diff --git a/spec/requests/membership_apps/create_spec.rb b/spec/requests/membership_apps/create_spec.rb
index 0d357c5..9801913 100644
--- a/spec/requests/membership_apps/create_spec.rb
+++ b/spec/requests/membership_apps/create_spec.rb
@@ -3,6 +3,8 @@
 require 'rails_helper'
 
 RSpec.describe 'POST /join' do
+  let(:current_account) { nil }
+
   let :membership_app_plain_attributes do
     attributes_for :membership_app
   end
@@ -15,6 +17,14 @@ RSpec.describe 'POST /join' do
 
   let(:country_state) { create :country_state }
 
+  before do
+    sign_in current_account.user if current_account&.user
+
+    if current_account&.guest?
+      get root_url guest_token: current_account.guest_token
+    end
+  end
+
   def make_request
     post '/join', params: {
       membership_app: membership_app_all_attributes,
@@ -36,6 +46,50 @@ RSpec.describe 'POST /join' do
       change(ActionMailer::Base.deliveries, :count).from(0).to(1)
   end
 
+  context 'when guest owner is authenticated' do
+    let!(:membership_app) { create :membership_app, account: owner }
+    let(:owner) { create :guest_account }
+    let(:current_account) { owner }
+
+    specify do
+      expect { make_request }.not_to change(MembershipApp, :count).from(1)
+    end
+
+    specify do
+      expect { make_request }.not_to change(Account, :count).from(1)
+    end
+
+    context 'after request' do
+      before { make_request }
+
+      specify do
+        expect(response).to have_http_status :unauthorized
+      end
+    end
+  end
+
+  context 'when usual owner is authenticated' do
+    let!(:membership_app) { create :membership_app, account: owner }
+    let(:owner) { create :usual_account }
+    let(:current_account) { owner }
+
+    specify do
+      expect { make_request }.not_to change(MembershipApp, :count).from(1)
+    end
+
+    specify do
+      expect { make_request }.not_to change(Account, :count).from(2)
+    end
+
+    context 'after request' do
+      before { make_request }
+
+      specify do
+        expect(response).to have_http_status :unauthorized
+      end
+    end
+  end
+
   context 'after request' do
     before { make_request }