✨ Add leader-based permissions to Meetup event tests and editable scope

- 🔒 Ensure leader users are required for Meetup event tests to simulate accurate permissions.
- ➕ Add `editableBy` scope to `MeetupEvent` model for consistent editable event handling.
- 🛠️ Refactor `mine` API endpoint and MCP tool to leverage `editableBy` scope.
- 🧪 Update tests to verify leader-based accessibility for Meetup events.

tests/Feature/Api/MeetupEventWriteApiTest.php

@@ -106,17 +106,28 @@ it('forbids updating someone elses', function () {
     $response->assertForbidden();
 });
 
-it('returns only own in mine index', function () {
+it('returns own and led-meetup events in mine index', function () {
     Sanctum::actingAs($user = User::factory()->create());
 
+    // 2 selbst angelegt
     MeetupEvent::factory()->count(2)->create(['created_by' => $user->id]);
+
+    // 1 Termin eines Co-Leaders im selben (von $user geführten) Meetup -> sichtbar
+    $ledMeetup = Meetup::factory()->create();
+    $ledMeetup->users()->syncWithoutDetaching([$user->id => ['is_leader' => true]]);
+    MeetupEvent::factory()->create([
+        'meetup_id' => $ledMeetup->id,
+        'created_by' => User::factory()->create()->id,
+    ]);
+
+    // 1 fremder Termin in einem Meetup ohne Leaderschaft -> NICHT sichtbar
     MeetupEvent::factory()->create(['created_by' => User::factory()->create()->id]);
 
     $response = $this->getJson('/api/my-meetup-events');
 
     $response->assertSuccessful();
 
-    expect($response->json('data'))->toHaveCount(2);
+    expect($response->json('data'))->toHaveCount(3);
 });
 
 it('forbids viewing someone elses in mine show', function () {

tests/Feature/Livewire/MeetupMountTest.php

@@ -70,12 +70,14 @@ it('aborts meetups.edit with 403 when the user is neither creator nor super-admi
 });
 
 it('mounts meetups.create-edit-events for new event', function () {
-    actingAsUser();
+    $leader = actingAsUser();
+    $this->meetup->users()->syncWithoutDetaching([$leader->id => ['is_leader' => true]]);
     Livewire::test('meetups.create-edit-events', ['meetup' => $this->meetup])->assertStatus(200);
 });
 
 it('mounts meetups.create-edit-events for existing event', function () {
-    actingAsUser();
+    $leader = actingAsUser();
+    $this->meetup->users()->syncWithoutDetaching([$leader->id => ['is_leader' => true]]);
     Livewire::test('meetups.create-edit-events', [
         'meetup' => $this->meetup,
         'event' => $this->event,
@@ -83,7 +85,8 @@ it('mounts meetups.create-edit-events for existing event', function () {
 });
 
 it('does not crash with PropertyNotFoundException when startDate is set to null in series mode', function () {
-    actingAsUser();
+    $leader = actingAsUser();
+    $this->meetup->users()->syncWithoutDetaching([$leader->id => ['is_leader' => true]]);
     Livewire::test('meetups.create-edit-events', ['meetup' => $this->meetup])
         ->set('seriesMode', true)
         ->set('endDate', '2026-10-27')
@@ -93,7 +96,8 @@ it('does not crash with PropertyNotFoundException when startDate is set to null
 });
 
 it('does not crash when endDate is set to null in series mode', function () {
-    actingAsUser();
+    $leader = actingAsUser();
+    $this->meetup->users()->syncWithoutDetaching([$leader->id => ['is_leader' => true]]);
     Livewire::test('meetups.create-edit-events', ['meetup' => $this->meetup])
         ->set('seriesMode', true)
         ->set('endDate', null)
@@ -102,7 +106,8 @@ it('does not crash when endDate is set to null in series mode', function () {
 });
 
 it('does not crash when startTime is set to null', function () {
-    actingAsUser();
+    $leader = actingAsUser();
+    $this->meetup->users()->syncWithoutDetaching([$leader->id => ['is_leader' => true]]);
     Livewire::test('meetups.create-edit-events', ['meetup' => $this->meetup])
         ->set('startTime', null)
         ->assertStatus(200)

tests/Feature/Mcp/MeetupEventMcpToolTest.php

@@ -11,7 +11,7 @@ use App\Models\User;
 
 it('lets an authenticated user create a meetup event and stamps created_by', function () {
     $user = User::factory()->create();
-    $meetup = Meetup::factory()->create();
+    $meetup = Meetup::factory()->create(['created_by' => $user->id]);
 
     $response = EinundzwanzigServer::actingAs($user)->tool(CreateMeetupEventTool::class, [
         'meetup_id' => $meetup->id,

tests/Feature/Mcp/MeetupMembershipMcpTest.php

@@ -53,11 +53,27 @@ it('makes the creator a leader so the meetup shows in my meetups', function () {
     ]);
 });
 
-it('lets a member add an event to a joined meetup', function () {
+it('forbids a non-leader member from adding an event but allows a leader', function () {
     $user = User::factory()->create();
     $meetup = Meetup::factory()->create(['name' => 'Einundzwanzig Dortmund']);
     $meetup->users()->attach($user->id, ['is_leader' => false]);
 
+    // Reines Mitglied (is_leader = false) darf keinen Termin anlegen.
+    EinundzwanzigServer::actingAs($user)
+        ->tool(CreateMeetupEventTool::class, [
+            'meetup' => 'Einundzwanzig Dortmund',
+            'start' => '2026-08-01 18:00:00',
+        ])
+        ->assertHasErrors();
+
+    $this->assertDatabaseMissing('meetup_events', [
+        'meetup_id' => $meetup->id,
+        'created_by' => $user->id,
+    ]);
+
+    // Als Leader darf derselbe Nutzer den Termin anlegen.
+    $meetup->users()->syncWithoutDetaching([$user->id => ['is_leader' => true]]);
+
     EinundzwanzigServer::actingAs($user)
         ->tool(CreateMeetupEventTool::class, [
             'meetup' => 'Einundzwanzig Dortmund',