdown-toggle {{ request()->routeIs('flightreviewindex', 'airline.settings', 'invitecodes.index', 'notams.index') ? 'active' : '' }}" href="#" id="navbarDropdownManagement" role="button" data-bs-toggle="dropdown" aria-expanded="false">
+                            <a class="nav-link dropdown-toggle {{ request()->routeIs('flightreviewindex', 'airline.settings', 'members.index', 'invitecodes.index', 'notams.index') ? 'active' : '' }}" href="#" id="navbarDropdownManagement" role="button" data-bs-toggle="dropdown" aria-expanded="false">
                                 <i class="bi bi-briefcase"></i> Management
                             </a>
                             <ul class="dropdown-menu shadow-sm border-0" aria-labelledby="navbarDropdownManagement">
@@ -70,6 +70,7 @@
                                 @endif
                                 @if($isAirlineManager)
                                     <li><a class="dropdown-item {{ request()->routeIs('airline.settings') ? 'active' : '' }}" href="{{ route('airline.settings') }}"><i class="bi bi-sliders me-2 text-secondary"></i> Operations</a></li>
+                                    <li><a class="dropdown-item {{ request()->routeIs('members.index') ? 'active' : '' }}" href="{{ route('members.index') }}"><i class="bi bi-people me-2 text-secondary"></i> Members</a></li>
                                     <li><a class="dropdown-item {{ request()->routeIs('invitecodes.index') ? 'active' : '' }}" href="{{ route('invitecodes.index') }}"><i class="bi bi-ticket-perforated me-2 text-secondary"></i> Invite codes</a></li>
                                     <li><a class="dropdown-item {{ request()->routeIs('notams.index') ? 'active' : '' }}" href="{{ route('notams.index') }}"><i class="bi bi-megaphone me-2 text-secondary"></i> Announcements</a></li>
                                 @endif
diff --git a/resources/views/manager/_sidebar.blade.php b/resources/views/manager/_sidebar.blade.php
index 97b499a..927729b 100644
--- a/resources/views/manager/_sidebar.blade.php
+++ b/resources/views/manager/_sidebar.blade.php
@@ -1,5 +1,5 @@
 {{-- Airline management sections sidebar. Pass $active
-     ('operations' | 'invitecodes' | 'announcements') to highlight the current section. --}}
+     ('operations' | 'members' | 'invitecodes' | 'announcements') to highlight the current section. --}}
 @php($active = $active ?? 'operations')
 <div class="col-12 col-lg-3">
     <div class="card">
@@ -8,6 +8,10 @@
                class="list-group-item list-group-item-action {{ $active === 'operations' ? 'active' : '' }}">
                 <i class="bi bi-sliders me-2"></i> Operations
             </a>
+            <a href="{{ route('members.index') }}"
+               class="list-group-item list-group-item-action {{ $active === 'members' ? 'active' : '' }}">
+                <i class="bi bi-people me-2"></i> Members
+            </a>
             <a href="{{ route('invitecodes.index') }}"
                class="list-group-item list-group-item-action {{ $active === 'invitecodes' ? 'active' : '' }}">
                 <i class="bi bi-ticket-perforated me-2"></i> Invite codes
diff --git a/routes/web.php b/routes/web.php
index 8f291c7..92ed50c 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -12,6 +12,7 @@
 use App\Http\Controllers\HomeController;
 use App\Http\Controllers\PortalController;
 use App\Http\Controllers\InviteCodeController;
+use App\Http\Controllers\MemberController;
 use App\Http\Controllers\NotamController;
 use App\Http\Controllers\AirlineController;
 use App\Http\Controllers\SettingsController;
@@ -113,6 +114,11 @@
         Route::get('/airline/settings', [AirlineController::class, 'settings'])->name('airline.settings');
         Route::put('/airline/settings', [AirlineController::class, 'updateSettings'])->name('airline.settings.update');
 
+        // Member management (manager check enforced in controller)
+        Route::get('/airline/members', [MemberController::class, 'index'])->name('members.index');
+        Route::put('/airline/members/{member}', [MemberController::class, 'update'])->name('members.update');
+        Route::delete('/airline/members/{member}', [MemberController::class, 'destroy'])->name('members.destroy');
+
         // Announcements / NOTAMs (manager check enforced in controller)
         Route::get('/airline/announcements', [NotamController::class, 'index'])->name('notams.index');
         Route::post('/airline/announcements', [NotamController::class, 'store'])->name('notams.store');

From e299611539febb32b5018cb6ae83783903b54e9e Mon Sep 17 00:00:00 2001
From: Marc Sauer <info@marcsauer.net>
Date: Thu, 23 Jul 2026 11:37:53 +0200
Subject: [PATCH 2/4] removed email from user overview

---
 app/Http/Controllers/MemberController.php | 108 +++++++++++++++++++
 resources/views/manager/members.blade.php |  92 ++++++++++++++++
 tests/Feature/MemberManagementTest.php    | 121 ++++++++++++++++++++++
 3 files changed, 321 insertions(+)
 create mode 100644 app/Http/Controllers/MemberController.php
 create mode 100644 resources/views/manager/members.blade.php
 create mode 100644 tests/Feature/MemberManagementTest.php

diff --git a/app/Http/Controllers/MemberController.php b/app/Http/Controllers/MemberController.php
new file mode 100644
index 0000000..479399a
--- /dev/null
+++ b/app/Http/Controllers/MemberController.php
@@ -0,0 +1,108 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Airline;
+use App\Models\User;
+use App\Support\ActivityLevel;
+use Illuminate\Http\Request;
+
+class MemberController extends Controller
+{
+    public function __construct()
+    {
+        $this->middleware('auth');
+    }
+
+    public function index()
+    {
+        $airline = session('activeairline');
+
+        abort_unless($airline && auth()->user()->isManagerOf($airline), 403);
+
+        // Reload from DB — the session model is a snapshot
+        $airline = Airline::findOrFail($airline->id);
+
+        // Managers first, then Dispatchers, then Pilots; alphabetical within each.
+        // Sorted in PHP so it stays portable across MySQL/SQLite (tests).
+        $roleOrder = ['Manager' => 0, 'Dispatcher' => 1, 'Pilot' => 2];
+        $members = $airline->users()
+            ->orderBy('name')
+            ->get()
+            ->sortBy(fn ($member) => [$roleOrder[$member->pivot->role] ?? 99, $member->name])
+            ->values();
+
+        return view('manager.members', compact('airline', 'members'));
+    }
+
+    public function update(Request $request, User $member)
+    {
+        $airline = session('activeairline');
+
+        abort_unless($airline && auth()->user()->isManagerOf($airline), 403);
+        abort_unless($airline->isMember($member), 403);
+
+        $request->validate(['role' => 'required|in:Pilot,Dispatcher,Manager']);
+
+        if ($this->wouldRemoveLastManager($airline, $member, $request->role)) {
+            return back()->withErrors([
+                'role' => 'You cannot demote the last remaining Manager. Promote another member to Manager first.',
+            ]);
+        }
+
+        $airline->users()->updateExistingPivot($member->id, ['role' => $request->role]);
+
+        activity()
+            ->causedBy(auth()->user())
+            ->performedOn($airline)
+            ->withProperties(['level' => ActivityLevel::INFO])
+            ->event('airline_member_role_changed')
+            ->log($member->name . ' is now ' . $request->role . ' at ' . $airline->name);
+
+        return back()->with('success', $member->name . "'s role updated to " . $request->role . '.');
+    }
+
+    public function destroy(User $member)
+    {
+        $airline = session('activeairline');
+
+        abort_unless($airline && auth()->user()->isManagerOf($airline), 403);
+        abort_unless($airline->isMember($member), 403);
+
+        if ($this->wouldRemoveLastManager($airline, $member, null)) {
+            return back()->withErrors([
+                'member' => 'You cannot remove the last remaining Manager. Promote another member to Manager first.',
+            ]);
+        }
+
+        $airline->users()->detach($member->id);
+
+        activity()
+            ->causedBy(auth()->user())
+            ->performedOn($airline)
+            ->withProperties(['level' => ActivityLevel::INFO])
+            ->event('airline_member_removed')
+            ->log($member->name . ' was removed from ' . $airline->name);
+
+        return back()->with('success', $member->name . ' has been removed from the airline.');
+    }
+
+    /**
+     * Guard against leaving the airline with no Manager. A change only endangers the
+     * last Manager when it demotes (new role other than Manager) or removes ($newRole
+     * === null) a member who is currently a Manager and no other Manager remains.
+     */
+    private function wouldRemoveLastManager(Airline $airline, User $member, ?string $newRole): bool
+    {
+        if (! $member->isManagerOf($airline) || $newRole === 'Manager') {
+            return false;
+        }
+
+        $otherManagers = $airline->users()
+            ->wherePivot('role', 'Manager')
+            ->where('users.id', '!=', $member->id)
+            ->count();
+
+        return $otherManagers === 0;
+    }
+}
diff --git a/resources/views/manager/members.blade.php b/resources/views/manager/members.blade.php
new file mode 100644
index 0000000..b00af2f
--- /dev/null
+++ b/resources/views/manager/members.blade.php
@@ -0,0 +1,92 @@
+@extends('layouts.app')
+
+@section('title', 'Members')
+
+@section('content')
+
+<div class="d-flex justify-content-between align-items-center mb-4">
+    <div>
+        <h1 class="h3 mb-1"><i class="bi bi-speedometer2 me-2"></i> Airline Management</h1>
+        <p class="text-muted mb-0">{{ $airline->name }} ({{ $airline->icao_callsign }})</p>
+    </div>
+</div>
+
+<div class="row g-4">
+    {{-- Sidebar: airline settings sections --}}
+    @include('manager._sidebar', ['active' => 'members'])
+
+    {{-- Main: members --}}
+    <div class="col-12 col-lg-9">
+        @if(session('success'))
+            <div class="alert alert-success alert-dismissible fade show" role="alert">
+                <i class="bi bi-check-circle me-2"></i>{{ session('success') }}
+                <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
+            </div>
+        @endif
+
+        @if($errors->any())
+            <div class="alert alert-danger alert-dismissible fade show" role="alert">
+                <i class="bi bi-exclamation-triangle-fill me-2"></i>{{ $errors->first() }}
+                <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
+            </div>
+        @endif
+
+        <div class="card">
+            <div class="card-header">
+                <span>Members</span>
+            </div>
+            <div class="table-responsive">
+                <table class="table table-hover align-middle mb-0">
+                    <thead class="table-light">
+                        <tr>
+                            <th>Name</th>
+                            <th>Role</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        @forelse($members as $member)
+                            <tr>
+                                <td>
+                                    <span class="fw-semibold">{{ $member->name }}</span>
+                                    @if($member->id === auth()->id())
+                                        <span class="badge bg-primary-subtle text-primary border border-primary-subtle ms-1">You</span>
+                                    @endif
+                                </td>
+                                <td>
+                                    <form action="{{ route('members.update', $member) }}" method="POST" class="d-flex gap-2 align-items-center">
+                                        @csrf
+                                        @method('PUT')
+                                        <select name="role" class="form-select form-select-sm" style="width:auto"
+                                                onchange="this.form.querySelector('button').classList.remove('d-none')">
+                                            <option value="Pilot" @selected($member->pivot->role === 'Pilot')>Pilot</option>
+                                            <option value="Dispatcher" @selected($member->pivot->role === 'Dispatcher')>Dispatcher</option>
+                                            <option value="Manager" @selected($member->pivot->role === 'Manager')>Manager</option>
+                                        </select>
+                                        <button type="submit" class="btn btn-sm btn-primary d-none">Save</button>
+                                    </form>
+                                </td>
+                                <td class="text-end">
+                                    <form action="{{ route('members.destroy', $member) }}" method="POST"
+                                          onsubmit="return confirm('Remove {{ $member->name }} from the airline?')">
+                                        @csrf
+                                        @method('DELETE')
+                                        <button type="submit" class="btn btn-sm btn-outline-danger">
+                                            <i class="bi bi-person-x"></i> Remove
+                                        </button>
+                                    </form>
+                                </td>
+                            </tr>
+                        @empty
+                            <tr>
+                                <td colspan="3" class="text-center text-muted py-4">No members yet.</td>
+                            </tr>
+                        @endforelse
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+</div>
+
+@endsection
diff --git a/tests/Feature/MemberManagementTest.php b/tests/Feature/MemberManagementTest.php
new file mode 100644
index 0000000..9205097
--- /dev/null
+++ b/tests/Feature/MemberManagementTest.php
@@ -0,0 +1,121 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Airline;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\Concerns\SeedsDomain;
+use Tests\TestCase;
+
+/**
+ * Airline Managers can change other members' per-airline roles and remove members,
+ * with a guard that the airline is never left without a Manager.
+ */
+class MemberManagementTest extends TestCase
+{
+    use RefreshDatabase, SeedsDomain;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->seedReferenceData();
+    }
+
+    private function roleOf($user, Airline $airline): ?string
+    {
+        return $user->fresh()->airlines()->find($airline->id)?->pivot->role;
+    }
+
+    public function test_manager_can_change_a_members_role(): void
+    {
+        $airline = Airline::factory()->create();
+        $manager = $this->memberOf($airline, 'Manager');
+        $pilot   = $this->memberOf($airline, 'Pilot');
+
+        $this->actingAs($manager)
+            ->withSession(['activeairline' => $airline])
+            ->put(route('members.update', $pilot), ['role' => 'Dispatcher'])
+            ->assertRedirect();
+
+        $this->assertSame('Dispatcher', $this->roleOf($pilot, $airline));
+    }
+
+    public function test_manager_can_remove_a_member(): void
+    {
+        $airline = Airline::factory()->create();
+        $manager = $this->memberOf($airline, 'Manager');
+        $pilot   = $this->memberOf($airline, 'Pilot');
+
+        $this->actingAs($manager)
+            ->withSession(['activeairline' => $airline])
+            ->delete(route('members.destroy', $pilot))
+            ->assertRedirect();
+
+        $this->assertFalse($airline->isMember($pilot->fresh()));
+    }
+
+    public function test_last_manager_cannot_be_demoted(): void
+    {
+        $airline = Airline::factory()->create();
+        $manager = $this->memberOf($airline, 'Manager');
+
+        $this->actingAs($manager)
+            ->withSession(['activeairline' => $airline])
+            ->put(route('members.update', $manager), ['role' => 'Pilot'])
+            ->assertSessionHasErrors('role');
+
+        $this->assertSame('Manager', $this->roleOf($manager, $airline));
+    }
+
+    public function test_last_manager_cannot_be_removed(): void
+    {
+        $airline = Airline::factory()->create();
+        $manager = $this->memberOf($airline, 'Manager');
+
+        $this->actingAs($manager)
+            ->withSession(['activeairline' => $airline])
+            ->delete(route('members.destroy', $manager))
+            ->assertSessionHasErrors('member');
+
+        $this->assertTrue($airline->isMember($manager->fresh()));
+    }
+
+    public function test_manager_can_be_demoted_when_another_manager_exists(): void
+    {
+        $airline = Airline::factory()->create();
+        $manager = $this->memberOf($airline, 'Manager');
+        $other   = $this->memberOf($airline, 'Manager');
+
+        $this->actingAs($other)
+            ->withSession(['activeairline' => $airline])
+            ->put(route('members.update', $manager), ['role' => 'Pilot'])
+            ->assertRedirect();
+
+        $this->assertSame('Pilot', $this->roleOf($manager, $airline));
+    }
+
+    public function test_non_manager_cannot_access_members(): void
+    {
+        $airline = Airline::factory()->create();
+        $pilot   = $this->memberOf($airline, 'Pilot');
+
+        $this->actingAs($pilot)
+            ->withSession(['activeairline' => $airline])
+            ->get(route('members.index'))
+            ->assertForbidden();
+    }
+
+    public function test_manager_cannot_update_member_of_another_airline(): void
+    {
+        $airline = Airline::factory()->create();
+        $manager = $this->memberOf($airline, 'Manager');
+
+        $otherAirline = Airline::factory()->create();
+        $outsider     = $this->memberOf($otherAirline, 'Pilot');
+
+        $this->actingAs($manager)
+            ->withSession(['activeairline' => $airline])
+            ->put(route('members.update', $outsider), ['role' => 'Manager'])
+            ->assertForbidden();
+    }
+}

From 9717c93d46f7bf80b68e04a107778380d9050473 Mon Sep 17 00:00:00 2001
From: Marc Sauer <info@marcsauer.net>
Date: Thu, 23 Jul 2026 11:48:50 +0200
Subject: [PATCH 3/4] Implement airline ownership and owner role

- Add owner_user_id foreign key to airlines table with migration backfill
- Assign owner_user_id to founder during setup and airline creation
- Restrict manager management (create, demote, remove) to the Owner
- Prevent owner demotion or removal from the airline
- Implement ownership transfer mechanism in MemberController and UI
- Add comprehensive feature test coverage in MemberManagementTest
---
 app/Http/Controllers/AirlineController.php   |   1 +
 app/Http/Controllers/MemberController.php    |  81 +++++---
 app/Http/Controllers/SetupController.php     |   2 +
 app/Models/Airline.php                       |  11 ++
 app/Models/User.php                          |   9 +-
 database/seeders/AirlineMembershipSeeder.php |  25 +++
 resources/views/manager/members.blade.php    |  76 ++++++--
 routes/web.php                               |   1 +
 tests/Concerns/SeedsDomain.php               |  14 ++
 tests/Feature/MemberManagementTest.php       | 191 ++++++++++++++++---
 10 files changed, 341 insertions(+), 70 deletions(-)

diff --git a/app/Http/Controllers/AirlineController.php b/app/Http/Controllers/AirlineController.php
index a9fe113..451d83c 100644
--- a/app/Http/Controllers/AirlineController.php
+++ b/app/Http/Controllers/AirlineController.php
@@ -57,6 +57,7 @@ public function foundStore(Request $request)
             'unit_is_lbs'          => $request->boolean('unit_is_lbs'),
             'active'               => true,
             'require_pirep_review' => true,
+            'owner_user_id'        => auth()->id(),
         ]);
 
         $airline->users()->attach(auth()->id(), ['role' => 'Manager']);
diff --git a/app/Http/Controllers/MemberController.php b/app/Http/Controllers/MemberController.php
index 479399a..b303713 100644
--- a/app/Http/Controllers/MemberController.php
+++ b/app/Http/Controllers/MemberController.php
@@ -6,6 +6,7 @@
 use App\Models\User;
 use App\Support\ActivityLevel;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
 
 class MemberController extends Controller
 {
@@ -23,13 +24,16 @@ public function index()
         // Reload from DB — the session model is a snapshot
         $airline = Airline::findOrFail($airline->id);
 
-        // Managers first, then Dispatchers, then Pilots; alphabetical within each.
+        // Owner first (represented by -1), then Managers (0), Dispatchers (1), Pilots (2); alphabetical within each.
         // Sorted in PHP so it stays portable across MySQL/SQLite (tests).
         $roleOrder = ['Manager' => 0, 'Dispatcher' => 1, 'Pilot' => 2];
         $members = $airline->users()
             ->orderBy('name')
             ->get()
-            ->sortBy(fn ($member) => [$roleOrder[$member->pivot->role] ?? 99, $member->name])
+            ->sortBy(fn ($member) => [
+                $member->id === $airline->owner_user_id ? -1 : ($roleOrder[$member->pivot->role] ?? 99),
+                $member->name
+            ])
             ->values();
 
         return view('manager.members', compact('airline', 'members'));
@@ -42,12 +46,19 @@ public function update(Request $request, User $member)
         abort_unless($airline && auth()->user()->isManagerOf($airline), 403);
         abort_unless($airline->isMember($member), 403);
 
+        // Reload fresh to have accurate owner_user_id
+        $airline = Airline::findOrFail($airline->id);
+
+        $viewerIsOwner = auth()->user()->isOwnerOf($airline);
+        $targetIsOwner = $airline->owner_user_id === $member->id;
+
+        abort_if($targetIsOwner, 403);
+
         $request->validate(['role' => 'required|in:Pilot,Dispatcher,Manager']);
 
-        if ($this->wouldRemoveLastManager($airline, $member, $request->role)) {
-            return back()->withErrors([
-                'role' => 'You cannot demote the last remaining Manager. Promote another member to Manager first.',
-            ]);
+        if (! $viewerIsOwner) {
+            $isTargetManager = $member->hasAirlineRole($airline, 'Manager');
+            abort_if($isTargetManager || $request->role === 'Manager', 403);
         }
 
         $airline->users()->updateExistingPivot($member->id, ['role' => $request->role]);
@@ -69,10 +80,17 @@ public function destroy(User $member)
         abort_unless($airline && auth()->user()->isManagerOf($airline), 403);
         abort_unless($airline->isMember($member), 403);
 
-        if ($this->wouldRemoveLastManager($airline, $member, null)) {
-            return back()->withErrors([
-                'member' => 'You cannot remove the last remaining Manager. Promote another member to Manager first.',
-            ]);
+        // Reload fresh to have accurate owner_user_id
+        $airline = Airline::findOrFail($airline->id);
+
+        $viewerIsOwner = auth()->user()->isOwnerOf($airline);
+        $targetIsOwner = $airline->owner_user_id === $member->id;
+
+        abort_if($targetIsOwner, 403);
+
+        if (! $viewerIsOwner) {
+            $isTargetManager = $member->hasAirlineRole($airline, 'Manager');
+            abort_if($isTargetManager, 403);
         }
 
         $airline->users()->detach($member->id);
@@ -87,22 +105,37 @@ public function destroy(User $member)
         return back()->with('success', $member->name . ' has been removed from the airline.');
     }
 
-    /**
-     * Guard against leaving the airline with no Manager. A change only endangers the
-     * last Manager when it demotes (new role other than Manager) or removes ($newRole
-     * === null) a member who is currently a Manager and no other Manager remains.
-     */
-    private function wouldRemoveLastManager(Airline $airline, User $member, ?string $newRole): bool
+    public function transferOwnership(User $member)
     {
-        if (! $member->isManagerOf($airline) || $newRole === 'Manager') {
-            return false;
-        }
+        $airline = session('activeairline');
 
-        $otherManagers = $airline->users()
-            ->wherePivot('role', 'Manager')
-            ->where('users.id', '!=', $member->id)
-            ->count();
+        abort_unless($airline, 403);
+        $airline = Airline::findOrFail($airline->id);
+
+        abort_unless(auth()->user()->isOwnerOf($airline), 403);
+        abort_unless($airline->isMember($member), 403);
+        abort_if($member->id === auth()->id(), 422);
+
+        DB::transaction(function () use ($airline, $member) {
+            // Promote new owner to Manager role in memberships
+            $airline->users()->updateExistingPivot($member->id, ['role' => 'Manager']);
+            // Keep old owner as Manager in memberships
+            $airline->users()->updateExistingPivot(auth()->id(), ['role' => 'Manager']);
+            
+            $airline->owner_user_id = $member->id;
+            $airline->save();
+        });
+
+        // re-put the fresh airline into the session
+        session(['activeairline' => $airline]);
+
+        activity()
+            ->causedBy(auth()->user())
+            ->performedOn($airline)
+            ->withProperties(['level' => ActivityLevel::INFO])
+            ->event('airline_ownership_transferred')
+            ->log('Ownership of ' . $airline->name . ' transferred to ' . $member->name);
 
-        return $otherManagers === 0;
+        return back()->with('success', 'Ownership transferred to ' . $member->name . '. You are now a Manager.');
     }
 }
diff --git a/app/Http/Controllers/SetupController.php b/app/Http/Controllers/SetupController.php
index ef25e4c..df81ad7 100644
--- a/app/Http/Controllers/SetupController.php
+++ b/app/Http/Controllers/SetupController.php
@@ -121,6 +121,8 @@ public function store(Request $request)
 
             $user->assignRole($superAdminRole);
             $airline->users()->attach($user, ['role' => 'Manager']);
+            $airline->owner_user_id = $user->id;
+            $airline->save();
 
             auth()->login($user);
             session(['activeairline' => $airline]);
diff --git a/app/Models/Airline.php b/app/Models/Airline.php
index 2ac37c6..47caf01 100644
--- a/app/Models/Airline.php
+++ b/app/Models/Airline.php
@@ -27,6 +27,7 @@ class Airline extends Model
         'active',
         'require_pirep_review',
         'location_continuity',
+        'owner_user_id',
     ];
 
     protected $casts = [
@@ -83,4 +84,14 @@ public function notams(): HasMany
         return $this->hasMany(Notam::class);
     }
 
+    public function owner(): \Illuminate\Database\Eloquent\Relations\BelongsTo
+    {
+        return $this->belongsTo(User::class, 'owner_user_id');
+    }
+
+    public function isOwnedBy(User $u): bool
+    {
+        return $this->owner_user_id !== null && $this->owner_user_id === $u->id;
+    }
+
 }
diff --git a/app/Models/User.php b/app/Models/User.php
index 222462c..273943b 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -103,14 +103,19 @@ public function hasAirlineRole(Airline $airline, string|array $roles): bool
             ->exists();
     }
 
+    public function isOwnerOf(Airline $airline): bool
+    {
+        return $airline->owner_user_id === $this->id;
+    }
+
     public function isManagerOf(Airline $airline): bool
     {
-        return $this->hasAirlineRole($airline, 'Manager');
+        return $this->isOwnerOf($airline) || $this->hasAirlineRole($airline, 'Manager');
     }
 
     public function canReviewFlightsFor(Airline $airline): bool
     {
-        return $this->hasAirlineRole($airline, ['Dispatcher', 'Manager']);
+        return $this->isOwnerOf($airline) || $this->hasAirlineRole($airline, ['Dispatcher', 'Manager']);
     }
 
     public function countNewNotifications() {
diff --git a/database/seeders/AirlineMembershipSeeder.php b/database/seeders/AirlineMembershipSeeder.php
index b7ad9dd..ba0448e 100644
--- a/database/seeders/AirlineMembershipSeeder.php
+++ b/database/seeders/AirlineMembershipSeeder.php
@@ -44,5 +44,30 @@ public function run(): void
                 }
             }
         }
+
+        // Set owners for all airlines
+        $airlines = DB::table('airlines')->get();
+        foreach ($airlines as $airline) {
+            $ownerUserId = DB::table('airline_memberships')
+                ->where('airline_id', $airline->id)
+                ->where('role', 'Manager')
+                ->orderBy('created_at')
+                ->orderBy('id')
+                ->value('user_id');
+
+            if (!$ownerUserId) {
+                $ownerUserId = DB::table('airline_memberships')
+                    ->where('airline_id', $airline->id)
+                    ->orderBy('created_at')
+                    ->orderBy('id')
+                    ->value('user_id');
+            }
+
+            if ($ownerUserId) {
+                DB::table('airlines')
+                    ->where('id', $airline->id)
+                    ->update(['owner_user_id' => $ownerUserId]);
+            }
+        }
     }
 }
diff --git a/resources/views/manager/members.blade.php b/resources/views/manager/members.blade.php
index b00af2f..f033940 100644
--- a/resources/views/manager/members.blade.php
+++ b/resources/views/manager/members.blade.php
@@ -4,6 +4,10 @@
 
 @section('content')
 
+@php
+    $viewerIsOwner = auth()->user()->isOwnerOf($airline);
+@endphp
+
 <div class="d-flex justify-content-between align-items-center mb-4">
     <div>
         <h1 class="h3 mb-1"><i class="bi bi-speedometer2 me-2"></i> Airline Management</h1>
@@ -46,35 +50,69 @@
                     </thead>
                     <tbody>
                         @forelse($members as $member)
+                            @php
+                                $rowIsOwner = $airline->owner_user_id === $member->id;
+                                $rowIsManager = $member->pivot->role === 'Manager';
+                            @endphp
                             <tr>
                                 <td>
                                     <span class="fw-semibold">{{ $member->name }}</span>
                                     @if($member->id === auth()->id())
                                         <span class="badge bg-primary-subtle text-primary border border-primary-subtle ms-1">You</span>
                                     @endif
+                                    @if($rowIsOwner)
+                                        <span class="badge bg-warning-subtle text-warning border border-warning-subtle ms-1"><i class="bi bi-star-fill me-1"></i>Owner</span>
+                                    @endif
                                 </td>
                                 <td>
-                                    <form action="{{ route('members.update', $member) }}" method="POST" class="d-flex gap-2 align-items-center">
-                                        @csrf
-                                        @method('PUT')
-                                        <select name="role" class="form-select form-select-sm" style="width:auto"
-                                                onchange="this.form.querySelector('button').classList.remove('d-none')">
-                                            <option value="Pilot" @selected($member->pivot->role === 'Pilot')>Pilot</option>
-                                            <option value="Dispatcher" @selected($member->pivot->role === 'Dispatcher')>Dispatcher</option>
-                                            <option value="Manager" @selected($member->pivot->role === 'Manager')>Manager</option>
-                                        </select>
-                                        <button type="submit" class="btn btn-sm btn-primary d-none">Save</button>
-                                    </form>
+                                    @if($rowIsOwner)
+                                        <span class="text-muted">Owner</span>
+                                    @else
+                                        @if($rowIsManager && ! $viewerIsOwner)
+                                            <span class="badge bg-secondary-subtle text-secondary border border-secondary-subtle">Manager</span>
+                                        @else
+                                            <form action="{{ route('members.update', $member) }}" method="POST" class="d-flex gap-2 align-items-center">
+                                                @csrf
+                                                @method('PUT')
+                                                <select name="role" class="form-select form-select-sm" style="width:auto"
+                                                        onchange="this.form.querySelector('button').classList.remove('d-none')">
+                                                    <option value="Pilot" @selected($member->pivot->role === 'Pilot')>Pilot</option>
+                                                    <option value="Dispatcher" @selected($member->pivot->role === 'Dispatcher')>Dispatcher</option>
+                                                    @if($viewerIsOwner)
+                                                        <option value="Manager" @selected($member->pivot->role === 'Manager')>Manager</option>
+                                                    @endif
+                                                </select>
+                                                <button type="submit" class="btn btn-sm btn-primary d-none">Save</button>
+                                            </form>
+                                        @endif
+                                    @endif
                                 </td>
                                 <td class="text-end">
-                                    <form action="{{ route('members.destroy', $member) }}" method="POST"
-                                          onsubmit="return confirm('Remove {{ $member->name }} from the airline?')">
-                                        @csrf
-                                        @method('DELETE')
-                                        <button type="submit" class="btn btn-sm btn-outline-danger">
-                                            <i class="bi bi-person-x"></i> Remove
-                                        </button>
-                                    </form>
+                                    @if(! $rowIsOwner)
+                                        <div class="d-flex justify-content-end gap-2">
+                                            @if($viewerIsOwner)
+                                                <form action="{{ route('members.transfer', $member) }}" method="POST"
+                                                      onsubmit="return confirm('Are you sure you want to transfer ownership of this airline to {{ $member->name }}? You will step down to a Manager.')">
+                                                    @csrf
+                                                    @method('PUT')
+                                                    <button type="submit" class="btn btn-sm btn-outline-warning">
+                                                        <i class="bi bi-gift-fill me-1"></i> Make Owner
+                                                    </button>
+                                                </form>
+                                            @endif
+
+                                            @if($viewerIsOwner || ! $rowIsManager)
+                                                <form action="{{ route('members.destroy', $member) }}" method="POST"
+                                                      onsubmit="return confirm('Remove {{ $member->name }} from the airline?')">
+                                                    @csrf
+                                                    @method('DELETE')
+                                                    <button type="submit" class="btn btn-sm btn-outline-danger">
+                                                        <i class="bi bi-person-x"></i> Remove
+                                                    </button>
+                                                </form>
+                                            @endif
+                                        </div>
+                                    @endif
                                 </td>
                             </tr>
                         @empty
diff --git a/routes/web.php b/routes/web.php
index 92ed50c..0b289ca 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -118,6 +118,7 @@
         Route::get('/airline/members', [MemberController::class, 'index'])->name('members.index');
         Route::put('/airline/members/{member}', [MemberController::class, 'update'])->name('members.update');
         Route::delete('/airline/members/{member}', [MemberController::class, 'destroy'])->name('members.destroy');
+        Route::put('/airline/members/{member}/transfer-ownership', [MemberController::class, 'transferOwnership'])->name('members.transfer');
 
         // Announcements / NOTAMs (manager check enforced in controller)
         Route::get('/airline/announcements', [NotamController::class, 'index'])->name('notams.index');
diff --git a/tests/Concerns/SeedsDomain.php b/tests/Concerns/SeedsDomain.php
index 7d83b25..7f1a971 100644
--- a/tests/Concerns/SeedsDomain.php
+++ b/tests/Concerns/SeedsDomain.php
@@ -68,4 +68,18 @@ protected function memberOf(Airline $airline, string $role = 'Pilot'): User
 
         return $user;
     }
+
+    /**
+     * Create a user, attach them to the airline as a Manager, and set them
+     * as the owner of the airline.
+     */
+    protected function ownerOf(Airline $airline): User
+    {
+        $user = User::factory()->create();
+        $user->airlines()->attach($airline->id, ['role' => 'Manager']);
+        $airline->owner_user_id = $user->id;
+        $airline->save();
+
+        return $user;
+    }
 }
diff --git a/tests/Feature/MemberManagementTest.php b/tests/Feature/MemberManagementTest.php
index 9205097..af3963e 100644
--- a/tests/Feature/MemberManagementTest.php
+++ b/tests/Feature/MemberManagementTest.php
@@ -3,14 +3,11 @@
 namespace Tests\Feature;
 
 use App\Models\Airline;
+use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Tests\Concerns\SeedsDomain;
 use Tests\TestCase;
 
-/**
- * Airline Managers can change other members' per-airline roles and remove members,
- * with a guard that the airline is never left without a Manager.
- */
 class MemberManagementTest extends TestCase
 {
     use RefreshDatabase, SeedsDomain;
@@ -26,11 +23,67 @@ private function roleOf($user, Airline $airline): ?string
         return $user->fresh()->airlines()->find($airline->id)?->pivot->role;
     }
 
-    public function test_manager_can_change_a_members_role(): void
+    public function test_founding_sets_owner_and_manager_role(): void
+    {
+        $user = User::factory()->create();
+        $user->assignRole('Super-Admin');
+
+        $this->actingAs($user)
+            ->post(route('airline.found.store'), [
+                'airline_name'     => 'Test Airline',
+                'airline_prefix'   => 'TA',
+                'airline_icao'     => 'TAL',
+                'airline_callsign' => 'TESTAIR',
+                'airline_hub'      => 'EDDF',
+                'airline_country'  => 'DE',
+                'airline_desc'     => 'A test airline',
+                'airline_website'  => 'https://example.com',
+                'airline_founded'  => '2026-07-23',
+                'unit_is_lbs'      => 0,
+            ])
+            ->assertRedirect();
+
+        $airline = Airline::where('icao_callsign', 'TAL')->first();
+        $this->assertNotNull($airline);
+        $this->assertSame($user->id, $airline->owner_user_id);
+        $this->assertTrue($user->isManagerOf($airline));
+        $this->assertSame('Manager', $this->roleOf($user, $airline));
+    }
+
+    public function test_owner_can_promote_pilot_to_manager(): void
     {
         $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
+        $pilot = $this->memberOf($airline, 'Pilot');
+
+        $this->actingAs($owner)
+            ->withSession(['activeairline' => $airline])
+            ->put(route('members.update', $pilot), ['role' => 'Manager'])
+            ->assertRedirect();
+
+        $this->assertSame('Manager', $this->roleOf($pilot, $airline));
+    }
+
+    public function test_owner_can_demote_manager_to_pilot(): void
+    {
+        $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
         $manager = $this->memberOf($airline, 'Manager');
-        $pilot   = $this->memberOf($airline, 'Pilot');
+
+        $this->actingAs($owner)
+            ->withSession(['activeairline' => $airline])
+            ->put(route('members.update', $manager), ['role' => 'Pilot'])
+            ->assertRedirect();
+
+        $this->assertSame('Pilot', $this->roleOf($manager, $airline));
+    }
+
+    public function test_non_owner_manager_can_change_pilot_to_dispatcher(): void
+    {
+        $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
+        $manager = $this->memberOf($airline, 'Manager');
+        $pilot = $this->memberOf($airline, 'Pilot');
 
         $this->actingAs($manager)
             ->withSession(['activeairline' => $airline])
@@ -40,64 +93,136 @@ public function test_manager_can_change_a_members_role(): void
         $this->assertSame('Dispatcher', $this->roleOf($pilot, $airline));
     }
 
-    public function test_manager_can_remove_a_member(): void
+    public function test_non_owner_manager_cannot_promote_to_manager(): void
     {
         $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
         $manager = $this->memberOf($airline, 'Manager');
-        $pilot   = $this->memberOf($airline, 'Pilot');
+        $pilot = $this->memberOf($airline, 'Pilot');
 
         $this->actingAs($manager)
             ->withSession(['activeairline' => $airline])
-            ->delete(route('members.destroy', $pilot))
-            ->assertRedirect();
+            ->put(route('members.update', $pilot), ['role' => 'Manager'])
+            ->assertForbidden();
 
-        $this->assertFalse($airline->isMember($pilot->fresh()));
+        $this->assertSame('Pilot', $this->roleOf($pilot, $airline));
     }
 
-    public function test_last_manager_cannot_be_demoted(): void
+    public function test_non_owner_manager_cannot_demote_manager(): void
     {
         $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
         $manager = $this->memberOf($airline, 'Manager');
+        $otherManager = $this->memberOf($airline, 'Manager');
 
         $this->actingAs($manager)
             ->withSession(['activeairline' => $airline])
-            ->put(route('members.update', $manager), ['role' => 'Pilot'])
-            ->assertSessionHasErrors('role');
+            ->put(route('members.update', $otherManager), ['role' => 'Pilot'])
+            ->assertForbidden();
 
-        $this->assertSame('Manager', $this->roleOf($manager, $airline));
+        $this->assertSame('Manager', $this->roleOf($otherManager, $airline));
     }
 
-    public function test_last_manager_cannot_be_removed(): void
+    public function test_non_owner_manager_cannot_remove_manager(): void
     {
         $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
         $manager = $this->memberOf($airline, 'Manager');
+        $otherManager = $this->memberOf($airline, 'Manager');
 
         $this->actingAs($manager)
             ->withSession(['activeairline' => $airline])
-            ->delete(route('members.destroy', $manager))
-            ->assertSessionHasErrors('member');
+            ->delete(route('members.destroy', $otherManager))
+            ->assertForbidden();
 
-        $this->assertTrue($airline->isMember($manager->fresh()));
+        $this->assertTrue($airline->isMember($otherManager->fresh()));
     }
 
-    public function test_manager_can_be_demoted_when_another_manager_exists(): void
+    public function test_nobody_can_update_or_remove_owner(): void
     {
         $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
         $manager = $this->memberOf($airline, 'Manager');
-        $other   = $this->memberOf($airline, 'Manager');
 
-        $this->actingAs($other)
+        // Manager trying to update owner
+        $this->actingAs($manager)
             ->withSession(['activeairline' => $airline])
-            ->put(route('members.update', $manager), ['role' => 'Pilot'])
+            ->put(route('members.update', $owner), ['role' => 'Pilot'])
+            ->assertForbidden();
+
+        // Manager trying to remove owner
+        $this->actingAs($manager)
+            ->withSession(['activeairline' => $airline])
+            ->delete(route('members.destroy', $owner))
+            ->assertForbidden();
+
+        // Owner trying to demote self
+        $this->actingAs($owner)
+            ->withSession(['activeairline' => $airline])
+            ->put(route('members.update', $owner), ['role' => 'Pilot'])
+            ->assertForbidden();
+
+        // Owner trying to remove self
+        $this->actingAs($owner)
+            ->withSession(['activeairline' => $airline])
+            ->delete(route('members.destroy', $owner))
+            ->assertForbidden();
+
+        $this->assertSame('Manager', $this->roleOf($owner, $airline));
+        $this->assertTrue($airline->isMember($owner->fresh()));
+    }
+
+    public function test_owner_can_transfer_ownership(): void
+    {
+        $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
+        $member = $this->memberOf($airline, 'Pilot');
+
+        $this->actingAs($owner)
+            ->withSession(['activeairline' => $airline])
+            ->put(route('members.transfer', $member))
             ->assertRedirect();
 
-        $this->assertSame('Pilot', $this->roleOf($manager, $airline));
+        $airline = $airline->fresh();
+        $this->assertSame($member->id, $airline->owner_user_id);
+        $this->assertSame('Manager', $this->roleOf($owner, $airline));
+        $this->assertSame('Manager', $this->roleOf($member, $airline));
+        $this->assertSame($airline->owner_user_id, session('activeairline')->owner_user_id);
+    }
+
+    public function test_non_owner_cannot_transfer_ownership(): void
+    {
+        $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
+        $manager = $this->memberOf($airline, 'Manager');
+        $pilot = $this->memberOf($airline, 'Pilot');
+
+        $this->actingAs($manager)
+            ->withSession(['activeairline' => $airline])
+            ->put(route('members.transfer', $pilot))
+            ->assertForbidden();
+
+        $this->assertSame($owner->id, $airline->fresh()->owner_user_id);
+    }
+
+    public function test_owner_cannot_transfer_to_self(): void
+    {
+        $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
+
+        $this->actingAs($owner)
+            ->withSession(['activeairline' => $airline])
+            ->put(route('members.transfer', $owner))
+            ->assertStatus(422);
+
+        $this->assertSame($owner->id, $airline->fresh()->owner_user_id);
     }
 
     public function test_non_manager_cannot_access_members(): void
     {
         $airline = Airline::factory()->create();
-        $pilot   = $this->memberOf($airline, 'Pilot');
+        $owner = $this->ownerOf($airline);
+        $pilot = $this->memberOf($airline, 'Pilot');
 
         $this->actingAs($pilot)
             ->withSession(['activeairline' => $airline])
@@ -108,6 +233,7 @@ public function test_non_manager_cannot_access_members(): void
     public function test_manager_cannot_update_member_of_another_airline(): void
     {
         $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
         $manager = $this->memberOf($airline, 'Manager');
 
         $otherAirline = Airline::factory()->create();
@@ -118,4 +244,19 @@ public function test_manager_cannot_update_member_of_another_airline(): void
             ->put(route('members.update', $outsider), ['role' => 'Manager'])
             ->assertForbidden();
     }
+
+    public function test_manager_can_remove_pilot(): void
+    {
+        $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
+        $manager = $this->memberOf($airline, 'Manager');
+        $pilot = $this->memberOf($airline, 'Pilot');
+
+        $this->actingAs($manager)
+            ->withSession(['activeairline' => $airline])
+            ->delete(route('members.destroy', $pilot))
+            ->assertRedirect();
+
+        $this->assertFalse($airline->isMember($pilot->fresh()));
+    }
 }

From 9743cbb3578a563f47aec906354c5b964267e78c Mon Sep 17 00:00:00 2001
From: Marc Sauer <info@marcsauer.net>
Date: Thu, 23 Jul 2026 11:59:31 +0200
Subject: [PATCH 4/4] removed a bug that we see the add aircraft button
 although not a manager

---
 app/Providers/AppServiceProvider.php          | 16 ++++++-
 ..._23_114200_add_owner_to_airlines_table.php | 48 +++++++++++++++++++
 tests/Feature/MemberManagementTest.php        | 36 ++++++++++++++
 3 files changed, 99 insertions(+), 1 deletion(-)
 create mode 100644 database/migrations/2026_07_23_114200_add_owner_to_airlines_table.php

diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php
index d6b3856..3ae1a62 100644
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -148,7 +148,21 @@ public function boot(): void
         });
 
         Gate::before(function ($user, $ability) {
-            return $user->hasRole('Super-Admin') ? true : null;
+            $activeAirline = session('activeairline');
+            if ($activeAirline) {
+                if ($ability === 'add aircraft' || $ability === 'edit aircraft') {
+                    return $user->isManagerOf($activeAirline);
+                }
+                if ($ability === 'review flight') {
+                    return $user->canReviewFlightsFor($activeAirline);
+                }
+            }
+
+            if ($user->hasRole('Super-Admin')) {
+                return true;
+            }
+
+            return null;
         });
     }
 }
\ No newline at end of file
diff --git a/database/migrations/2026_07_23_114200_add_owner_to_airlines_table.php b/database/migrations/2026_07_23_114200_add_owner_to_airlines_table.php
new file mode 100644
index 0000000..6991341
--- /dev/null
+++ b/database/migrations/2026_07_23_114200_add_owner_to_airlines_table.php
@@ -0,0 +1,48 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('airlines', function (Blueprint $table) {
+            $table->foreignId('owner_user_id')->nullable()->after('id')->constrained('users')->nullOnDelete();
+        });
+
+        // Backfill
+        $airlines = DB::table('airlines')->get();
+        foreach ($airlines as $airline) {
+            $ownerUserId = DB::table('airline_memberships')
+                ->where('airline_id', $airline->id)
+                ->where('role', 'Manager')
+                ->orderBy('created_at')
+                ->orderBy('id')
+                ->value('user_id');
+
+            if (!$ownerUserId) {
+                $ownerUserId = DB::table('airline_memberships')
+                    ->where('airline_id', $airline->id)
+                    ->orderBy('created_at')
+                    ->orderBy('id')
+                    ->value('user_id');
+            }
+
+            if ($ownerUserId) {
+                DB::table('airlines')
+                    ->where('id', $airline->id)
+                    ->update(['owner_user_id' => $ownerUserId]);
+            }
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::table('airlines', function (Blueprint $table) {
+            $table->dropConstrainedForeignId('owner_user_id');
+        });
+    }
+};
diff --git a/tests/Feature/MemberManagementTest.php b/tests/Feature/MemberManagementTest.php
index af3963e..f136ede 100644
--- a/tests/Feature/MemberManagementTest.php
+++ b/tests/Feature/MemberManagementTest.php
@@ -259,4 +259,40 @@ public function test_manager_can_remove_pilot(): void
 
         $this->assertFalse($airline->isMember($pilot->fresh()));
     }
+
+    public function test_ownership_transfer_preserves_add_aircraft_permission_for_both(): void
+    {
+        $airline = Airline::factory()->create();
+        $owner = $this->ownerOf($airline);
+        $member = $this->memberOf($airline, 'Pilot');
+
+        // Transfer ownership
+        $this->actingAs($owner)
+            ->withSession(['activeairline' => $airline])
+            ->put(route('members.transfer', $member))
+            ->assertRedirect();
+
+        // New owner (was Pilot) can add aircraft
+        $this->actingAs($member->fresh())
+            ->withSession(['activeairline' => $airline])
+            ->get(route('createaircraft'))
+            ->assertOk();
+
+        // Old owner (now Manager) can also still add aircraft
+        $this->actingAs($owner->fresh())
+            ->withSession(['activeairline' => $airline])
+            ->get(route('createaircraft'))
+            ->assertOk();
+    }
+
+    public function test_pilot_does_not_have_add_aircraft_permission_on_active_airline(): void
+    {
+        $airline = Airline::factory()->create();
+        $pilot = $this->memberOf($airline, 'Pilot');
+
+        $this->actingAs($pilot)
+            ->withSession(['activeairline' => $airline])
+            ->get(route('createaircraft'))
+            ->assertForbidden();
+    }
 }