diff --git a/database/factories/PermissionFactory.php b/database/factories/PermissionFactory.php
index d2cec7f..365446d 100644
--- a/database/factories/PermissionFactory.php
+++ b/database/factories/PermissionFactory.php
@@ -17,7 +17,9 @@ class PermissionFactory extends Factory
     public function definition(): array
     {
         return [
-            //
+            'name' => $this->faker->unique()->slug,
+            'name_fa' => $this->faker->word,
+            'guard_name' => 'web',
         ];
     }
 }
diff --git a/database/factories/ProvinceFactory.php b/database/factories/ProvinceFactory.php
index 767b375..891ea6e 100644
--- a/database/factories/ProvinceFactory.php
+++ b/database/factories/ProvinceFactory.php
@@ -17,7 +17,9 @@ class ProvinceFactory extends Factory
     public function definition(): array
     {
         return [
-            //
+            'name' => $this->faker->state,
+            'lat' => $this->faker->latitude,
+            'lon' => $this->faker->longitude,
         ];
     }
 }
diff --git a/database/factories/RoleFactory.php b/database/factories/RoleFactory.php
index b825646..5dbe458 100644
--- a/database/factories/RoleFactory.php
+++ b/database/factories/RoleFactory.php
@@ -17,7 +17,9 @@ class RoleFactory extends Factory
     public function definition(): array
     {
         return [
-            //
+            'name' => $this->faker->unique()->slug,
+            'name_fa' => $this->faker->unique()->word,
+            'guard_name' => 'web',
         ];
     }
 }
diff --git a/resources/lang/fa/validation.php b/resources/lang/fa/validation.php
index b92f5eb..4eb1325 100644
--- a/resources/lang/fa/validation.php
+++ b/resources/lang/fa/validation.php
@@ -204,7 +204,10 @@ return [
         'category_id' => 'موضوع',
         'subcategory_id' => 'زیر موضوع',
         'description' => 'توضیحات',
-        'size' => 'حداکثر تعداد'
+        'size' => 'حداکثر تعداد',
+        'extension' => 'کد تلفن',
+        'caller_id' => 'شماره تماس‌گیرنده',
+        'role_id' => 'شناسه نقش ',
     ],
 
 ];
diff --git a/routes/web.php b/routes/web.php
index 5714891..c95f079 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -54,12 +54,14 @@ Route::prefix('server')->group(function () {
     Route::prefix('categories')
         ->middleware('auth')
         ->controller(CategoryController::class)
+        ->name('categories.')
         ->group(function () {
-            Route::get('/list', 'list');
+            Route::get('/list', 'list')->name('list');
         });
 
     Route::middleware('auth')
         ->prefix('permissions')
+        ->name('permissions.')
         ->controller(PermissionManagementController::class)
         ->group(function () {
             Route::get('/', 'index')->name('index');
@@ -72,19 +74,21 @@ Route::prefix('server')->group(function () {
 
     Route::prefix('provinces')
         ->controller(ProvinceController::class)
+        ->name('provinces.')
         ->group(function () {
             Route::get('/list', 'list')->name('list');
         });
 
     Route::middleware('auth')
         ->prefix('roles')
+        ->name('roles.')
         ->controller(RoleManagementController::class)
         ->group(function () {
             Route::get('/', 'index')->name('index');
             Route::get('list', 'list')->name('list');
             Route::post('/', 'store')->name('store');
-            Route::get('/{roll}', 'show')->name('show');
-            Route::post('/{roll}', 'update')->name('update');
-            Route::delete('/{roll}', 'destroy')->name('destroy');
+            Route::get('/{role}', 'show')->name('show');
+            Route::post('/{role}', 'update')->name('update');
+            Route::delete('/{role}', 'destroy')->name('destroy');
         });
 });
diff --git a/tests/Feature/Auth/LoginTest.php b/tests/Feature/Auth/LoginTest.php
new file mode 100644
index 0000000..cdc9e28
--- /dev/null
+++ b/tests/Feature/Auth/LoginTest.php
@@ -0,0 +1,73 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Models\Province;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class LoginTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_user_can_login()
+    {
+        $user = User::factory()
+            ->create([
+                'password' => bcrypt('password'),
+                'province_id' => Province::factory()
+            ]);
+
+        $response = $this->postJson('/server/auth/login', [
+            'username' => $user->username,
+            'password' => 'password',
+            'telephone_id' => $this->faker->numerify('TID####')
+        ]);
+
+        $response->assertOk()
+            ->assertJson([
+                'message' => __('messages.successful'),
+            ]);
+
+        $this->assertAuthenticatedAs($user);
+    }
+
+    public function test_username_is_required()
+    {
+        $response = $this->postJson('/server/auth/login', [
+            'password' => 'password',
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'username' => __('validation.required', ['attribute' => 'نام کاربری']),
+            ]);
+    }
+
+
+    public function test_password_is_required()
+    {
+        $response = $this->postJson('/server/auth/login', [
+            'username' => $this->faker->lexify('?????'),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'password' => __('validation.required', ['attribute' => 'رمز عبور'])
+            ]);
+    }
+
+    public function test_telephone_id_is_required()
+    {
+        $response = $this->postJson('/server/auth/login', [
+            'username' => $this->faker->lexify('?????'),
+            'password' => 'password',
+        ]);
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'telephone_id' => __('validation.required', ['attribute' => 'کد تلفن'])
+            ]);
+    }
+}
diff --git a/tests/Feature/Call/ListTest.php b/tests/Feature/Call/ListTest.php
new file mode 100644
index 0000000..eba7d04
--- /dev/null
+++ b/tests/Feature/Call/ListTest.php
@@ -0,0 +1,114 @@
+<?php
+
+namespace Tests\Feature\Call;
+
+use App\Models\Call;
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Illuminate\Testing\Fluent\AssertableJson;
+use Tests\TestCase;
+
+class ListTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $response = $this->getJson(route('calls.list'));
+        $response->assertStatus(401);
+    }
+
+    public function test_user_without_permission_cannot_access(): void
+    {
+        $user = User::factory()->create();
+        $this->actingAs($user);
+
+        $response = $this->getJson(route('calls.list'));
+        $response->assertForbidden();
+    }
+
+    public function test_size_must_be_integer(): void
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_calls',
+                'name_fa' => 'مدیریت تماس‌ها',
+            ]))->create();
+        $this->actingAs($user);
+
+        $response = $this->getJson(route('calls.list', [
+            'size' => $this->faker->word,
+            ]));
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'size' => __('validation.integer', ['attribute' => 'حداکثر تعداد']),
+            ]);
+    }
+
+    public function test_calls_are_limited_by_size_parameter(): void
+    {
+
+        $user = User::factory()
+            ->has(Permission::factory()->state([
+                'id' => 3,
+                'name' => 'manage_calls',
+                'name_fa' => 'مدیریت تماس‌ها',
+            ]))
+            ->create();
+        Call::factory()->count(5)->create();
+
+
+        $response = $this->actingAs($user)->getJson(route('calls.list', [
+            'size' => $this->faker->numberBetween(1, 4),
+        ]));
+
+        $response->assertOk()
+            ->assertJson(fn (AssertableJson $json) =>
+            $json->has('data')
+                ->has('data.0', fn (AssertableJson $json) => $json->hasAll([
+                    'id',
+                    'operator_id',
+                    'operator_full_name',
+                    'operator_username',
+                    'telephone_id',
+                    'caller_phone_number',
+                    'description',
+                    'category_id',
+                    'category_name',
+                    'subcategory_id',
+                    'subcategory_name',
+                    'created_at',
+                ]))
+            );
+
+    }
+
+
+    public function test_calls_are_filtered_by_phone_number(): void
+    {
+        $user = User::factory()
+        ->has(Permission::factory([
+            'name' => 'manage_calls',
+            'name_fa' => 'مدیریت تماس‌ها',
+        ]))->create();
+
+        $targetPhone = '09' . $this->faker->numberBetween(100000000, 999999999);
+
+        Call::factory()->count(4)->create([
+            'caller_phone_number' => $targetPhone,
+        ]);
+
+        Call::factory()->count(2)->create();
+
+
+        $response = $this->actingAs($user)->getJson(route('calls.list', ['phone_number' => $targetPhone]));
+
+        $response->assertOk()
+            ->assertJsonCount(4, 'data')
+            ->assertJsonFragment(['caller_phone_number' => $targetPhone]);
+    }
+
+}
diff --git a/tests/Feature/Call/StoreTest.php b/tests/Feature/Call/StoreTest.php
new file mode 100644
index 0000000..a1b372c
--- /dev/null
+++ b/tests/Feature/Call/StoreTest.php
@@ -0,0 +1,118 @@
+<?php
+
+namespace Tests\Feature\Call;
+
+use App\Models\Event;
+use App\Models\User;
+use App\Enums\CallEvents;
+use App\Services\Notification\NotificationService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Mockery\MockInterface;
+use Tests\TestCase;
+
+class StoreTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_validation_fails_when_required_fields_are_missing(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('calls.store'));
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'extension' => __('validation.required', ['attribute' => 'کد تلفن']),
+                'caller_id' => __('validation.required', ['attribute' => 'شماره تماس‌گیرنده']),
+            ]);
+    }
+
+    public function test_extension_must_be_string(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('calls.store'), [
+            'extension' => $this->faker->numberBetween(1000, 9999),
+            'caller_id' => $this->faker->randomNumber(),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'extension' => __('validation.string', ['attribute' => 'کد تلفن']),
+            ]);
+    }
+
+    public function test_extension_must_exist_in_users_table(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('calls.store'), [
+            'extension' => $this->faker->uuid,
+            'caller_id' => $this->faker->randomNumber(),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'extension' => __('validation.exists', ['attribute' => 'کد تلفن']),
+            ]);
+    }
+
+    public function test_caller_id_must_be_numeric(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('calls.store'), [
+            'extension' => $user->telephone_id,
+            'caller_id' => $this->faker->word(),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'caller_id' => __('validation.numeric', ['attribute' => 'شماره تماس‌گیرنده']),
+            ]);
+    }
+
+    public function test_can_create_a_call(): void
+    {
+        $operator = User::factory()->create([
+            'telephone_id' => $this->faker->unique()->numerify('###'),
+        ]);
+
+        $this->artisan('db:seed --class=EventSeeder');
+
+        $this->mock(NotificationService::class, function (MockInterface $mock) {
+            $mock->shouldReceive('deliverDataToNotificationServer');
+        });
+
+        $callerId = $this->faker->numerify('09#########');
+
+        $response = $this->postJson(route('calls.store'), [
+            'extension' => $operator->telephone_id,
+            'caller_id' => $callerId,
+        ]);
+
+        $response->assertStatus(200)
+            ->assertExactJson([
+                'message' => __('messages.successful'),
+            ]);
+
+        $this->assertDatabaseHas('calls', [
+            'caller_phone_number' => $callerId,
+            'telephone_id' => $operator->telephone_id,
+            'operator_id' => $operator->id,
+            'operator_username' => $operator->username,
+            'operator_full_name' => $operator->full_name,
+        ]);
+
+        $event = Event::query()->where('id', CallEvents::CALL_CREATED)->first();
+
+        $this->assertDatabaseHas('call_histories', [
+            'event_name' => $event->name,
+            'event_id' => $event->id,
+            'caller_phone_number' => $callerId,
+            'telephone_id' => $operator->telephone_id,
+        ]);
+    }
+
+}
diff --git a/tests/Feature/Call/UpdateTest.php b/tests/Feature/Call/UpdateTest.php
new file mode 100644
index 0000000..a60db06
--- /dev/null
+++ b/tests/Feature/Call/UpdateTest.php
@@ -0,0 +1,252 @@
+<?php
+
+namespace Tests\Feature\Call;
+
+use App\Enums\CallEvents;
+use App\Models\Call;
+use App\Models\Category;
+use App\Models\Permission;
+use App\Models\User;
+use Database\Seeders\EventSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class UpdateTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_operator_is_not_authenticated(): void
+    {
+        $response = $this->postJson(route('calls.update', ['call' => 1]));
+
+        $response->assertUnauthorized();
+    }
+
+    public function test_operator_without_unappropriated_permission_is_forbidden_to_access_calls_data(): void
+    {
+        $telephoneId = 'tel-' . $this->faker->unique()->numerify('###');
+
+        $user = User::factory()
+            ->create([
+                'telephone_id' => $telephoneId,
+            ]);
+
+        $call = Call::factory()->create([
+            'telephone_id' => $telephoneId,
+        ]);
+
+        $response = $this->actingAs($user)->postJson(route('calls.update', ['call' => $call->id]));
+
+        $response->assertForbidden();
+    }
+
+    public function test_operator_can_not_access_to_other_operators_calls(): void
+    {
+
+        $telephoneId = 'tel-' . $this->faker->unique()->numerify('###');
+
+        $user = User::factory()
+            ->create([
+                'telephone_id' => $telephoneId,
+            ]);
+
+        $another_operator = User::factory([
+            'id' => $this->faker->randomNumber(2, true)
+        ])->create();
+
+        $call = Call::factory([
+            'telephone_id' => $another_operator->telephone_id
+        ])->create();
+
+        $response = $this->actingAs($user)->postJson(route('calls.update', ['call' => $call->id]));
+
+        $response->assertForbidden();
+    }
+
+
+    public function test_non_owner_user_cannot_update_call(): void
+    {
+        $callOwner = User::factory()->create([
+            'telephone_id' => 'tel-' . $this->faker->unique()->numerify('###'),
+        ]);
+
+        $call = Call::factory()->create([
+            'telephone_id' => $callOwner->telephone_id,
+        ]);
+
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('calls.update', $call->id), [
+            'category_id' => $this->faker->randomNumber(),
+            'subcategory_id' =>  $this->faker->randomNumber(),
+            'description' => $this->faker->sentence
+        ]);
+
+        $response->assertForbidden();
+    }
+
+    public function test_validation_fails_when_required_fields_are_missing(): void
+    {
+        $telephoneId = 'tel-' . $this->faker->unique()->numerify('###');
+
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_calls',
+                'name_fa' => 'مدیریت تماس‌ها',
+            ]))
+            ->create([
+                'telephone_id' => $telephoneId,
+            ]);
+
+        $call = Call::factory()->create([
+            'telephone_id' => $telephoneId,
+        ]);
+
+        $response = $this->actingAs($user)->postJson(route('calls.update', $call->id), []);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'category_id' => __('validation.required', ['attribute' => 'موضوع']),
+                'subcategory_id' => __('validation.required', ['attribute' => 'زیر موضوع']),
+            ]);
+    }
+
+    public function test_category_id_and_subcategory_id_must_be_integers(): void
+    {
+        $telephoneId = 'tel-' . $this->faker->unique()->numerify('###');
+
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_calls',
+                'name_fa' => 'مدیریت تماس‌ها',
+            ]))
+            ->create([
+                'telephone_id' => $telephoneId,
+            ]);
+
+        $call = Call::factory()->create([
+            'telephone_id' =>$user->telephone_id,
+        ]);
+
+        $response =  $this->actingAs($user)->postJson(route('calls.update', $call->id), [
+            'category_id' =>$this->faker->sentence(3),
+            'subcategory_id' =>  $this->faker->sentence(3),
+            'description' => $this->faker->sentence,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'category_id' => __('validation.integer', ['attribute' => 'موضوع']),
+                'subcategory_id' => __('validation.integer', ['attribute' => 'زیر موضوع']),
+            ]);
+    }
+
+    public function test_description_field_must_be_string(): void
+    {
+        $telephoneId = 'tel-' . $this->faker->unique()->numerify('###');
+
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_calls',
+                'name_fa' => 'مدیریت تماس‌ها',
+            ]))
+            ->create([
+                'telephone_id' => $telephoneId,
+            ]);
+
+        $call = Call::factory()->create([
+            'telephone_id' => $telephoneId,
+        ]);
+
+
+
+        $response = $this->actingAs($user)->postJson(route('calls.update', $call->id), [
+            'category_id' => $this->faker->randomNumber(),
+            'subcategory_id' =>  $this->faker->randomNumber(),
+            'description' => $this->faker->randomNumber(),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'description' => __('validation.string', ['attribute' => 'توضیحات']),
+            ]);
+    }
+
+    public function test_combination_of_category_and_subcategory_must_exist(): void
+    {
+        $telephoneId = 'tel-' . $this->faker->unique()->numerify('###');
+
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_calls',
+                'name_fa' => 'مدیریت تماس‌ها',
+            ]))
+            ->create([
+                'telephone_id' => $telephoneId,
+            ]);
+
+        $call = Call::factory()->create([
+            'telephone_id' => $telephoneId,
+        ]);
+
+
+
+        $response =  $this->actingAs($user)->postJson(route('calls.update', $call->id), [
+            'category_id' => $this->faker->randomNumber(),
+            'subcategory_id' =>  $this->faker->randomNumber(),
+            'description' => $this->faker->sentence,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'category' => __('messages.combination_of_category_and_subcategory_does_not_exist'),
+            ]);
+    }
+
+    public function test_operator_can_update_call_successfully(): void
+    {
+        $telephoneId = 'tel-' . $this->faker->unique()->numerify('###');
+
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_calls',
+                'name_fa' => 'مدیریت تماس‌ها',
+            ]))
+            ->create([
+                'telephone_id' => $telephoneId,
+            ]);
+
+        $call = Call::factory()->create([
+            'telephone_id' => $telephoneId,
+        ]);
+
+        $this->seed(EventSeeder::class);
+
+        $category = Category::factory()->create();
+        $description = $this->faker->sentence;
+
+        $response = $this->actingAs($user)->postJson(route('calls.update', $call->id), [
+            'category_id' => $category->category_id,
+            'subcategory_id' => $category->subcategory_id,
+            'description' => $description,
+            ]);
+
+        $response->assertOk()
+            ->assertJson([
+                'message' => __('messages.successful'),
+            ]);
+
+        $this->assertDatabaseHas('calls', [
+            'id' => $call->id,
+            'category_id' => $category->category_id,
+            'subcategory_id' => $category->subcategory_id,
+            'description' => $description,
+            ]);
+
+        $this->assertDatabaseHas('call_histories', [
+            'call_id' => $call->id,
+            'event_id' => CallEvents::OPERATOR_STORED_CALL_DATA,
+        ]);
+    }
+}
diff --git a/tests/Feature/Category/ListTest.php b/tests/Feature/Category/ListTest.php
new file mode 100644
index 0000000..f02aa60
--- /dev/null
+++ b/tests/Feature/Category/ListTest.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace Tests\Feature\Category;
+
+use App\Models\Category;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class ListTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_guest_user_cannot_access_list(): void
+    {
+        $response = $this->getJson(route('categories.list'));
+        $response->assertUnauthorized();
+    }
+    public function test_user_can_see_list(): void
+    {
+        $user = User::factory()->create();
+        $response = $this->actingAs($user)->getJson(route('categories.list'));
+
+        Category::factory()->count(3)->create();
+
+        $response->assertOk();
+        $response->assertJsonStructure([
+            'data' => [
+                '*' => [
+                    'id',
+                    'category_id',
+                    'category_name',
+                    'subcategory_id',
+                    'subcategory_name'
+                ],
+            ]
+        ]);
+
+    }
+}
diff --git a/tests/Feature/Permission/DeleteTest.php b/tests/Feature/Permission/DeleteTest.php
new file mode 100644
index 0000000..d390457
--- /dev/null
+++ b/tests/Feature/Permission/DeleteTest.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class DeleteTest extends TestCase
+{
+   use RefreshDatabase, WithFaker;
+
+
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $permission = Permission::factory()->create();
+        $response = $this->getJson(route('permissions.destroy',[$permission->id]));
+        $response->assertUnauthorized();
+    }
+
+    public function test_authenticated_user_can_delete_permission(): void
+    {
+        $user = User::factory()->create();
+        $permission = Permission::factory()->create();
+
+        $response = $this->actingAs($user)->deleteJson(route('permissions.destroy', [$permission->id]));
+
+        $response->assertOk()
+            ->assertJson([
+                'message' => __('messages.successful'),
+            ]);
+
+        $this->assertDatabaseMissing('permissions', [
+            'id' => $permission->id,
+        ]);
+    }
+
+    public function test_guest_cannot_delete_permission(): void
+    {
+        $permission = Permission::factory()->create();
+
+        $response = $this->deleteJson(route('permissions.destroy', [$permission->id]));
+
+        $response->assertUnauthorized();
+    }
+
+}
diff --git a/tests/Feature/Permission/IndexTest.php b/tests/Feature/Permission/IndexTest.php
new file mode 100644
index 0000000..b0971e1
--- /dev/null
+++ b/tests/Feature/Permission/IndexTest.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class IndexTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $response = $this->getJson(route('permissions.index'));
+        $response->assertUnauthorized();
+    }
+
+    public function test_all_permissions_returned_successfully(): void
+    {
+        $user = User::factory()
+            ->create();
+
+        $response = $this->actingAs($user)->getJson(route('permissions.index'));
+
+        $response->assertOk();
+
+        $response->assertJsonStructure([
+            'data' => [
+                '*' => [
+                    'id',
+                    'name',
+                    'name_fa',
+                    'guard_name',
+                    'created_at',
+                    'updated_at',
+                ],
+            ]
+        ]);
+
+    }
+}
diff --git a/tests/Feature/Permission/ListTest.php b/tests/Feature/Permission/ListTest.php
new file mode 100644
index 0000000..79ad422
--- /dev/null
+++ b/tests/Feature/Permission/ListTest.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Illuminate\Testing\Fluent\AssertableJson;
+use Tests\TestCase;
+
+class ListTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $response = $this->getJson(route('permissions.list'));
+        $response->assertUnauthorized();
+    }
+
+
+    public function test_guest_user_cannot_access_list(): void
+    {
+        $response = $this->getJson(route('permissions.list'));
+
+        $response->assertUnauthorized();
+    }
+
+    public function test_permissions_list_returns_correct_structure(): void
+    {
+        $user = User::factory()
+            ->create();
+
+        Permission::factory()->count(3)->create();
+
+        $response = $this->actingAs($user)->getJson(route('permissions.list'));
+
+        $response->assertOk()
+            ->assertJsonStructure([
+                'data' => [
+                    '*' => [
+                        'id',
+                        'name',
+                        'name_fa',
+                    ]
+                ]
+            ]);
+    }
+
+}
diff --git a/tests/Feature/Permission/SHowTest.php b/tests/Feature/Permission/SHowTest.php
new file mode 100644
index 0000000..d7a4a90
--- /dev/null
+++ b/tests/Feature/Permission/SHowTest.php
@@ -0,0 +1,48 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class SHowTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_guest_cannot_view_permission(): void
+    {
+        $permission = Permission::factory()->create();
+
+        $response = $this->getJson(route('permissions.show', [$permission->id]));
+
+        $response->assertUnauthorized();
+    }
+    public function test_permission_show_returns_correct_structure_and_data(): void
+    {
+        $user = User::factory()
+            ->create();
+
+        $permission = Permission::factory()->create([
+            'name' => 'edit-posts',
+            'name_fa' => 'ویرایش پست‌ها',
+            'guard_name' => 'web',
+        ]);
+
+        $response = $this->actingAs($user)->getJson(route('permissions.show', [$permission->id]));
+
+        $response->assertOk()
+            ->assertJson([
+                'data' => [
+                    'id' => $permission->id,
+                    'name' => 'edit-posts',
+                    'name_fa' => 'ویرایش پست‌ها',
+                    'guard_name' => 'web',
+                ]
+            ]);
+    }
+
+
+}
diff --git a/tests/Feature/Permission/StoreTest.php b/tests/Feature/Permission/StoreTest.php
new file mode 100644
index 0000000..cbd4942
--- /dev/null
+++ b/tests/Feature/Permission/StoreTest.php
@@ -0,0 +1,117 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class StoreTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_user_must_be_authenticated(): void
+    {
+        $response = $this->postJson(route('permissions.store'), []);
+        $response->assertUnauthorized();
+    }
+
+    public function test_name_and_name_fa_fields_are_required(): void
+    {
+        $user = User::factory()->create();
+
+
+        $response =  $this->actingAs($user)->postJson(route('permissions.store'));
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.required', ['attribute' => 'نام']),
+                'name_fa' => __('validation.required', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+    public function test_name_and_name_fa_fields_must_be_unique(): void
+    {
+        $user = User::factory()->create();
+
+        $duplicateName = $this->faker->unique()->slug;
+        $duplicateNameFa = $this->faker->unique()->word;
+
+        Permission::create([
+            'name' => $duplicateName,
+            'name_fa' => $duplicateNameFa,
+            'guard_name' => 'web',
+        ]);
+
+        $response = $this->actingAs($user)->postJson(route('permissions.store'), [
+            'name' => $duplicateName,
+            'name_fa' => $duplicateNameFa,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.unique', ['attribute' => 'نام']),
+                'name_fa' => __('validation.unique', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+
+    public function test_name_and_name_fa_must_be_strings(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('permissions.store'), [
+            'name' =>$this->faker->randomDigit(),
+            'name_fa' => $this->faker->randomDigit(),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.string', ['attribute' => 'نام']),
+                'name_fa' => __('validation.string', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+    public function test_name_and_name_fa_must_not_exceed_max_length(): void
+    {
+        $user = User::factory()->create();
+
+        $longString = $this->faker->regexify('[a-zA-Z0-9]{256}');
+
+        $response = $this->actingAs($user)->postJson(route('permissions.store'), [
+            'name' => $longString,
+            'name_fa' => $longString,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.max.string', ['attribute' => 'نام', 'max' => 255]),
+                'name_fa' => __('validation.max.string', ['attribute' => 'نام فارسی', 'max' => 255]),
+            ]);
+    }
+
+    public function test_valid_permission_is_stored_successfully(): void
+    {
+        $user = User::factory()->create();
+
+        $payload = [
+            'name' => $this->faker->unique()->slug,
+            'name_fa' => $this->faker->unique()->words(2, true),
+        ];
+
+        $response = $this->actingAs($user)->postJson(route('permissions.store'), $payload);
+
+        $response->assertOk()
+            ->assertJson([
+                'message' => __('messages.successful'),
+            ]);
+
+        $this->assertDatabaseHas('permissions', [
+            'name' => $payload['name'],
+            'name_fa' => $payload['name_fa'],
+        ]);
+    }
+
+
+}
diff --git a/tests/Feature/Permission/UpdateTest.php b/tests/Feature/Permission/UpdateTest.php
new file mode 100644
index 0000000..42b65a7
--- /dev/null
+++ b/tests/Feature/Permission/UpdateTest.php
@@ -0,0 +1,118 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class UpdateTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_user_must_be_authenticated(): void
+    {
+        $permission = Permission::factory()->create();
+
+        $response = $this->postJson(route('permissions.update', [$permission->id]));
+
+        $response->assertUnauthorized();
+    }
+
+
+
+    public function test_name_and_name_fa_fields_are_required(): void
+    {
+        $user = User::factory()->create();
+        $permission = Permission::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('permissions.update', [$permission->id]));
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.required', ['attribute' => 'نام']),
+                'name_fa' => __('validation.required', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+    public function test_name_and_name_fa_fields_must_be_strings(): void
+    {
+        $user = User::factory()->create();
+        $permission = Permission::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('permissions.update', [$permission->id]), [
+            'name' =>$this->faker->randomDigit(),
+            'name_fa' => $this->faker->randomDigit(),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.string', ['attribute' => 'نام']),
+                'name_fa' => __('validation.string', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+    public function test_name_and_name_fa_fields_must_be_unique_except_current(): void
+    {
+        $user = User::factory()->create();
+
+        $permission1 = Permission::factory()->create();
+        $permission2 = Permission::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('permissions.update', [$permission1->id]), [
+            'name' => $permission2->name,
+            'name_fa' => $permission2->name_fa,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.unique', ['attribute' => 'نام']),
+                'name_fa' => __('validation.unique', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+    public function test_name_and_name_fa_must_not_exceed_max_length(): void
+    {
+        $user = User::factory()->create();
+        $permission = Permission::factory()->create();
+
+        $longString = $this->faker->regexify('[a-zA-Z0-9]{256}');
+
+        $response = $this->actingAs($user)->postJson(route('permissions.update', [$permission->id]), [
+            'name' => $longString,
+            'name_fa' => $longString,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.max.string', ['attribute' => 'نام', 'max' => 255]),
+                'name_fa' => __('validation.max.string', ['attribute' => 'نام فارسی', 'max' => 255]),
+            ]);
+    }
+
+    public function test_valid_permission_is_updated_successfully(): void
+    {
+        $user = User::factory()->create();
+        $permission = Permission::factory()->create();
+
+        $payload = [
+            'name' => $this->faker->unique()->slug,
+            'name_fa' => $this->faker->unique()->words(2, true),
+        ];
+
+        $response = $this->actingAs($user)->postJson(route('permissions.update', [$permission->id]), $payload);
+
+        $response->assertOk()
+            ->assertJson([
+                'message' => __('messages.successful'),
+            ]);
+
+        $this->assertDatabaseHas('permissions', [
+            'id' => $permission->id,
+            'name' => $payload['name'],
+            'name_fa' => $payload['name_fa'],
+        ]);
+    }
+}
diff --git a/tests/Feature/Province/ListTest.php b/tests/Feature/Province/ListTest.php
new file mode 100644
index 0000000..0f8151d
--- /dev/null
+++ b/tests/Feature/Province/ListTest.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace Tests\Feature\Province;
+
+use App\Models\Province;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class ListTest extends TestCase
+{
+    use refreshDatabase, WithFaker;
+
+    public function test_user_can_view_list():void
+    {
+        $user = User::factory()->create();
+        $response = $this->actingAs($user)->getJson(route('provinces.list'));
+
+        Province::factory()->count(3)->create();
+        $response->assertOk();
+        $response->assertJsonStructure([
+            'data' => [
+                '*' => [
+                    'id',
+                    'name'
+                ],
+            ]
+        ]);
+
+    }
+}
diff --git a/tests/Feature/Role/DeleteTest.php b/tests/Feature/Role/DeleteTest.php
new file mode 100644
index 0000000..ddaf5aa
--- /dev/null
+++ b/tests/Feature/Role/DeleteTest.php
@@ -0,0 +1,65 @@
+<?php
+
+namespace Tests\Feature\Role;
+
+use App\Models\Permission;
+use App\Models\Role;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class DeleteTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_guest_cannot_view_role(): void
+    {
+        $role = Role::factory()->create();
+        $response = $this->postJson(route('roles.destroy', [$role->id]));
+
+        $response->assertUnauthorized();
+    }
+
+    public function test_a_role_can_be_deleted()
+    {
+        $user = User::factory()->create();
+        $role = Role::factory()->create();
+
+        $permission = Permission::factory([
+            'id' => 2,
+            'name' => $this->faker->name
+        ])->create();
+
+        $role->syncPermissions($permission);
+
+        $this->assertDatabaseHas('roles', [
+            'id' => $role->id,
+            'name' => $role->name,
+            'name_fa' => $role->name_fa,
+        ]);
+
+        $this->assertDatabaseHas('role_has_permissions', [
+            'permission_id' => $permission->id,
+            'role_id' => $role->id
+        ]);
+
+        $response = $this->actingAs($user)->deleteJson(route('roles.destroy', [$role->id]));
+
+        $response->assertOk()
+            ->assertExactJson([
+                'message' => __('messages.successful')
+            ]);
+
+        $this->assertDatabaseMissing('roles', [
+            'id' => $role->id,
+            'name' => $role->name,
+            'name_fa' => $role->name_fa,
+        ]);
+
+        $this->assertDatabaseMissing('role_has_permissions', [
+            'permission_id' => $permission->id,
+            'role_id' => $role->id
+        ]);
+    }
+}
diff --git a/tests/Feature/Role/IndexTest.php b/tests/Feature/Role/IndexTest.php
new file mode 100644
index 0000000..13fdc70
--- /dev/null
+++ b/tests/Feature/Role/IndexTest.php
@@ -0,0 +1,47 @@
+<?php
+
+namespace Tests\Feature\Role;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class IndexTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $response = $this->getJson(route('roles.index'));
+
+        $response->assertUnauthorized();
+    }
+
+    public function test_authenticated_user_can_see_roles_index(): void
+    {
+        $user = User::factory()->create();
+
+        $response =  $this->actingAs($user)->getJson(route('roles.index',[
+            'filters' => json_encode([]),
+            'sorting' => json_encode([]),
+        ]));
+
+        $response->assertOk();
+
+        $response->assertJsonStructure([
+            'data' => [
+                '*' => [
+                    'id',
+                    'name',
+                    'name_fa',
+                ],
+            ],
+            'meta' => [
+                'totalRowCount'
+            ]
+        ]);
+    }
+
+}
diff --git a/tests/Feature/Role/ListTest.php b/tests/Feature/Role/ListTest.php
new file mode 100644
index 0000000..d38d271
--- /dev/null
+++ b/tests/Feature/Role/ListTest.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace Tests\Feature\Role;
+
+use App\Models\Permission;
+use App\Models\Role;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class ListTest extends TestCase
+{
+   use RefreshDatabase, WithFaker;
+
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $response = $this->getJson(route('roles.list'));
+        $response->assertUnauthorized();
+    }
+
+    public function test_roles_list_returns_correct_structure(): void
+    {
+        $user = User::factory()->create();
+
+        Role::factory()->count(3)->create();
+
+        $response = $this->actingAs($user)->getJson(route('roles.list'));
+
+        $response->assertOk()
+            ->assertJsonStructure([
+                'data' => [
+                    '*' => [
+                        'id',
+                        'name',
+                        'name_fa',
+                    ]
+                ]
+            ]);
+    }
+}
diff --git a/tests/Feature/Role/ShowTest.php b/tests/Feature/Role/ShowTest.php
new file mode 100644
index 0000000..4edc4b9
--- /dev/null
+++ b/tests/Feature/Role/ShowTest.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace Tests\Feature\Role;
+
+use App\Models\Permission;
+use App\Models\Role;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class ShowTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $role = Role::factory()->create();
+        $response = $this->postJson(route('roles.show',[$role->id]));
+
+        $response->assertUnauthorized();
+    }
+
+    public function test_a_role_can_be_returned_properly():void
+    {
+        $user = User::factory()->create();
+
+        $role = Role::factory()->create();
+
+
+        $permission = Permission::factory()->create([
+            'id' => 2,
+            'name' => $this->faker->name,
+            'name_fa' => $this->faker->name
+        ]);
+
+        $role->syncPermissions($permission);
+
+        $role = Role::factory()->create();
+        $response =  $this->actingAs($user)->getJson(route('roles.show', [$role->id]));
+
+        $response->assertOk()
+            ->assertJson([
+                'data' => [
+                    'id' => $role->id,
+                    'name' => $role->name,
+                    'name_fa' => $role->name_fa,
+                    'permissions' => $role->permissions->pluck('name')->toArray(),
+                ]
+            ]);
+    }
+}
diff --git a/tests/Feature/Role/StoreTest.php b/tests/Feature/Role/StoreTest.php
new file mode 100644
index 0000000..9d2633f
--- /dev/null
+++ b/tests/Feature/Role/StoreTest.php
@@ -0,0 +1,125 @@
+<?php
+
+namespace Tests\Feature\Role;
+
+use App\Models\Permission;
+use App\Models\Role;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class StoreTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_unauthenticated_user_cannot_access()
+    {
+        $response = $this->postJson(route('roles.store'));
+
+        $response->assertUnauthorized();
+    }
+
+    public function test_name_and_name_fa_fields_are_required(): void
+    {
+        $user = User::factory()->create();
+
+
+        $response =  $this->actingAs($user)->postJson(route('roles.store'));
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.required', ['attribute' => 'نام']),
+                'name_fa' => __('validation.required', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+    public function test_name_and_name_fa_fields_must_be_unique(): void
+    {
+        $user = User::factory()->create();
+
+        $duplicateName = $this->faker->unique()->slug;
+        $duplicateNameFa = $this->faker->unique()->word;
+
+        Role::create([
+            'name' => $duplicateName,
+            'name_fa' => $duplicateNameFa,
+            'guard_name' => 'web',
+        ]);
+
+        $response = $this->actingAs($user)->postJson(route('roles.store'), [
+            'name' => $duplicateName,
+            'name_fa' => $duplicateNameFa,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.unique', ['attribute' => 'نام']),
+                'name_fa' => __('validation.unique', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+
+    public function test_name_and_name_fa_must_be_strings(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('roles.store'), [
+            'name' =>$this->faker->randomDigit(),
+            'name_fa' => $this->faker->randomDigit(),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.string', ['attribute' => 'نام']),
+                'name_fa' => __('validation.string', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+    public function test_name_and_name_fa_must_not_exceed_max_length(): void
+    {
+        $user = User::factory()->create();
+
+        $longString = $this->faker->regexify('[a-zA-Z0-9]{256}');
+
+        $response = $this->actingAs($user)->postJson(route('roles.store'), [
+            'name' => $longString,
+            'name_fa' => $longString,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.max.string', ['attribute' => 'نام', 'max' => 255]),
+                'name_fa' => __('validation.max.string', ['attribute' => 'نام فارسی', 'max' => 255]),
+            ]);
+    }
+
+    public function test_valid_role_is_stored_successfully(): void
+    {
+        $user = User::factory()->create();
+
+        $permission = Permission::factory()->create();
+
+        $payload = [
+            'name' => $this->faker->unique()->slug,
+            'name_fa' => $this->faker->unique()->words(2, true),
+            'permissions' => [$permission->id],
+        ];
+
+        $response = $this->actingAs($user)->postJson(route('roles.store'), $payload);
+
+        $response->assertOk()
+            ->assertExactJson([
+                'message' => __('messages.successful')
+            ]);
+
+        $this->assertDatabaseHas('roles', [
+            'name' => $payload['name'],
+            'name_fa' => $payload['name_fa'],
+        ]);
+
+        $this->assertDatabaseHas('role_has_permissions', [
+            'permission_id' => $permission->id,
+        ]);
+    }
+
+}
diff --git a/tests/Feature/Role/UpdateTest.php b/tests/Feature/Role/UpdateTest.php
new file mode 100644
index 0000000..18b68eb
--- /dev/null
+++ b/tests/Feature/Role/UpdateTest.php
@@ -0,0 +1,169 @@
+<?php
+
+namespace Tests\Feature\Role;
+
+use App\Models\Permission;
+use App\Models\Role;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class UpdateTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+    public function test_the_user_is_not_authenticated()
+    {
+        $role = Role::factory()->create();
+        $response = $this->postJson(route('roles.update',[$role->id]));
+
+        $response->assertUnauthorized();
+    }
+
+    public function test_fields_are_required(): void
+    {
+        $user = User::factory()->create();
+        $role = Role::factory()->create();
+
+
+        $response = $this->actingAs($user)->postJson(route('roles.update',[$role->id]));
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.required', ['attribute' => 'نام']),
+                'name_fa' => __('validation.required', ['attribute' => 'نام فارسی']),
+                'permissions' => __('validation.required', ['attribute' => 'دسترسی ها']),
+            ]);
+    }
+
+    public function test_fields_must_be_unique(): void
+    {
+        $user = User::factory()->create();
+        $role = Role::factory()->create();
+
+
+        $duplicateName = $this->faker->unique()->slug;
+        $duplicateNameFa = $this->faker->unique()->word;
+
+        Role::create([
+            'name' => $duplicateName,
+            'name_fa' => $duplicateNameFa,
+            'guard_name' => 'web',
+        ]);
+
+        $response = $this->actingAs($user)->postJson(route('roles.update',[$role->id]), [
+            'name' => $duplicateName,
+            'name_fa' => $duplicateNameFa,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.unique', ['attribute' => 'نام']),
+                'name_fa' => __('validation.unique', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+    public function test_name_and_name_fa_must_be_strings(): void
+    {
+        $role = Role::factory()->create();
+
+        $user = User::factory()->create();
+        $permission = Permission::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('roles.update',[$role->id]), [
+            'name' => 123,
+            'name_fa' => 456,
+            'permissions' => [$permission->id],
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.string', ['attribute' => 'نام']),
+                'name_fa' => __('validation.string', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+    public function test_name_and_name_fa_must_not_exceed_max_length(): void
+    {
+        $role = Role::factory()->create();
+
+        $user = User::factory()->create();
+        $longString = str_repeat('a', 256);
+        $permission = Permission::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('roles.update',[$role->id]), [
+            'name' => $longString,
+            'name_fa' => $longString,
+            'permissions' => [$permission->id],
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.max.string', ['attribute' => 'نام', 'max' => 255]),
+                'name_fa' => __('validation.max.string', ['attribute' => 'نام فارسی', 'max' => 255]),
+            ]);
+    }
+
+    public function test_permissions_must_be_array(): void
+    {
+        $user = User::factory()->create();
+        $role = Role::factory()->create();
+
+
+        $response = $this->actingAs($user)->postJson(route('roles.update',[$role->id]), [
+            'name' => $this->faker->slug,
+            'name_fa' => $this->faker->word,
+            'permissions' => 1,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'permissions' => __('validation.array', ['attribute' => 'دسترسی ها']),
+            ]);
+    }
+
+    public function test_permissions_values_must_exist(): void
+    {
+        $user = User::factory()->create();
+        $role = Role::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('roles.update', [$role->id]), [
+            'permissions' => $this->faker->name(),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'permissions' => __('validation.exists', ['attribute' => 'دسترسی ها']),
+            ]);
+    }
+
+    public function test_valid_role_is_update_successfully(): void
+    {
+        $user = User::factory()->create();
+        $role = Role::factory()->create();
+
+        $permission = Permission::factory()->create();
+
+        $payload = [
+            'name' => $this->faker->unique()->slug,
+            'name_fa' => $this->faker->unique()->words(2, true),
+            'permissions' => [$permission->id],
+        ];
+
+        $response = $this->actingAs($user)->postJson(route('roles.update',[$role->id]), $payload);
+
+        $response->assertOk()
+            ->assertExactJson([
+                'message' => __('messages.successful'),
+            ]);
+
+        $this->assertDatabaseHas('roles', [
+            'name' => $payload['name'],
+            'name_fa' => $payload['name_fa'],
+        ]);
+
+        $this->assertDatabaseHas('role_has_permissions', [
+            'permission_id' => $permission->id,
+        ]);
+    }
+}
diff --git a/tests/Feature/User/DeleteTest.php b/tests/Feature/User/DeleteTest.php
new file mode 100644
index 0000000..ec3f07b
--- /dev/null
+++ b/tests/Feature/User/DeleteTest.php
@@ -0,0 +1,61 @@
+<?php
+
+namespace Tests\Feature\User;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class DeleteTest extends TestCase
+{
+   use RefreshDatabase, WithFaker;
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $user = User::factory()->create();
+        $response = $this->getJson(route('users.destroy',[$user->id]));
+
+        $response->assertUnauthorized();
+    }
+    public function test_user_without_permission_cannot_destroy_users(): void
+    {
+        $user = User::factory()
+            ->create();
+
+        $response = $this->actingAs($user)->getJson(route('users.destroy',[$user->id]));
+        $response->assertForbidden();
+    }
+    public function test_superAdmin_cant_updated()
+    {
+
+        $user = User::factory()->create([
+            'username' => "witel",
+        ]);
+
+        $response = $this->actingAs($user)->getJson(route('users.destroy',[$user->id]));
+
+        $response->assertForbidden();
+
+    }
+    public function test_can_delete_a_user()
+    {
+        $user = User::factory()
+            ->has(permission::factory([
+                'name'=> 'manage_users',
+                "name_fa" => 'مدیریت کاربران',
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->deleteJson(route('users.destroy', [$user->id]));
+
+        $response->assertStatus(200)
+            ->assertExactJson([
+                'message' => __('messages.successful')
+            ]);
+
+        $this->assertDatabaseMissing('users', [
+            'username' => $user->username
+        ]);
+    }
+}
diff --git a/tests/Feature/User/IndexTest.php b/tests/Feature/User/IndexTest.php
new file mode 100644
index 0000000..f4f249d
--- /dev/null
+++ b/tests/Feature/User/IndexTest.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace Tests\Feature\User;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class IndexTest extends TestCase
+{
+   use refreshDatabase, WithFaker;
+
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $response = $this->getJson(route('users.index'));
+
+        $response->assertUnauthorized();
+    }
+    public function test_user_without_permission_cannot_see_index(): void
+    {
+        $user = User::factory()->create();
+        $response = $this->actingAs($user)->getJson(route('users.index'));
+        $response->assertForbidden();
+    }
+    public function test_all_users_returned_successfully_for_index_user(): void
+    {
+        $user = User::factory()
+            ->has(permission::factory([
+                'name'=> 'manage_users',
+                "name_fa" => 'مدیریت کاربران',
+            ]))
+            ->create();
+        User::factory()->count(2)->create();
+        $response = $this->actingAs($user)->getJson(route('users.index',[
+            'filters'=> json_encode([]),
+            'sortings'=> json_encode([]),
+            'relations'=> ['roles:id,name_fa']
+        ]));
+        $response->assertOk();
+        $response->assertJsonStructure([
+            'data' => [
+                '*' => ['id',
+                    'full_name',
+                    'username',
+                    'province_id',
+                    'phone_number',
+                    'national_id',
+                    'telephone_id',
+                    ],
+                ],
+            'meta' => [
+                'totalRowCount'
+            ]
+        ]);
+    }
+
+}
diff --git a/tests/Feature/User/ShowTest.php b/tests/Feature/User/ShowTest.php
new file mode 100644
index 0000000..b531479
--- /dev/null
+++ b/tests/Feature/User/ShowTest.php
@@ -0,0 +1,76 @@
+<?php
+
+namespace Tests\Feature\User;
+
+use App\Models\Permission;
+use App\Models\Role;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class ShowTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $user = User::factory()->create();
+        $response = $this->getJson(route('users.show',[$user->id]));
+
+        $response->assertUnauthorized();
+    }
+    public function test_user_without_permission_cannot_show_users(): void
+    {
+        $user = User::factory()
+            ->create();
+
+        $response = $this->actingAs($user)->getJson(route('users.show',[$user->id]));
+        $response->assertForbidden();
+    }
+    public function test_superAdmin_cant_updated()
+    {
+
+        $user = User::factory()->create([
+            'username' => "witel",
+        ]);
+
+        $response = $this->actingAs($user)->getJson(route('users.show',[$user->id]));
+
+        $response->assertForbidden();
+
+    }
+    public function test_user_with_permission_can_show_users(): void
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+        $role = Role::factory()
+            ->has(Permission::factory([
+                'name' => 'test'
+            ]))->create();
+
+        $user->assignRole($role->id);
+
+        $response = $this->actingAs($user)->getJson(route('users.show',[$user->id]));
+        $response->assertJsonStructure([
+            'data' => [
+                'username',
+                'full_name',
+                'id',
+                'gender',
+                'email',
+                'phone_number',
+                'avatar',
+                'national_id',
+                'position',
+                'province_id',
+                'province_name',
+                'role',
+                'telephone_id'
+            ]
+        ]);
+    }
+}
diff --git a/tests/Feature/User/StoreTest.php b/tests/Feature/User/StoreTest.php
new file mode 100644
index 0000000..6d9e9bc
--- /dev/null
+++ b/tests/Feature/User/StoreTest.php
@@ -0,0 +1,508 @@
+<?php
+
+namespace Tests\Feature\User;
+
+use App\Models\Permission;
+use App\Models\Province;
+use App\Models\Role;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Illuminate\Http\UploadedFile;
+use Tests\TestCase;
+
+class StoreTest extends TestCase
+{
+    use refreshDatabase, WithFaker;
+
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $response = $this->getJson(route('users.store'));
+
+        $response->assertUnauthorized();
+    }
+    public function test_user_without_permission_cannot_see_index(): void
+    {
+        $user = User::factory()->create();
+        $response = $this->actingAs($user)->getJson(route('users.store'));
+        $response->assertForbidden();
+    }
+
+    public function test_fields_are_required()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.store'),[]);
+        $response->assertUnprocessable()
+            ->assertInValid([
+                'full_name' => __('validation.required', ['attribute' => 'نام کامل']),
+                'username' => __('validation.required', ['attribute' => 'نام کاربری']),
+                'position' => __('validation.required', ['attribute' => 'سمت']),
+                'gender' => __('validation.required', ['attribute' => 'جنسیت']),
+                'national_id' => __('validation.required', ['attribute' => 'کدملی']),
+                'phone_number' => __('validation.required', ['attribute' => 'شماره تلفن']),
+                'province_id' => __('validation.required', ['attribute' => 'استان']),
+                'password' => __('validation.required', ['attribute' => 'رمز عبور']),
+                'role_id' => __('validation.required', ['attribute' => 'شناسه نقش ']),
+            ]);
+
+    }
+    public function test_gender_should_be_male_or_female()
+    {
+        $user = User::factory()
+        ->has(Permission::factory([
+            'name' => 'manage_users',
+            'name_fa' => 'مدیریت کاربران'
+        ]))
+        ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->name,
+            'username' => $this->faker->unique()->userName,
+            'position' => $this->faker->jobTitle,
+            'gender' => 'other',
+            'national_id' => $this->faker->numerify('##########'),
+            'phone_number' => $this->faker->numerify('09#########'),
+            'province_id' => Province::factory()->create()->id,
+            'role_id' => Role::factory()->create()->id,
+            'password' => $this->faker->regexify('[A-Za-z]{4}[0-9]{4}')
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'gender' => __('validation.in', ['attribute' => 'جنسیت'])
+            ]);
+    }
+
+    public function test_phone_number_should_match_regex()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '01' . $this->faker->numberBetween(100000000, 999999999),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'phone_number' => __('validation.regex', ['attribute' => 'شماره تلفن'])
+            ]);
+        }
+
+    public function test_password_should_match_the_regex()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(100000000, 999999999),
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->lexify('?????'),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'password' => __('validation.regex', ['attribute' => 'رمز عبور'])
+            ]);
+    }
+    public function test_fields_should_be_string()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->numberBetween(10, 20),
+            'username' => $this->faker->numberBetween(10, 20),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'full_name' => __('validation.string', ['attribute' => 'نام کامل']),
+                'username' => __('validation.string', ['attribute' => 'نام کاربری']),
+            ]);
+    }
+    public function test_avatar_should_be_less_than_2048()
+    {
+        $avatar = UploadedFile::fake()->image('file.png')->size('3000');
+
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(100000000, 999999999),
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->numberBetween(1000, 9999) . $this->faker->lexify('?????'),
+            'roles' => Role::factory()->create()->id,
+            'avatar' => $avatar
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'avatar' => __('validation.max.file', ['attribute' => 'آواتار', 'max' => 2048])
+            ]);
+    }
+
+    public function test_full_name_must_not_exceed_max_length():void
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+        $longString = $this->faker->regexify('[a-zA-Z0-9]{256}');
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' =>  $longString,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(100000000, 999999999),
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->numberBetween(1000, 9999) . $this->faker->lexify('?????'),
+            'role_id' => Role::factory()->create()->id,
+
+        ]);
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'full_name' => __('validation.max.string', ['attribute' => 'نام کامل', 'max' => 255]),
+            ]);
+    }
+
+    public function test_fields_id_should_be_unique()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+        $existingPhone = '09' .$this->faker->numberBetween(100000000, 999999999);
+        $existingEmail = $this->faker->email;
+        $existingUser = $this->faker->name;
+        $existingNational = $this->faker->numberBetween(1000000000, 9999999999);
+
+        User::factory()->create([
+            'phone_number' => $existingPhone,
+            'national_id' => $existingNational,
+            'username' => $existingUser,
+            'email' => $existingEmail,
+        ]);
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->text,
+            'username' =>$existingUser,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' =>$existingNational,
+            'phone_number' => $existingPhone,
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->numberBetween(1000, 9999) . $this->faker->lexify('?????'),
+            'role_id' => Role::factory()->create()->id,
+            'email' =>$existingEmail,
+        ]);
+
+        $response->assertJsonValidationErrors([
+                'phone_number' => __('validation.unique', ['attribute' => 'شماره تلفن']),
+                'email' => __('validation.unique', ['attribute' => 'ایمیل']),
+                'username' => __('validation.unique', ['attribute' => 'نام کاربری']),
+                'national_id' => __('validation.unique', ['attribute' => 'کدملی']),
+            ]);
+    }
+
+    public function test_password_should_have_minimum_8_characters(): void
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->name,
+            'username' => $this->faker->unique()->userName,
+            'position' => $this->faker->jobTitle,
+            'gender' => $this->faker->randomElement(['male', 'female']),
+            'national_id' => $this->faker->numerify('##########'),
+            'phone_number' => $this->faker->numerify('09#########'),
+            'province_id' => Province::factory()->create()->id,
+            'password' => 'abc123',
+            'role_id' => Role::factory()->create()->id,
+            'email' => $this->faker->unique()->safeEmail,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'password' => __('validation.min.string', ['attribute' => 'رمز عبور', 'min' => 8]),
+            ]);
+    }
+    public function test_national_id_should_be_10_digits()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(10000, 99999),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'national_id' => __('validation.digits', [
+                    'attribute' => 'کدملی',
+                    'digits' => 10,
+                ])
+            ]);
+    }
+    public function test_phone_number_should_be_11_digits()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(1000000, 9999999),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'phone_number' => __('validation.digits', [
+                    'attribute' => 'شماره تلفن',
+                    'digits' => 11
+                ])
+            ]);
+    }
+
+    public function test_role_should_exist_in_roles_table()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+        $invalidRoleId = 9999;
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(100000000, 999999999),
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->numberBetween(1000, 9999) . $this->faker->lexify('?????'),
+            'role_id' => $invalidRoleId ,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'role_id' => __('validation.exists', ['attribute' => 'شناسه نقش '])
+            ]);
+    }
+    public function test_province_id_should_be_exist_in_province_table()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+        $invalidProvince =  $this->faker->numberBetween(100000000, 999999999);
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(100000000, 999999999),
+            'province_id' => $invalidProvince,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'province_id' => __('validation.exists', ['attribute' => 'استان'])
+            ]);
+    }
+
+    public function test_email_should_have_valid_format(): void
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->name,
+            'username' => $this->faker->unique()->userName,
+            'position' => $this->faker->jobTitle,
+            'gender' => $this->faker->randomElement(['male', 'female']),
+            'national_id' => $this->faker->numerify('##########'),
+            'phone_number' => $this->faker->numerify('09#########'),
+            'province_id' => Province::factory()->create()->id,
+            'password' => 'abc12345',
+            'role_id' => Role::factory()->create()->id,
+            'email' => 'not-an-email',
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'email' => __('validation.email', ['attribute' => 'ایمیل']),
+            ]);
+    }
+    public function test_avatar_should_be_valid_mime_type(): void
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $invalidFile = UploadedFile::fake()->create('avatar.txt', 100, 'text/plain');
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->name,
+            'username' => $this->faker->unique()->userName,
+            'position' => $this->faker->jobTitle,
+            'gender' => $this->faker->randomElement(['male', 'female']),
+            'national_id' => $this->faker->numerify('##########'),
+            'phone_number' => $this->faker->numerify('09#########'),
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->regexify('[A-Za-z]{4}[0-9]{4}'),
+            'role_id' => Role::factory()->create()->id,
+            'email' => $this->faker->unique()->safeEmail,
+            'avatar' => $invalidFile,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'avatar' => __('validation.mimes', ['attribute' => 'آواتار', 'values' => 'png, jpg, pdf']),
+            ]);
+    }
+    public function test_phone_number_must_be_numeric(): void
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+        $invalidPhone =  $this->faker->word();
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->name,
+            'username' => $this->faker->unique()->userName,
+            'position' => $this->faker->jobTitle,
+            'gender' => $this->faker->randomElement(['male', 'female']),
+            'national_id' => $this->faker->numerify('##########'),
+            'phone_number' =>$invalidPhone ,
+            'province_id' => Province::factory()->create()->id,
+            'password' => 'abc12345',
+            'role_id' => Role::factory()->create()->id,
+            'email' => 'not-an-email',
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'phone_number' => __('validation.numeric', ['attribute' => 'شماره تلفن']),
+            ]);
+
+    }
+
+
+    public function test_can_store_an_user()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+        $username = $this->faker->userName;
+
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->name,
+            'username' => $username,
+            'position' => $this->faker->lexify('?????'),
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(100000000, 999999999),
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->numberBetween(1000, 9999) . $this->faker->lexify('?????'),
+            'role_id' => Role::factory()->create()->id,
+            'telephone_id' => '01-1'
+        ]);
+
+        $response->assertStatus(200)
+            ->assertExactJson([
+                'message' => __('messages.successful')
+            ]);
+
+        $this->assertDatabaseHas('users', [
+            'username' =>  $username
+        ]);
+    }
+
+
+
+
+
+
+}
diff --git a/tests/Feature/User/UpdateTest.php b/tests/Feature/User/UpdateTest.php
new file mode 100644
index 0000000..58baedd
--- /dev/null
+++ b/tests/Feature/User/UpdateTest.php
@@ -0,0 +1,430 @@
+<?php
+
+namespace Tests\Feature\User;
+
+use App\Models\Permission;
+use App\Models\Province;
+use App\Models\Role;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Illuminate\Http\UploadedFile;
+use Tests\TestCase;
+
+class UpdateTest extends TestCase
+{
+    use refreshDatabase, WithFaker;
+
+    public function test_unauthenticated_user_cannot_access(): void
+    {
+        $user = User::factory()
+            ->create();
+        $response = $this->getJson(route('users.update',[$user->id]));
+
+        $response->assertUnauthorized();
+    }
+    public function test_user_without_permission_cannot_see_index(): void
+    {
+        $user = User::factory()->create();
+        $response = $this->actingAs($user)->getJson(route('users.update',[$user->id]));
+        $response->assertForbidden();
+    }
+    public function test_superAdmin_cant_updated()
+    {
+
+        $user = User::factory()->create([
+            'username' => "witel",
+        ]);
+
+        $response = $this->actingAs($user)->getJson(route('users.update',[$user->id]));
+
+        $response->assertForbidden();
+
+    }
+    public function test_fields_are_required()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]),[]);
+        $response->assertUnprocessable()
+            ->assertInValid([
+                'full_name' => __('validation.required', ['attribute' => 'نام کامل']),
+                'username' => __('validation.required', ['attribute' => 'نام کاربری']),
+                'position' => __('validation.required', ['attribute' => 'سمت']),
+                'gender' => __('validation.required', ['attribute' => 'جنسیت']),
+                'national_id' => __('validation.required', ['attribute' => 'کدملی']),
+                'phone_number' => __('validation.required', ['attribute' => 'شماره تلفن']),
+                'province_id' => __('validation.required', ['attribute' => 'استان']),
+                'role_id' => __('validation.required', ['attribute' => 'شناسه نقش ']),
+            ]);
+
+    }
+    public function test_gender_should_be_male_or_female()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [
+            'full_name' => $this->faker->name,
+            'username' => $this->faker->unique()->userName,
+            'position' => $this->faker->jobTitle,
+            'gender' => 'other',
+            'national_id' => $this->faker->numerify('##########'),
+            'phone_number' => $this->faker->numerify('09#########'),
+            'province_id' => Province::factory()->create()->id,
+            'role_id' => Role::factory()->create()->id,
+            'password' => $this->faker->regexify('[A-Za-z]{4}[0-9]{4}')
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'gender' => __('validation.in', ['attribute' => 'جنسیت'])
+            ]);
+    }
+
+    public function test_phone_number_should_match_regex()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [
+            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '01' . $this->faker->numberBetween(100000000, 999999999),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'phone_number' => __('validation.regex', ['attribute' => 'شماره تلفن'])
+            ]);
+    }
+
+    public function test_fields_should_be_string()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [
+            'full_name' => $this->faker->numberBetween(10, 20),
+            'username' => $this->faker->numberBetween(10, 20),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'full_name' => __('validation.string', ['attribute' => 'نام کامل']),
+                'username' => __('validation.string', ['attribute' => 'نام کاربری']),
+            ]);
+    }
+    public function test_avatar_should_be_less_than_2048()
+    {
+        $avatar = UploadedFile::fake()->image('file.png')->size('3000');
+
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [
+            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(100000000, 999999999),
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->numberBetween(1000, 9999) . $this->faker->lexify('?????'),
+            'roles' => Role::factory()->create()->id,
+            'avatar' => $avatar
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'avatar' => __('validation.max.file', ['attribute' => 'آواتار', 'max' => 2048])
+            ]);
+    }
+
+    public function test_full_name_must_not_exceed_max_length():void
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+        $longString = $this->faker->regexify('[a-zA-Z0-9]{256}');
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [
+            'full_name' =>  $longString,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(100000000, 999999999),
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->numberBetween(1000, 9999) . $this->faker->lexify('?????'),
+            'role_id' => Role::factory()->create()->id,
+
+        ]);
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'full_name' => __('validation.max.string', ['attribute' => 'نام کامل', 'max' => 255]),
+            ]);
+    }
+    public function test_national_id_should_be_10_digits()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [
+            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(10000, 99999),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'national_id' => __('validation.digits', [
+                    'attribute' => 'کدملی',
+                    'digits' => 10,
+                ])
+            ]);
+    }
+    public function test_phone_number_should_be_11_digits()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [
+            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(1000000, 9999999),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'phone_number' => __('validation.digits', [
+                    'attribute' => 'شماره تلفن',
+                    'digits' => 11
+                ])
+            ]);
+    }
+
+    public function test_role_should_exist_in_roles_table()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+        $invalidRoleId = 9999;
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [
+            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(100000000, 999999999),
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->numberBetween(1000, 9999) . $this->faker->lexify('?????'),
+            'role_id' => $invalidRoleId ,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'role_id' => __('validation.exists', ['attribute' => 'شناسه نقش '])
+            ]);
+    }
+    public function test_province_id_should_be_exist_in_province_table()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+        $invalidProvince =  $this->faker->numberBetween(100000000, 999999999);
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [            'full_name' => $this->faker->text,
+            'username' => $this->faker->text,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(100000000, 999999999),
+            'province_id' => $invalidProvince,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'province_id' => __('validation.exists', ['attribute' => 'استان'])
+            ]);
+    }
+
+    public function test_email_should_have_valid_format(): void
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [
+            'full_name' => $this->faker->name,
+            'username' => $this->faker->unique()->userName,
+            'position' => $this->faker->jobTitle,
+            'gender' => $this->faker->randomElement(['male', 'female']),
+            'national_id' => $this->faker->numerify('##########'),
+            'phone_number' => $this->faker->numerify('09#########'),
+            'province_id' => Province::factory()->create()->id,
+            'password' => 'abc12345',
+            'role_id' => Role::factory()->create()->id,
+            'email' => 'not-an-email',
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'email' => __('validation.email', ['attribute' => 'ایمیل']),
+            ]);
+    }
+    public function test_avatar_should_be_valid_mime_type(): void
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $invalidFile = UploadedFile::fake()->create('avatar.txt', 100, 'text/plain');
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [
+            'full_name' => $this->faker->name,
+            'username' => $this->faker->unique()->userName,
+            'position' => $this->faker->jobTitle,
+            'gender' => $this->faker->randomElement(['male', 'female']),
+            'national_id' => $this->faker->numerify('##########'),
+            'phone_number' => $this->faker->numerify('09#########'),
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->regexify('[A-Za-z]{4}[0-9]{4}'),
+            'role_id' => Role::factory()->create()->id,
+            'email' => $this->faker->unique()->safeEmail,
+            'avatar' => $invalidFile,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'avatar' => __('validation.mimes', ['attribute' => 'آواتار', 'values' => 'png, jpg, pdf']),
+            ]);
+    }
+    public function test_fields_id_should_be_unique()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+        $existingPhone = '09' .$this->faker->numberBetween(100000000, 999999999);
+        $existingEmail = $this->faker->email;
+        $existingUser = $this->faker->name;
+        $existingNational = $this->faker->numberBetween(1000000000, 9999999999);
+
+        User::factory()->create([
+            'phone_number' => $existingPhone,
+            'national_id' => $existingNational,
+            'username' => $existingUser,
+            'email' => $existingEmail,
+        ]);
+
+        $response = $this->actingAs($user)->postJson(route('users.store'), [
+            'full_name' => $this->faker->text,
+            'username' =>$existingUser,
+            'position' => $this->faker->text,
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' =>$existingNational,
+            'phone_number' => $existingPhone,
+            'province_id' => Province::factory()->create()->id,
+            'password' => $this->faker->numberBetween(1000, 9999) . $this->faker->lexify('?????'),
+            'role_id' => Role::factory()->create()->id,
+            'email' =>$existingEmail,
+        ]);
+
+        $response->assertJsonValidationErrors([
+            'phone_number' => __('validation.unique', ['attribute' => 'شماره تلفن']),
+            'email' => __('validation.unique', ['attribute' => 'ایمیل']),
+            'username' => __('validation.unique', ['attribute' => 'نام کاربری']),
+            'national_id' => __('validation.unique', ['attribute' => 'کدملی']),
+        ]);
+    }
+    public function test_can_update_an_user()
+    {
+        $user = User::factory()
+            ->has(Permission::factory([
+                'name' => 'manage_users',
+                'name_fa' => 'مدیریت کاربران'
+            ]))
+            ->create();
+
+        $username = $this->faker->userName;
+
+        $response = $this->actingAs($user)->postJson(route('users.update',[$user->id]), [
+            'full_name' => $this->faker->name,
+            'username' => $username,
+            'position' => $this->faker->lexify('?????'),
+            'gender' => $this->faker->randomElement(['female', 'male']),
+            'national_id' => $this->faker->numberBetween(1000000000, 9999999999),
+            'phone_number' => '09' . $this->faker->numberBetween(100000000, 999999999),
+            'province_id' => Province::factory()->create()->id,
+            'role_id' => Role::factory()->create()->id,
+            'telephone_id' => '01-1'
+        ]);
+
+        $response->assertStatus(200)
+            ->assertExactJson([
+                'message' => __('messages.successful')
+            ]);
+
+        $this->assertDatabaseHas('users', [
+            'username' => $username
+        ]);
+    }
+
+
+}
diff --git a/tests/TestCase.php b/tests/TestCase.php
index fe1ffc2..8f98a4a 100644
--- a/tests/TestCase.php
+++ b/tests/TestCase.php
@@ -2,6 +2,7 @@
 
 namespace Tests;
 
+use Database\Seeders\EventSeeder;
 use Illuminate\Foundation\Testing\TestCase as BaseTestCase;
 
 abstract class TestCase extends BaseTestCase