app/Filament/Pages/ChooseWorkspace.php

@@ -1,137 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Pages;
-
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use App\Support\Workspaces\WorkspaceContext;
-use Filament\Actions\Action;
-use Filament\Forms\Components\TextInput;
-use Filament\Notifications\Notification;
-use Filament\Pages\Page;
-use Illuminate\Database\Eloquent\Collection;
-
-class ChooseWorkspace extends Page
-{
-    protected static string $layout = 'filament-panels::components.layout.simple';
-
-    protected static bool $shouldRegisterNavigation = false;
-
-    protected static bool $isDiscovered = false;
-
-    protected static ?string $slug = 'choose-workspace';
-
-    protected static ?string $title = 'Choose workspace';
-
-    protected string $view = 'filament.pages.choose-workspace';
-
-    /**
-     * @return array<Action>
-     */
-    protected function getHeaderActions(): array
-    {
-        return [
-            Action::make('createWorkspace')
-                ->label('Create workspace')
-                ->modalHeading('Create workspace')
-                ->form([
-                    TextInput::make('name')
-                        ->required()
-                        ->maxLength(255),
-                    TextInput::make('slug')
-                        ->helperText('Optional. Used in URLs if set.')
-                        ->maxLength(255)
-                        ->rules(['nullable', 'string', 'max:255', 'alpha_dash', 'unique:workspaces,slug'])
-                        ->dehydrateStateUsing(fn ($state) => filled($state) ? $state : null)
-                        ->dehydrated(fn ($state) => filled($state)),
-                ])
-                ->action(fn (array $data) => $this->createWorkspace($data)),
-        ];
-    }
-
-    /**
-     * @return Collection<int, Workspace>
-     */
-    public function getWorkspaces(): Collection
-    {
-        $user = auth()->user();
-
-        if (! $user instanceof User) {
-            return Workspace::query()->whereRaw('1 = 0')->get();
-        }
-
-        return Workspace::query()
-            ->whereIn('id', function ($query) use ($user): void {
-                $query->from('workspace_memberships')
-                    ->select('workspace_id')
-                    ->where('user_id', $user->getKey());
-            })
-            ->whereNull('archived_at')
-            ->orderBy('name')
-            ->get();
-    }
-
-    public function selectWorkspace(int $workspaceId): void
-    {
-        $user = auth()->user();
-
-        if (! $user instanceof User) {
-            abort(403);
-        }
-
-        $workspace = Workspace::query()->whereKey($workspaceId)->first();
-
-        if (! $workspace instanceof Workspace) {
-            abort(404);
-        }
-
-        if (! empty($workspace->archived_at)) {
-            abort(404);
-        }
-
-        $context = app(WorkspaceContext::class);
-
-        if (! $context->isMember($user, $workspace)) {
-            abort(404);
-        }
-
-        $context->setCurrentWorkspace($workspace, $user, request());
-
-        $this->redirect(ChooseTenant::getUrl());
-    }
-
-    /**
-     * @param  array{name: string, slug?: string|null}  $data
-     */
-    public function createWorkspace(array $data): void
-    {
-        $user = auth()->user();
-
-        if (! $user instanceof User) {
-            abort(403);
-        }
-
-        $workspace = Workspace::query()->create([
-            'name' => $data['name'],
-            'slug' => $data['slug'] ?? null,
-        ]);
-
-        WorkspaceMembership::query()->create([
-            'workspace_id' => $workspace->getKey(),
-            'user_id' => $user->getKey(),
-            'role' => 'owner',
-        ]);
-
-        app(WorkspaceContext::class)->setCurrentWorkspace($workspace, $user, request());
-
-        Notification::make()
-            ->title('Workspace created')
-            ->success()
-            ->send();
-
-        $this->redirect(ChooseTenant::getUrl());
-    }
-}

app/Filament/Pages/NoAccess.php

@@ -4,13 +4,6 @@
 
 namespace App\Filament\Pages;
 
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use App\Support\Workspaces\WorkspaceContext;
-use Filament\Actions\Action;
-use Filament\Forms\Components\TextInput;
-use Filament\Notifications\Notification;
 use Filament\Pages\Page;
 
 class NoAccess extends Page
@@ -26,60 +19,4 @@ class NoAccess extends Page
     protected static ?string $title = 'No access';
 
     protected string $view = 'filament.pages.no-access';
-
-    /**
-     * @return array<Action>
-     */
-    protected function getHeaderActions(): array
-    {
-        return [
-            Action::make('createWorkspace')
-                ->label('Create workspace')
-                ->modalHeading('Create workspace')
-                ->form([
-                    TextInput::make('name')
-                        ->required()
-                        ->maxLength(255),
-                    TextInput::make('slug')
-                        ->helperText('Optional. Used in URLs if set.')
-                        ->maxLength(255)
-                        ->rules(['nullable', 'string', 'max:255', 'alpha_dash', 'unique:workspaces,slug'])
-                        ->dehydrateStateUsing(fn ($state) => filled($state) ? $state : null)
-                        ->dehydrated(fn ($state) => filled($state)),
-                ])
-                ->action(fn (array $data) => $this->createWorkspace($data)),
-        ];
-    }
-
-    /**
-     * @param  array{name: string, slug?: string|null}  $data
-     */
-    public function createWorkspace(array $data): void
-    {
-        $user = auth()->user();
-
-        if (! $user instanceof User) {
-            abort(403);
-        }
-
-        $workspace = Workspace::query()->create([
-            'name' => $data['name'],
-            'slug' => $data['slug'] ?? null,
-        ]);
-
-        WorkspaceMembership::query()->create([
-            'workspace_id' => $workspace->getKey(),
-            'user_id' => $user->getKey(),
-            'role' => 'owner',
-        ]);
-
-        app(WorkspaceContext::class)->setCurrentWorkspace($workspace, $user, request());
-
-        Notification::make()
-            ->title('Workspace created')
-            ->success()
-            ->send();
-
-        $this->redirect(ChooseTenant::getUrl());
-    }
 }

app/Filament/Resources/Workspaces/Pages/CreateWorkspace.php

@@ -1,35 +0,0 @@
-<?php
-
-namespace App\Filament\Resources\Workspaces\Pages;
-
-use App\Filament\Resources\Workspaces\WorkspaceResource;
-use App\Models\User;
-use App\Models\WorkspaceMembership;
-use App\Support\Workspaces\WorkspaceContext;
-use Filament\Resources\Pages\CreateRecord;
-
-class CreateWorkspace extends CreateRecord
-{
-    protected static string $resource = WorkspaceResource::class;
-
-    protected function afterCreate(): void
-    {
-        $user = auth()->user();
-
-        if (! $user instanceof User) {
-            return;
-        }
-
-        WorkspaceMembership::query()->firstOrCreate(
-            [
-                'workspace_id' => $this->record->getKey(),
-                'user_id' => $user->getKey(),
-            ],
-            [
-                'role' => 'owner',
-            ],
-        );
-
-        app(WorkspaceContext::class)->setCurrentWorkspace($this->record, $user, request());
-    }
-}

app/Filament/Resources/Workspaces/Pages/EditWorkspace.php

@@ -1,11 +0,0 @@
-<?php
-
-namespace App\Filament\Resources\Workspaces\Pages;
-
-use App\Filament\Resources\Workspaces\WorkspaceResource;
-use Filament\Resources\Pages\EditRecord;
-
-class EditWorkspace extends EditRecord
-{
-    protected static string $resource = WorkspaceResource::class;
-}

app/Filament/Resources/Workspaces/Pages/ListWorkspaces.php

@@ -1,19 +0,0 @@
-<?php
-
-namespace App\Filament\Resources\Workspaces\Pages;
-
-use App\Filament\Resources\Workspaces\WorkspaceResource;
-use Filament\Actions;
-use Filament\Resources\Pages\ListRecords;
-
-class ListWorkspaces extends ListRecords
-{
-    protected static string $resource = WorkspaceResource::class;
-
-    protected function getHeaderActions(): array
-    {
-        return [
-            Actions\CreateAction::make(),
-        ];
-    }
-}

app/Filament/Resources/Workspaces/WorkspaceResource.php

@@ -1,62 +0,0 @@
-<?php
-
-namespace App\Filament\Resources\Workspaces;
-
-use App\Models\Workspace;
-use BackedEnum;
-use Filament\Forms;
-use Filament\Resources\Resource;
-use Filament\Schemas\Schema;
-use Filament\Tables;
-use Filament\Tables\Table;
-use UnitEnum;
-
-class WorkspaceResource extends Resource
-{
-    protected static ?string $model = Workspace::class;
-
-    protected static bool $isScopedToTenant = false;
-
-    protected static string|BackedEnum|null $navigationIcon = 'heroicon-o-squares-2x2';
-
-    protected static string|UnitEnum|null $navigationGroup = 'Settings';
-
-    public static function form(Schema $schema): Schema
-    {
-        return $schema
-            ->schema([
-                Forms\Components\TextInput::make('name')
-                    ->required()
-                    ->maxLength(255),
-                Forms\Components\TextInput::make('slug')
-                    ->required()
-                    ->maxLength(255)
-                    ->unique(ignoreRecord: true),
-            ]);
-    }
-
-    public static function table(Table $table): Table
-    {
-        return $table
-            ->columns([
-                Tables\Columns\TextColumn::make('name')
-                    ->searchable()
-                    ->sortable(),
-                Tables\Columns\TextColumn::make('slug')
-                    ->searchable()
-                    ->sortable(),
-            ])
-            ->actions([
-                Tables\Actions\EditAction::make(),
-            ]);
-    }
-
-    public static function getPages(): array
-    {
-        return [
-            'index' => Pages\ListWorkspaces::route('/'),
-            'create' => Pages\CreateWorkspace::route('/create'),
-            'edit' => Pages\EditWorkspace::route('/{record}/edit'),
-        ];
-    }
-}

app/Http/Middleware/EnsureWorkspaceMember.php

@@ -1,51 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use App\Models\User;
-use App\Models\Workspace;
-use App\Support\Workspaces\WorkspaceContext;
-use App\Support\Workspaces\WorkspaceResolver;
-use Closure;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\Response;
-
-class EnsureWorkspaceMember
-{
-    /**
-     * Handle an incoming request.
-     *
-     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
-     */
-    public function handle(Request $request, Closure $next): Response
-    {
-        $user = $request->user();
-
-        if (! $user instanceof User) {
-            return $next($request);
-        }
-
-        $workspaceParam = $request->route()?->parameter('workspace');
-
-        $workspace = $workspaceParam instanceof Workspace
-            ? $workspaceParam
-            : (is_scalar($workspaceParam)
-                ? app(WorkspaceResolver::class)->resolve((string) $workspaceParam)
-                : null);
-
-        if (! $workspace instanceof Workspace) {
-            abort(404);
-        }
-
-        /** @var WorkspaceContext $context */
-        $context = app(WorkspaceContext::class);
-
-        if (! $context->isMember($user, $workspace)) {
-            abort(404);
-        }
-
-        $context->setCurrentWorkspace($workspace, $user, $request);
-
-        return $next($request);
-    }
-}

app/Http/Middleware/EnsureWorkspaceSelected.php

@@ -1,67 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use App\Models\User;
-use App\Models\WorkspaceMembership;
-use App\Support\Workspaces\WorkspaceContext;
-use Closure;
-use Illuminate\Http\Request;
-use Illuminate\Http\Response as HttpResponse;
-use Illuminate\Support\Facades\Schema;
-use Symfony\Component\HttpFoundation\Response;
-
-class EnsureWorkspaceSelected
-{
-    /**
-     * Handle an incoming request.
-     *
-     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
-     */
-    public function handle(Request $request, Closure $next): Response
-    {
-        $routeName = $request->route()?->getName();
-
-        if (is_string($routeName) && str_contains($routeName, '.auth.')) {
-            return $next($request);
-        }
-
-        $path = '/'.ltrim($request->path(), '/');
-
-        if (str_starts_with($path, '/admin/t/')) {
-            return $next($request);
-        }
-
-        if (in_array($path, ['/admin/no-access', '/admin/choose-workspace'], true)) {
-            return $next($request);
-        }
-
-        $user = $request->user();
-
-        if (! $user instanceof User) {
-            return $next($request);
-        }
-
-        /** @var WorkspaceContext $context */
-        $context = app(WorkspaceContext::class);
-
-        $workspace = $context->resolveInitialWorkspaceFor($user, $request);
-
-        if ($workspace !== null) {
-            return $next($request);
-        }
-
-        $membershipQuery = WorkspaceMembership::query()->where('user_id', $user->getKey());
-
-        $hasAnyActiveMembership = Schema::hasColumn('workspaces', 'archived_at')
-            ? $membershipQuery
-                ->join('workspaces', 'workspace_memberships.workspace_id', '=', 'workspaces.id')
-                ->whereNull('workspaces.archived_at')
-                ->exists()
-            : $membershipQuery->exists();
-
-        $target = $hasAnyActiveMembership ? '/admin/choose-workspace' : '/admin/no-access';
-
-        return new HttpResponse('', 302, ['Location' => $target]);
-    }
-}

app/Models/Tenant.php

@@ -7,7 +7,6 @@
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\HasManyThrough;
@@ -171,11 +170,6 @@ public function memberships(): HasMany
         return $this->hasMany(TenantMembership::class);
     }
 
-    public function workspace(): BelongsTo
-    {
-        return $this->belongsTo(Workspace::class);
-    }
-
     public function roleMappings(): HasMany
     {
         return $this->hasMany(TenantRoleMapping::class);

app/Models/User.php

@@ -3,7 +3,6 @@
 namespace App\Models;
 
 use App\Support\Auth\Capabilities;
-use App\Support\Workspaces\WorkspaceContext;
 use Filament\Models\Contracts\FilamentUser;
 use Filament\Models\Contracts\HasDefaultTenant;
 use Filament\Models\Contracts\HasTenants;
@@ -142,10 +141,7 @@ public function getTenants(Panel $panel): array|Collection
             return collect();
         }
 
-        $workspaceId = app(WorkspaceContext::class)->currentWorkspaceId();
-
         return $this->tenants()
-            ->when($workspaceId !== null, fn ($query) => $query->where('tenants.workspace_id', $workspaceId))
             ->where('status', 'active')
             ->orderBy('name')
             ->get();
@@ -157,8 +153,6 @@ public function getDefaultTenant(Panel $panel): ?Model
             return null;
         }
 
-        $workspaceId = app(WorkspaceContext::class)->currentWorkspaceId();
-
         $tenantId = null;
 
         if ($this->tenantPreferencesTableExists()) {
@@ -170,7 +164,6 @@ public function getDefaultTenant(Panel $panel): ?Model
 
         if ($tenantId !== null) {
             $tenant = $this->tenants()
-                ->when($workspaceId !== null, fn ($query) => $query->where('tenants.workspace_id', $workspaceId))
                 ->where('status', 'active')
                 ->whereKey($tenantId)
                 ->first();
@@ -181,7 +174,6 @@ public function getDefaultTenant(Panel $panel): ?Model
         }
 
         return $this->tenants()
-            ->when($workspaceId !== null, fn ($query) => $query->where('tenants.workspace_id', $workspaceId))
             ->where('status', 'active')
             ->orderBy('name')
             ->first();

app/Models/Workspace.php

@@ -1,43 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsToMany;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-
-class Workspace extends Model
-{
-    /** @use HasFactory<\Database\Factories\WorkspaceFactory> */
-    use HasFactory;
-
-    protected $guarded = [];
-
-    /**
-     * @return HasMany<WorkspaceMembership, $this>
-     */
-    public function memberships(): HasMany
-    {
-        return $this->hasMany(WorkspaceMembership::class);
-    }
-
-    /**
-     * @return BelongsToMany<User, $this>
-     */
-    public function users(): BelongsToMany
-    {
-        return $this->belongsToMany(User::class, 'workspace_memberships')
-            ->using(WorkspaceMembership::class)
-            ->withPivot(['id', 'role'])
-            ->withTimestamps();
-    }
-
-    /**
-     * @return HasMany<Tenant, $this>
-     */
-    public function tenants(): HasMany
-    {
-        return $this->hasMany(Tenant::class);
-    }
-}

app/Models/WorkspaceMembership.php

@@ -1,31 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class WorkspaceMembership extends Model
-{
-    /** @use HasFactory<\Database\Factories\WorkspaceMembershipFactory> */
-    use HasFactory;
-
-    protected $guarded = [];
-
-    /**
-     * @return BelongsTo<Workspace, $this>
-     */
-    public function workspace(): BelongsTo
-    {
-        return $this->belongsTo(Workspace::class);
-    }
-
-    /**
-     * @return BelongsTo<User, $this>
-     */
-    public function user(): BelongsTo
-    {
-        return $this->belongsTo(User::class);
-    }
-}

app/Policies/WorkspaceMembershipPolicy.php

@@ -1,108 +0,0 @@
-<?php
-
-namespace App\Policies;
-
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use App\Services\Auth\WorkspaceCapabilityResolver;
-use App\Support\Auth\Capabilities;
-use App\Support\Auth\WorkspaceRole;
-
-class WorkspaceMembershipPolicy
-{
-    /**
-     * Determine whether the user can view any models.
-     */
-    public function viewAny(User $user): bool
-    {
-        return true;
-    }
-
-    /**
-     * Determine whether the user can view the model.
-     */
-    public function view(User $user, WorkspaceMembership $workspaceMembership): bool
-    {
-        /** @var WorkspaceCapabilityResolver $resolver */
-        $resolver = app(WorkspaceCapabilityResolver::class);
-
-        return $resolver->can($user, $workspaceMembership->workspace, Capabilities::WORKSPACE_MEMBERSHIP_VIEW);
-    }
-
-    /**
-     * Determine whether the user can create models.
-     */
-    public function create(User $user): bool
-    {
-        return true;
-    }
-
-    /**
-     * Determine whether the user can update the model.
-     */
-    public function update(User $user, WorkspaceMembership $workspaceMembership): bool
-    {
-        if ($this->isLastOwner($workspaceMembership)) {
-            return false;
-        }
-
-        /** @var WorkspaceCapabilityResolver $resolver */
-        $resolver = app(WorkspaceCapabilityResolver::class);
-
-        return $resolver->can($user, $workspaceMembership->workspace, Capabilities::WORKSPACE_MEMBERSHIP_MANAGE);
-    }
-
-    /**
-     * Determine whether the user can delete the model.
-     */
-    public function delete(User $user, WorkspaceMembership $workspaceMembership): bool
-    {
-        if ($this->isLastOwner($workspaceMembership)) {
-            return false;
-        }
-
-        /** @var WorkspaceCapabilityResolver $resolver */
-        $resolver = app(WorkspaceCapabilityResolver::class);
-
-        return $resolver->can($user, $workspaceMembership->workspace, Capabilities::WORKSPACE_MEMBERSHIP_MANAGE);
-    }
-
-    /**
-     * Determine whether the user can restore the model.
-     */
-    public function restore(User $user, WorkspaceMembership $workspaceMembership): bool
-    {
-        return false;
-    }
-
-    /**
-     * Determine whether the user can permanently delete the model.
-     */
-    public function forceDelete(User $user, WorkspaceMembership $workspaceMembership): bool
-    {
-        return false;
-    }
-
-    public function manageForWorkspace(User $user, Workspace $workspace): bool
-    {
-        /** @var WorkspaceCapabilityResolver $resolver */
-        $resolver = app(WorkspaceCapabilityResolver::class);
-
-        return $resolver->can($user, $workspace, Capabilities::WORKSPACE_MEMBERSHIP_MANAGE);
-    }
-
-    private function isLastOwner(WorkspaceMembership $membership): bool
-    {
-        if ($membership->role !== WorkspaceRole::Owner->value) {
-            return false;
-        }
-
-        $ownerCount = WorkspaceMembership::query()
-            ->where('workspace_id', $membership->workspace_id)
-            ->where('role', WorkspaceRole::Owner->value)
-            ->count();
-
-        return $ownerCount <= 1;
-    }
-}

app/Policies/WorkspacePolicy.php

@@ -1,74 +0,0 @@
-<?php
-
-namespace App\Policies;
-
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use App\Services\Auth\WorkspaceCapabilityResolver;
-use App\Support\Auth\Capabilities;
-
-class WorkspacePolicy
-{
-    /**
-     * Determine whether the user can view any models.
-     */
-    public function viewAny(User $user): bool
-    {
-        return true;
-    }
-
-    /**
-     * Determine whether the user can view the model.
-     */
-    public function view(User $user, Workspace $workspace): bool
-    {
-        return WorkspaceMembership::query()
-            ->where('user_id', $user->getKey())
-            ->where('workspace_id', $workspace->getKey())
-            ->exists();
-    }
-
-    /**
-     * Determine whether the user can create models.
-     */
-    public function create(User $user): bool
-    {
-        return true;
-    }
-
-    /**
-     * Determine whether the user can update the model.
-     */
-    public function update(User $user, Workspace $workspace): bool
-    {
-        /** @var WorkspaceCapabilityResolver $resolver */
-        $resolver = app(WorkspaceCapabilityResolver::class);
-
-        return $resolver->can($user, $workspace, Capabilities::WORKSPACE_MANAGE);
-    }
-
-    /**
-     * Determine whether the user can delete the model.
-     */
-    public function delete(User $user, Workspace $workspace): bool
-    {
-        return false;
-    }
-
-    /**
-     * Determine whether the user can restore the model.
-     */
-    public function restore(User $user, Workspace $workspace): bool
-    {
-        return false;
-    }
-
-    /**
-     * Determine whether the user can permanently delete the model.
-     */
-    public function forceDelete(User $user, Workspace $workspace): bool
-    {
-        return false;
-    }
-}

app/Providers/Filament/AdminPanelProvider.php

@@ -4,7 +4,6 @@
 
 use App\Filament\Pages\Auth\Login;
 use App\Filament\Pages\ChooseTenant;
-use App\Filament\Pages\ChooseWorkspace;
 use App\Filament\Pages\NoAccess;
 use App\Filament\Pages\Tenancy\RegisterTenant;
 use App\Filament\Pages\TenantDashboard;
@@ -38,7 +37,6 @@ public function panel(Panel $panel): Panel
             ->path('admin')
             ->login(Login::class)
             ->authenticatedRoutes(function (Panel $panel): void {
-                ChooseWorkspace::registerRoutes($panel);
                 ChooseTenant::registerRoutes($panel);
                 NoAccess::registerRoutes($panel);
             })
@@ -81,8 +79,6 @@ public function panel(Panel $panel): Panel
                 VerifyCsrfToken::class,
                 SubstituteBindings::class,
                 'ensure-correct-guard:web',
-                'ensure-workspace-selected',
-                'ensure-filament-tenant-selected',
                 DenyNonMemberTenantAccess::class,
                 DisableBladeIconComponents::class,
                 DispatchServingFilamentEvent::class,

app/Services/Audit/WorkspaceAuditLogger.php

@@ -1,40 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\Audit;
-
-use App\Models\AuditLog;
-use App\Models\User;
-use App\Models\Workspace;
-use Carbon\CarbonImmutable;
-
-class WorkspaceAuditLogger
-{
-    public function log(
-        Workspace $workspace,
-        string $action,
-        array $context = [],
-        ?User $actor = null,
-        string $status = 'success',
-        ?string $resourceType = null,
-        ?string $resourceId = null,
-    ): AuditLog {
-        $metadata = $context['metadata'] ?? [];
-        unset($context['metadata']);
-
-        return AuditLog::create([
-            'tenant_id' => null,
-            'workspace_id' => (int) $workspace->getKey(),
-            'actor_id' => $actor?->getKey(),
-            'actor_email' => $actor?->email,
-            'actor_name' => $actor?->name,
-            'action' => $action,
-            'resource_type' => $resourceType,
-            'resource_id' => $resourceId,
-            'status' => $status,
-            'metadata' => $metadata + $context,
-            'recorded_at' => CarbonImmutable::now(),
-        ]);
-    }
-}

app/Services/Auth/WorkspaceCapabilityResolver.php

@@ -1,100 +0,0 @@
-<?php
-
-namespace App\Services\Auth;
-
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use App\Support\Auth\Capabilities;
-use App\Support\Auth\WorkspaceRole;
-use Illuminate\Support\Facades\Log;
-
-/**
- * Workspace Capability Resolver
- *
- * Resolves user memberships and capabilities for a given workspace.
- * Caches results per request to avoid N+1 queries.
- */
-class WorkspaceCapabilityResolver
-{
-    private array $resolvedMemberships = [];
-
-    private array $loggedDenials = [];
-
-    public function getRole(User $user, Workspace $workspace): ?WorkspaceRole
-    {
-        $membership = $this->getMembership($user, $workspace);
-
-        if ($membership === null) {
-            return null;
-        }
-
-        return WorkspaceRole::tryFrom($membership['role']);
-    }
-
-    public function can(User $user, Workspace $workspace, string $capability): bool
-    {
-        if (! Capabilities::isKnown($capability)) {
-            throw new \InvalidArgumentException("Unknown capability: {$capability}");
-        }
-
-        $role = $this->getRole($user, $workspace);
-
-        if ($role === null) {
-            $this->logDenial($user, $workspace, $capability);
-
-            return false;
-        }
-
-        $allowed = WorkspaceRoleCapabilityMap::hasCapability($role, $capability);
-
-        if (! $allowed) {
-            $this->logDenial($user, $workspace, $capability);
-        }
-
-        return $allowed;
-    }
-
-    public function isMember(User $user, Workspace $workspace): bool
-    {
-        return $this->getMembership($user, $workspace) !== null;
-    }
-
-    public function clearCache(): void
-    {
-        $this->resolvedMemberships = [];
-    }
-
-    private function logDenial(User $user, Workspace $workspace, string $capability): void
-    {
-        $key = implode(':', [(string) $user->getKey(), (string) $workspace->getKey(), $capability]);
-
-        if (isset($this->loggedDenials[$key])) {
-            return;
-        }
-
-        $this->loggedDenials[$key] = true;
-
-        Log::warning('rbac.workspace.denied', [
-            'capability' => $capability,
-            'workspace_id' => (int) $workspace->getKey(),
-            'actor_user_id' => (int) $user->getKey(),
-        ]);
-    }
-
-    private function getMembership(User $user, Workspace $workspace): ?array
-    {
-        $cacheKey = "workspace_membership_{$user->id}_{$workspace->id}";
-
-        if (! isset($this->resolvedMemberships[$cacheKey])) {
-            $membership = WorkspaceMembership::query()
-                ->where('user_id', $user->id)
-                ->where('workspace_id', $workspace->id)
-                ->first(['role']);
-
-            $this->resolvedMemberships[$cacheKey] = $membership?->toArray();
-        }
-
-        return $this->resolvedMemberships[$cacheKey];
-    }
-}

app/Services/Auth/WorkspaceMembershipManager.php

@@ -1,272 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\Auth;
-
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use App\Services\Audit\WorkspaceAuditLogger;
-use App\Support\Audit\AuditActionId;
-use App\Support\Auth\Capabilities;
-use App\Support\Auth\WorkspaceRole;
-use DomainException;
-use Illuminate\Support\Facades\DB;
-
-class WorkspaceMembershipManager
-{
-    public function __construct(public WorkspaceAuditLogger $auditLogger) {}
-
-    public function addMember(
-        Workspace $workspace,
-        User $actor,
-        User $member,
-        string $role,
-        string $source = 'manual',
-    ): WorkspaceMembership {
-        $this->assertValidRole($role);
-        $this->assertActorCanManage($actor, $workspace);
-
-        return DB::transaction(function () use ($workspace, $actor, $member, $role, $source): WorkspaceMembership {
-            $existing = WorkspaceMembership::query()
-                ->where('workspace_id', (int) $workspace->getKey())
-                ->where('user_id', (int) $member->getKey())
-                ->first();
-
-            if ($existing) {
-                if ($existing->role !== $role) {
-                    $fromRole = (string) $existing->role;
-
-                    $existing->forceFill([
-                        'role' => $role,
-                    ])->save();
-
-                    $this->auditLogger->log(
-                        workspace: $workspace,
-                        action: AuditActionId::WorkspaceMembershipRoleChange->value,
-                        context: [
-                            'metadata' => [
-                                'member_user_id' => (int) $member->getKey(),
-                                'from_role' => $fromRole,
-                                'to_role' => $role,
-                                'source' => $source,
-                            ],
-                        ],
-                        actor: $actor,
-                        status: 'success',
-                        resourceType: 'workspace',
-                        resourceId: (string) $workspace->getKey(),
-                    );
-                }
-
-                return $existing->refresh();
-            }
-
-            $membership = WorkspaceMembership::query()->create([
-                'workspace_id' => (int) $workspace->getKey(),
-                'user_id' => (int) $member->getKey(),
-                'role' => $role,
-            ]);
-
-            $this->auditLogger->log(
-                workspace: $workspace,
-                action: AuditActionId::WorkspaceMembershipAdd->value,
-                context: [
-                    'metadata' => [
-                        'member_user_id' => (int) $member->getKey(),
-                        'role' => $role,
-                        'source' => $source,
-                    ],
-                ],
-                actor: $actor,
-                status: 'success',
-                resourceType: 'workspace',
-                resourceId: (string) $workspace->getKey(),
-            );
-
-            return $membership;
-        });
-    }
-
-    public function changeRole(Workspace $workspace, User $actor, WorkspaceMembership $membership, string $newRole): WorkspaceMembership
-    {
-        $this->assertValidRole($newRole);
-        $this->assertActorCanManage($actor, $workspace);
-
-        try {
-            return DB::transaction(function () use ($workspace, $actor, $membership, $newRole): WorkspaceMembership {
-                $membership->refresh();
-
-                if ($membership->workspace_id !== (int) $workspace->getKey()) {
-                    throw new DomainException('Membership belongs to a different workspace.');
-                }
-
-                $oldRole = (string) $membership->role;
-
-                if ($oldRole === $newRole) {
-                    return $membership;
-                }
-
-                $this->guardLastOwnerDemotion($workspace, $membership, $newRole);
-
-                $membership->forceFill([
-                    'role' => $newRole,
-                ])->save();
-
-                $this->auditLogger->log(
-                    workspace: $workspace,
-                    action: AuditActionId::WorkspaceMembershipRoleChange->value,
-                    context: [
-                        'metadata' => [
-                            'member_user_id' => (int) $membership->user_id,
-                            'from_role' => $oldRole,
-                            'to_role' => $newRole,
-                        ],
-                    ],
-                    actor: $actor,
-                    status: 'success',
-                    resourceType: 'workspace',
-                    resourceId: (string) $workspace->getKey(),
-                );
-
-                return $membership->refresh();
-            });
-        } catch (DomainException $exception) {
-            if ($exception->getMessage() === 'You cannot demote the last remaining owner.') {
-                $this->auditLogger->log(
-                    workspace: $workspace,
-                    action: AuditActionId::WorkspaceMembershipLastOwnerBlocked->value,
-                    context: [
-                        'metadata' => [
-                            'member_user_id' => (int) $membership->user_id,
-                            'from_role' => (string) $membership->role,
-                            'attempted_to_role' => $newRole,
-                        ],
-                    ],
-                    actor: $actor,
-                    status: 'blocked',
-                    resourceType: 'workspace',
-                    resourceId: (string) $workspace->getKey(),
-                );
-            }
-
-            throw $exception;
-        }
-    }
-
-    public function removeMember(Workspace $workspace, User $actor, WorkspaceMembership $membership): void
-    {
-        $this->assertActorCanManage($actor, $workspace);
-
-        try {
-            DB::transaction(function () use ($workspace, $actor, $membership): void {
-                $membership->refresh();
-
-                if ($membership->workspace_id !== (int) $workspace->getKey()) {
-                    throw new DomainException('Membership belongs to a different workspace.');
-                }
-
-                $this->guardLastOwnerRemoval($workspace, $membership);
-
-                $memberUserId = (int) $membership->user_id;
-                $oldRole = (string) $membership->role;
-
-                $membership->delete();
-
-                $this->auditLogger->log(
-                    workspace: $workspace,
-                    action: AuditActionId::WorkspaceMembershipRemove->value,
-                    context: [
-                        'metadata' => [
-                            'member_user_id' => $memberUserId,
-                            'role' => $oldRole,
-                        ],
-                    ],
-                    actor: $actor,
-                    status: 'success',
-                    resourceType: 'workspace',
-                    resourceId: (string) $workspace->getKey(),
-                );
-            });
-        } catch (DomainException $exception) {
-            if ($exception->getMessage() === 'You cannot remove the last remaining owner.') {
-                $this->auditLogger->log(
-                    workspace: $workspace,
-                    action: AuditActionId::WorkspaceMembershipLastOwnerBlocked->value,
-                    context: [
-                        'metadata' => [
-                            'member_user_id' => (int) $membership->user_id,
-                            'role' => (string) $membership->role,
-                            'attempted_action' => 'remove',
-                        ],
-                    ],
-                    actor: $actor,
-                    status: 'blocked',
-                    resourceType: 'workspace',
-                    resourceId: (string) $workspace->getKey(),
-                );
-            }
-
-            throw $exception;
-        }
-    }
-
-    private function assertActorCanManage(User $actor, Workspace $workspace): void
-    {
-        /** @var WorkspaceCapabilityResolver $resolver */
-        $resolver = app(WorkspaceCapabilityResolver::class);
-
-        if (! $resolver->can($actor, $workspace, Capabilities::WORKSPACE_MEMBERSHIP_MANAGE)) {
-            throw new DomainException('Forbidden.');
-        }
-    }
-
-    private function assertValidRole(string $role): void
-    {
-        $valid = array_map(
-            static fn (WorkspaceRole $workspaceRole): string => $workspaceRole->value,
-            WorkspaceRole::cases(),
-        );
-
-        if (! in_array($role, $valid, true)) {
-            throw new DomainException('Invalid role.');
-        }
-    }
-
-    private function guardLastOwnerDemotion(Workspace $workspace, WorkspaceMembership $membership, string $newRole): void
-    {
-        if ($membership->role !== WorkspaceRole::Owner->value) {
-            return;
-        }
-
-        if ($newRole === WorkspaceRole::Owner->value) {
-            return;
-        }
-
-        $owners = WorkspaceMembership::query()
-            ->where('workspace_id', (int) $workspace->getKey())
-            ->where('role', WorkspaceRole::Owner->value)
-            ->count();
-
-        if ($owners <= 1) {
-            throw new DomainException('You cannot demote the last remaining owner.');
-        }
-    }
-
-    private function guardLastOwnerRemoval(Workspace $workspace, WorkspaceMembership $membership): void
-    {
-        if ($membership->role !== WorkspaceRole::Owner->value) {
-            return;
-        }
-
-        $owners = WorkspaceMembership::query()
-            ->where('workspace_id', (int) $workspace->getKey())
-            ->where('role', WorkspaceRole::Owner->value)
-            ->count();
-
-        if ($owners <= 1) {
-            throw new DomainException('You cannot remove the last remaining owner.');
-        }
-    }
-}

app/Services/Auth/WorkspaceRoleCapabilityMap.php

@@ -1,74 +0,0 @@
-<?php
-
-namespace App\Services\Auth;
-
-use App\Support\Auth\Capabilities;
-use App\Support\Auth\WorkspaceRole;
-
-/**
- * Workspace Role to Capability Mapping (Single Source of Truth)
- *
- * This class defines which capabilities each workspace role has.
- * All capability strings MUST be references from the Capabilities registry.
- */
-class WorkspaceRoleCapabilityMap
-{
-    /**
-     * @var array<string, array<int, string>>
-     */
-    private static array $roleCapabilities = [
-        WorkspaceRole::Owner->value => [
-            Capabilities::WORKSPACE_VIEW,
-            Capabilities::WORKSPACE_MANAGE,
-            Capabilities::WORKSPACE_ARCHIVE,
-            Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
-            Capabilities::WORKSPACE_MEMBERSHIP_MANAGE,
-        ],
-
-        WorkspaceRole::Manager->value => [
-            Capabilities::WORKSPACE_VIEW,
-            Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
-            Capabilities::WORKSPACE_MEMBERSHIP_MANAGE,
-        ],
-
-        WorkspaceRole::Operator->value => [
-            Capabilities::WORKSPACE_VIEW,
-            Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
-        ],
-
-        WorkspaceRole::Readonly->value => [
-            Capabilities::WORKSPACE_VIEW,
-        ],
-    ];
-
-    /**
-     * @return array<string>
-     */
-    public static function getCapabilities(WorkspaceRole|string $role): array
-    {
-        $roleValue = $role instanceof WorkspaceRole ? $role->value : $role;
-
-        return self::$roleCapabilities[$roleValue] ?? [];
-    }
-
-    /**
-     * @return array<string>
-     */
-    public static function rolesWithCapability(string $capability): array
-    {
-        $roles = [];
-
-        foreach (self::$roleCapabilities as $role => $capabilities) {
-            if (in_array($capability, $capabilities, true)) {
-                $roles[] = $role;
-            }
-        }
-
-        return $roles;
-    }
-
-    public static function hasCapability(WorkspaceRole|string $role, string $capability): bool
-    {
-        return in_array($capability, self::getCapabilities($role), true);
-    }
-}

app/Support/Auth/Capabilities.php

@@ -15,18 +15,6 @@ class Capabilities
      */
     private static ?array $all = null;
 
-    // Workspaces
-    public const WORKSPACE_VIEW = 'workspace.view';
-
-    public const WORKSPACE_MANAGE = 'workspace.manage';
-
-    public const WORKSPACE_ARCHIVE = 'workspace.archive';
-
-    // Workspace memberships
-    public const WORKSPACE_MEMBERSHIP_VIEW = 'workspace_membership.view';
-
-    public const WORKSPACE_MEMBERSHIP_MANAGE = 'workspace_membership.manage';
-
     // Tenants
     public const TENANT_VIEW = 'tenant.view';
 

app/Support/Auth/WorkspaceRole.php

@@ -1,11 +0,0 @@
-<?php
-
-namespace App\Support\Auth;
-
-enum WorkspaceRole: string
-{
-    case Owner = 'owner';
-    case Manager = 'manager';
-    case Operator = 'operator';
-    case Readonly = 'readonly';
-}

app/Support/Middleware/EnsureFilamentTenantSelected.php

@@ -1,125 +0,0 @@
-<?php
-
-namespace App\Support\Middleware;
-
-use App\Models\Tenant;
-use App\Models\User;
-use App\Models\Workspace;
-use App\Services\Auth\CapabilityResolver;
-use App\Support\Workspaces\WorkspaceContext;
-use Closure;
-use Filament\Facades\Filament;
-use Filament\Models\Contracts\HasTenants;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\Response;
-
-class EnsureFilamentTenantSelected
-{
-    /**
-     * @param  Closure(Request): Response  $next
-     */
-    public function handle(Request $request, Closure $next): Response
-    {
-        if ($request->route()?->hasParameter('tenant')) {
-            $user = $request->user();
-
-            if ($user === null) {
-                return $next($request);
-            }
-
-            if (! $user instanceof HasTenants) {
-                abort(404);
-            }
-
-            $panel = Filament::getCurrentOrDefaultPanel();
-
-            if (! $panel->hasTenancy()) {
-                return $next($request);
-            }
-
-            $tenantParameter = $request->route()->parameter('tenant');
-
-            $tenant = $panel->getTenant($tenantParameter);
-
-            if (! $tenant instanceof Tenant) {
-                abort(404);
-            }
-
-            $workspaceContext = app(WorkspaceContext::class);
-            $workspaceId = $workspaceContext->currentWorkspaceId($request);
-
-            if ($workspaceId === null) {
-                abort(404);
-            }
-
-            if ((int) $tenant->workspace_id !== (int) $workspaceId) {
-                abort(404);
-            }
-
-            $workspace = Workspace::query()->whereKey($workspaceId)->first();
-
-            if (! $workspace instanceof Workspace) {
-                abort(404);
-            }
-
-            if (! $user instanceof User || ! $workspaceContext->isMember($user, $workspace)) {
-                abort(404);
-            }
-
-            if (! $user->canAccessTenant($tenant)) {
-                abort(404);
-            }
-
-            Filament::setTenant($tenant, true);
-
-            return $next($request);
-        }
-
-        if (filled(Filament::getTenant())) {
-            return $next($request);
-        }
-
-        $user = $request->user();
-
-        if (! $user instanceof User) {
-            return $next($request);
-        }
-
-        $tenant = null;
-
-        try {
-            $tenant = Tenant::current();
-        } catch (\RuntimeException) {
-            $tenant = null;
-        }
-
-        if ($tenant instanceof Tenant && ! app(CapabilityResolver::class)->isMember($user, $tenant)) {
-            $tenant = null;
-        }
-
-        if (! $tenant) {
-            $tenant = $user->tenants()
-                ->whereNull('deleted_at')
-                ->where('status', 'active')
-                ->first();
-        }
-
-        if (! $tenant) {
-            $tenant = $user->tenants()
-                ->whereNull('deleted_at')
-                ->first();
-        }
-
-        if (! $tenant) {
-            $tenant = $user->tenants()
-                ->withTrashed()
-                ->first();
-        }
-
-        if ($tenant) {
-            Filament::setTenant($tenant, true);
-        }
-
-        return $next($request);
-    }
-}

app/Support/Rbac/WorkspaceAccessContext.php

@@ -1,45 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Support\Rbac;
-
-use App\Models\User;
-use App\Models\Workspace;
-
-/**
- * DTO representing the access context for a workspace-scoped UI action.
- */
-final readonly class WorkspaceAccessContext
-{
-    public function __construct(
-        public ?User $user,
-        public ?Workspace $workspace,
-        public bool $isMember,
-        public bool $hasCapability,
-    ) {}
-
-    /**
-     * Non-members should receive 404 (deny-as-not-found).
-     */
-    public function shouldDenyAsNotFound(): bool
-    {
-        return ! $this->isMember;
-    }
-
-    /**
-     * Members without capability should receive 403 (forbidden).
-     */
-    public function shouldDenyAsForbidden(): bool
-    {
-        return $this->isMember && ! $this->hasCapability;
-    }
-
-    /**
-     * User is authorized to perform the action.
-     */
-    public function isAuthorized(): bool
-    {
-        return $this->isMember && $this->hasCapability;
-    }
-}

app/Support/Workspaces/WorkspaceContext.php

@@ -1,133 +0,0 @@
-<?php
-
-namespace App\Support\Workspaces;
-
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use Illuminate\Http\Request;
-
-final class WorkspaceContext
-{
-    public const SESSION_KEY = 'current_workspace_id';
-
-    public function __construct(private WorkspaceResolver $resolver) {}
-
-    public function currentWorkspaceId(?Request $request = null): ?int
-    {
-        $session = ($request && $request->hasSession()) ? $request->session() : session();
-
-        $id = $session->get(self::SESSION_KEY);
-
-        return is_int($id) ? $id : (is_numeric($id) ? (int) $id : null);
-    }
-
-    public function currentWorkspace(?Request $request = null): ?Workspace
-    {
-        $id = $this->currentWorkspaceId($request);
-
-        if (! $id) {
-            return null;
-        }
-
-        $workspace = Workspace::query()->whereKey($id)->first();
-
-        if (! $workspace) {
-            return null;
-        }
-
-        if (! $this->isWorkspaceSelectable($workspace)) {
-            return null;
-        }
-
-        return $workspace;
-    }
-
-    public function setCurrentWorkspace(Workspace $workspace, ?User $user = null, ?Request $request = null): void
-    {
-        $session = ($request && $request->hasSession()) ? $request->session() : session();
-        $session->put(self::SESSION_KEY, (int) $workspace->getKey());
-
-        if ($user !== null) {
-            $user->forceFill(['last_workspace_id' => (int) $workspace->getKey()])->save();
-        }
-    }
-
-    public function clearCurrentWorkspace(?User $user = null, ?Request $request = null): void
-    {
-        $session = ($request && $request->hasSession()) ? $request->session() : session();
-        $session->forget(self::SESSION_KEY);
-
-        if ($user !== null && $user->last_workspace_id !== null) {
-            $user->forceFill(['last_workspace_id' => null])->save();
-        }
-    }
-
-    public function resolveInitialWorkspaceFor(User $user, ?Request $request = null): ?Workspace
-    {
-        $session = ($request && $request->hasSession()) ? $request->session() : session();
-
-        $currentId = $this->currentWorkspaceId($request);
-
-        if ($currentId) {
-            $current = Workspace::query()->whereKey($currentId)->first();
-
-            if (! $current instanceof Workspace || ! $this->isWorkspaceSelectable($current) || ! $this->isMember($user, $current)) {
-                $session->forget(self::SESSION_KEY);
-
-                if ((int) $user->last_workspace_id === (int) $currentId) {
-                    $user->forceFill(['last_workspace_id' => null])->save();
-                }
-            } else {
-                return $current;
-            }
-        }
-
-        if ($user->last_workspace_id !== null) {
-            $workspace = Workspace::query()->whereKey($user->last_workspace_id)->first();
-
-            if (! $workspace instanceof Workspace || ! $this->isWorkspaceSelectable($workspace) || ! $this->isMember($user, $workspace)) {
-                $user->forceFill(['last_workspace_id' => null])->save();
-            } else {
-                $session->put(self::SESSION_KEY, (int) $workspace->getKey());
-
-                return $workspace;
-            }
-        }
-
-        $memberships = WorkspaceMembership::query()
-            ->where('user_id', $user->getKey())
-            ->with('workspace')
-            ->get();
-
-        $selectableWorkspaces = $memberships
-            ->map(fn (WorkspaceMembership $membership) => $membership->workspace)
-            ->filter(fn (?Workspace $workspace) => $workspace instanceof Workspace && $this->isWorkspaceSelectable($workspace))
-            ->values();
-
-        if ($selectableWorkspaces->count() === 1) {
-            /** @var Workspace $workspace */
-            $workspace = $selectableWorkspaces->first();
-
-            $session->put(self::SESSION_KEY, (int) $workspace->getKey());
-            $user->forceFill(['last_workspace_id' => (int) $workspace->getKey()])->save();
-
-            return $workspace;
-        }
-
-        return null;
-    }
-
-    public function isMember(User $user, Workspace $workspace): bool
-    {
-        return WorkspaceMembership::query()
-            ->where('user_id', $user->getKey())
-            ->where('workspace_id', $workspace->getKey())
-            ->exists();
-    }
-
-    private function isWorkspaceSelectable(Workspace $workspace): bool
-    {
-        return empty($workspace->archived_at);
-    }
-}

app/Support/Workspaces/WorkspaceResolver.php

@@ -1,25 +0,0 @@
-<?php
-
-namespace App\Support\Workspaces;
-
-use App\Models\Workspace;
-
-final class WorkspaceResolver
-{
-    public function resolve(string $value): ?Workspace
-    {
-        $workspace = Workspace::query()
-            ->where('slug', $value)
-            ->first();
-
-        if ($workspace !== null) {
-            return $workspace;
-        }
-
-        if (! ctype_digit($value)) {
-            return null;
-        }
-
-        return Workspace::query()->whereKey((int) $value)->first();
-    }
-}

bootstrap/app.php

@@ -14,17 +14,12 @@
         $middleware->alias([
             'ensure-correct-guard' => \App\Http\Middleware\EnsureCorrectGuard::class,
             'ensure-platform-capability' => \App\Http\Middleware\EnsurePlatformCapability::class,
-            'ensure-workspace-member' => \App\Http\Middleware\EnsureWorkspaceMember::class,
-            'ensure-workspace-selected' => \App\Http\Middleware\EnsureWorkspaceSelected::class,
-            'ensure-filament-tenant-selected' => \App\Support\Middleware\EnsureFilamentTenantSelected::class,
         ]);
 
         $middleware->prependToPriorityList(
             \Illuminate\Contracts\Auth\Middleware\AuthenticatesRequests::class,
             \App\Http\Middleware\EnsureCorrectGuard::class,
         );
-
-        $middleware->redirectGuestsTo('/admin/login');
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         //

database/factories/WorkspaceFactory.php

@@ -1,27 +0,0 @@
-<?php
-
-namespace Database\Factories;
-
-use Illuminate\Database\Eloquent\Factories\Factory;
-use Illuminate\Support\Str;
-
-/**
- * @extends \Illuminate\Database\Eloquent\Factories\Factory<\App\Models\Workspace>
- */
-class WorkspaceFactory extends Factory
-{
-    /**
-     * Define the model's default state.
-     *
-     * @return array<string, mixed>
-     */
-    public function definition(): array
-    {
-        $name = $this->faker->company();
-
-        return [
-            'name' => $name,
-            'slug' => Str::slug($name).'-'.$this->faker->unique()->randomNumber(5),
-        ];
-    }
-}

database/factories/WorkspaceMembershipFactory.php

@@ -1,25 +0,0 @@
-<?php
-
-namespace Database\Factories;
-
-use Illuminate\Database\Eloquent\Factories\Factory;
-
-/**
- * @extends \Illuminate\Database\Eloquent\Factories\Factory<\App\Models\WorkspaceMembership>
- */
-class WorkspaceMembershipFactory extends Factory
-{
-    /**
-     * Define the model's default state.
-     *
-     * @return array<string, mixed>
-     */
-    public function definition(): array
-    {
-        return [
-            'workspace_id' => \App\Models\Workspace::factory(),
-            'user_id' => \App\Models\User::factory(),
-            'role' => 'operator',
-        ];
-    }
-}

database/migrations/2026_01_31_230301_create_workspaces_table.php

@@ -1,31 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        Schema::create('workspaces', function (Blueprint $table) {
-            $table->id();
-            $table->string('name');
-            $table->string('slug')->nullable()->unique();
-            $table->timestamps();
-
-            $table->index('name');
-        });
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        Schema::dropIfExists('workspaces');
-    }
-};

database/migrations/2026_01_31_230302_create_workspace_memberships_table.php

@@ -1,33 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        Schema::create('workspace_memberships', function (Blueprint $table) {
-            $table->id();
-            $table->foreignId('workspace_id')->constrained()->cascadeOnDelete();
-            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
-            $table->enum('role', ['owner', 'manager', 'operator', 'readonly']);
-            $table->timestamps();
-
-            $table->unique(['workspace_id', 'user_id']);
-            $table->index(['workspace_id', 'role']);
-        });
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        Schema::dropIfExists('workspace_memberships');
-    }
-};

database/migrations/2026_01_31_230303_add_last_workspace_id_to_users_table.php

@@ -1,32 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        Schema::table('users', function (Blueprint $table) {
-            $table->foreignId('last_workspace_id')
-                ->nullable()
-                ->after('remember_token')
-                ->constrained('workspaces')
-                ->nullOnDelete();
-        });
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        Schema::table('users', function (Blueprint $table) {
-            $table->dropConstrainedForeignId('last_workspace_id');
-        });
-    }
-};

database/migrations/2026_01_31_230304_add_workspace_id_to_tenants_table.php

@@ -1,47 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        $driver = DB::getDriverName();
-
-        Schema::table('tenants', function (Blueprint $table) use ($driver): void {
-            $column = $table->foreignId('workspace_id')->nullable();
-
-            if ($driver !== 'sqlite') {
-                $column
-                    ->after('id')
-                    ->constrained('workspaces')
-                    ->nullOnDelete();
-            }
-
-            $table->index('workspace_id');
-        });
-
-        if ($driver === 'sqlite') {
-            // SQLite table rebuilds can drop/flatten the partial index defined in
-            // 2025_12_11_192942_add_is_current_to_tenants.php. Recreate it here.
-            DB::statement('DROP INDEX IF EXISTS tenants_current_unique');
-            DB::statement('CREATE UNIQUE INDEX tenants_current_unique ON tenants (is_current) WHERE is_current = 1 AND deleted_at IS NULL');
-        }
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        Schema::table('tenants', function (Blueprint $table) {
-            $table->dropConstrainedForeignId('workspace_id');
-        });
-    }
-};

database/migrations/2026_02_01_002054_add_workspace_id_to_audit_logs_table.php

@@ -1,164 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        $driver = Schema::getConnection()->getDriverName();
-
-        if ($driver === 'sqlite') {
-            Schema::disableForeignKeyConstraints();
-
-            Schema::rename('audit_logs', 'audit_logs_old');
-
-            foreach ([
-                'audit_logs_tenant_id_action_index',
-                'audit_logs_tenant_id_resource_type_index',
-                'audit_logs_recorded_at_index',
-            ] as $indexName) {
-                DB::statement("DROP INDEX IF EXISTS {$indexName}");
-            }
-
-            Schema::create('audit_logs', function (Blueprint $table) {
-                $table->id();
-                $table->foreignId('tenant_id')->nullable()->constrained()->cascadeOnDelete();
-                $table->foreignId('workspace_id')->nullable()->constrained()->nullOnDelete();
-                $table->unsignedBigInteger('actor_id')->nullable();
-                $table->string('actor_email')->nullable();
-                $table->string('actor_name')->nullable();
-                $table->string('action');
-                $table->string('resource_type')->nullable();
-                $table->string('resource_id')->nullable();
-                $table->string('status')->default('success');
-                $table->json('metadata')->nullable();
-                $table->timestamp('recorded_at')->useCurrent();
-                $table->timestamps();
-
-                $table->index(['tenant_id', 'action']);
-                $table->index(['tenant_id', 'resource_type']);
-                $table->index(['workspace_id', 'action']);
-                $table->index(['workspace_id', 'resource_type']);
-                $table->index('recorded_at');
-            });
-
-            DB::table('audit_logs_old')->orderBy('id')->chunkById(500, function ($rows): void {
-                foreach ($rows as $row) {
-                    DB::table('audit_logs')->insert([
-                        'id' => $row->id,
-                        'tenant_id' => $row->tenant_id,
-                        'workspace_id' => null,
-                        'actor_id' => $row->actor_id,
-                        'actor_email' => $row->actor_email,
-                        'actor_name' => $row->actor_name,
-                        'action' => $row->action,
-                        'resource_type' => $row->resource_type,
-                        'resource_id' => $row->resource_id,
-                        'status' => $row->status,
-                        'metadata' => $row->metadata,
-                        'recorded_at' => $row->recorded_at,
-                        'created_at' => $row->created_at,
-                        'updated_at' => $row->updated_at,
-                    ]);
-                }
-            }, 'id');
-
-            Schema::drop('audit_logs_old');
-            Schema::enableForeignKeyConstraints();
-
-            return;
-        }
-
-        DB::statement('ALTER TABLE audit_logs ALTER COLUMN tenant_id DROP NOT NULL');
-
-        Schema::table('audit_logs', function (Blueprint $table) {
-            $table->foreignId('workspace_id')->nullable()->constrained()->nullOnDelete()->after('tenant_id');
-
-            $table->index(['workspace_id', 'action']);
-            $table->index(['workspace_id', 'resource_type']);
-        });
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        $driver = Schema::getConnection()->getDriverName();
-
-        if ($driver === 'sqlite') {
-            Schema::disableForeignKeyConstraints();
-
-            Schema::rename('audit_logs', 'audit_logs_new');
-
-            foreach ([
-                'audit_logs_tenant_id_action_index',
-                'audit_logs_tenant_id_resource_type_index',
-                'audit_logs_recorded_at_index',
-                'audit_logs_workspace_id_action_index',
-                'audit_logs_workspace_id_resource_type_index',
-            ] as $indexName) {
-                DB::statement("DROP INDEX IF EXISTS {$indexName}");
-            }
-
-            Schema::create('audit_logs', function (Blueprint $table) {
-                $table->id();
-                $table->foreignId('tenant_id')->constrained()->cascadeOnDelete();
-                $table->unsignedBigInteger('actor_id')->nullable();
-                $table->string('actor_email')->nullable();
-                $table->string('actor_name')->nullable();
-                $table->string('action');
-                $table->string('resource_type')->nullable();
-                $table->string('resource_id')->nullable();
-                $table->string('status')->default('success');
-                $table->json('metadata')->nullable();
-                $table->timestamp('recorded_at')->useCurrent();
-                $table->timestamps();
-
-                $table->index(['tenant_id', 'action']);
-                $table->index(['tenant_id', 'resource_type']);
-                $table->index('recorded_at');
-            });
-
-            DB::table('audit_logs_new')->whereNotNull('tenant_id')->orderBy('id')->chunkById(500, function ($rows): void {
-                foreach ($rows as $row) {
-                    DB::table('audit_logs')->insert([
-                        'id' => $row->id,
-                        'tenant_id' => $row->tenant_id,
-                        'actor_id' => $row->actor_id,
-                        'actor_email' => $row->actor_email,
-                        'actor_name' => $row->actor_name,
-                        'action' => $row->action,
-                        'resource_type' => $row->resource_type,
-                        'resource_id' => $row->resource_id,
-                        'status' => $row->status,
-                        'metadata' => $row->metadata,
-                        'recorded_at' => $row->recorded_at,
-                        'created_at' => $row->created_at,
-                        'updated_at' => $row->updated_at,
-                    ]);
-                }
-            }, 'id');
-
-            Schema::drop('audit_logs_new');
-            Schema::enableForeignKeyConstraints();
-
-            return;
-        }
-
-        Schema::table('audit_logs', function (Blueprint $table) {
-            $table->dropConstrainedForeignId('workspace_id');
-            $table->dropIndex(['workspace_id', 'action']);
-            $table->dropIndex(['workspace_id', 'resource_type']);
-        });
-
-        DB::statement('ALTER TABLE audit_logs ALTER COLUMN tenant_id SET NOT NULL');
-    }
-};

database/migrations/2026_02_01_085446_backfill_default_workspace_and_memberships.php

@@ -1,142 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        if (! Schema::hasTable('workspaces')) {
-            return;
-        }
-
-        $now = now();
-
-        $defaultWorkspaceId = DB::table('workspaces')
-            ->where('slug', 'default')
-            ->value('id');
-
-        if (! $defaultWorkspaceId) {
-            $defaultWorkspaceId = DB::table('workspaces')->insertGetId([
-                'name' => 'Default Workspace',
-                'slug' => 'default',
-                'created_at' => $now,
-                'updated_at' => $now,
-            ]);
-        }
-
-        if (Schema::hasTable('tenants') && Schema::hasColumn('tenants', 'workspace_id')) {
-            DB::table('tenants')
-                ->whereNull('workspace_id')
-                ->update([
-                    'workspace_id' => $defaultWorkspaceId,
-                    'updated_at' => $now,
-                ]);
-        }
-
-        if (! Schema::hasTable('workspace_memberships')) {
-            return;
-        }
-
-        $roleRankToRole = [
-            4 => 'owner',
-            3 => 'manager',
-            2 => 'operator',
-            1 => 'readonly',
-        ];
-
-        $userRoleRanks = collect();
-
-        if (Schema::hasTable('tenant_memberships')) {
-            $userRoleRanks = DB::table('tenant_memberships')
-                ->select([
-                    'user_id',
-                    DB::raw("MAX(CASE role WHEN 'owner' THEN 4 WHEN 'manager' THEN 3 WHEN 'operator' THEN 2 WHEN 'readonly' THEN 1 ELSE 0 END) AS role_rank"),
-                ])
-                ->groupBy('user_id')
-                ->get();
-        }
-
-        $rows = [];
-        $userIds = [];
-
-        foreach ($userRoleRanks as $row) {
-            $role = $roleRankToRole[(int) $row->role_rank] ?? null;
-
-            if (! $role) {
-                continue;
-            }
-
-            $rows[] = [
-                'workspace_id' => $defaultWorkspaceId,
-                'user_id' => $row->user_id,
-                'role' => $role,
-                'created_at' => $now,
-                'updated_at' => $now,
-            ];
-            $userIds[] = $row->user_id;
-        }
-
-        if (empty($rows) && Schema::hasTable('users')) {
-            $firstUserId = DB::table('users')->orderBy('id')->value('id');
-
-            if ($firstUserId) {
-                $rows[] = [
-                    'workspace_id' => $defaultWorkspaceId,
-                    'user_id' => $firstUserId,
-                    'role' => 'owner',
-                    'created_at' => $now,
-                    'updated_at' => $now,
-                ];
-                $userIds[] = $firstUserId;
-            }
-        }
-
-        if (! empty($rows)) {
-            foreach (array_chunk($rows, 500) as $chunk) {
-                DB::table('workspace_memberships')->insertOrIgnore($chunk);
-            }
-        }
-
-        $ownerCount = DB::table('workspace_memberships')
-            ->where('workspace_id', $defaultWorkspaceId)
-            ->where('role', 'owner')
-            ->count();
-
-        if ($ownerCount === 0) {
-            $firstMembershipId = DB::table('workspace_memberships')
-                ->where('workspace_id', $defaultWorkspaceId)
-                ->orderBy('id')
-                ->value('id');
-
-            if ($firstMembershipId) {
-                DB::table('workspace_memberships')
-                    ->where('id', $firstMembershipId)
-                    ->update([
-                        'role' => 'owner',
-                        'updated_at' => $now,
-                    ]);
-            }
-        }
-
-        if (Schema::hasTable('users') && ! empty($userIds) && Schema::hasColumn('users', 'last_workspace_id')) {
-            DB::table('users')
-                ->whereIn('id', array_unique($userIds))
-                ->whereNull('last_workspace_id')
-                ->update([
-                    'last_workspace_id' => $defaultWorkspaceId,
-                    'updated_at' => $now,
-                ]);
-        }
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void {}
-};

database/migrations/2026_02_01_085849_add_archived_at_to_workspaces_table.php

@@ -1,30 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        Schema::table('workspaces', function (Blueprint $table) {
-            $table->timestamp('archived_at')->nullable()->after('slug');
-            $table->index('archived_at');
-        });
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        Schema::table('workspaces', function (Blueprint $table) {
-            $table->dropIndex(['archived_at']);
-            $table->dropColumn('archived_at');
-        });
-    }
-};

resources/views/filament/pages/choose-tenant.blade.php

@@ -1,39 +1,37 @@
-<x-filament-panels::page>
+<x-filament::section>
-    <x-filament::section>
+    <div class="flex flex-col gap-4">
-        <div class="flex flex-col gap-4">
+        <div class="text-sm text-gray-600 dark:text-gray-300">
-            <div class="text-sm text-gray-600 dark:text-gray-300">
+            Select a tenant to continue.
-                Select a tenant to continue.
-            </div>
-
-            @php
-                $tenants = $this->getTenants();
-            @endphp
-
-            @if ($tenants->isEmpty())
-                <div class="rounded-md border border-gray-200 bg-gray-50 p-4 text-sm text-gray-700 dark:border-gray-800 dark:bg-gray-900 dark:text-gray-200">
-                    No tenants are available for your account.
-                </div>
-            @else
-                <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-3">
-                    @foreach ($tenants as $tenant)
-                        <div wire:key="tenant-{{ $tenant->id }}" class="rounded-lg border border-gray-200 p-4 dark:border-gray-800">
-                            <div class="flex flex-col gap-3">
-                                <div class="font-medium text-gray-900 dark:text-gray-100">
-                                    {{ $tenant->name }}
-                                </div>
-
-                                <x-filament::button
-                                    type="button"
-                                    color="primary"
-                                    wire:click="selectTenant({{ (int) $tenant->id }})"
-                                >
-                                    Continue
-                                </x-filament::button>
-                            </div>
-                        </div>
-                    @endforeach
-                </div>
-            @endif
         </div>
-    </x-filament::section>
+
-</x-filament-panels::page>
+        @php
+            $tenants = $this->getTenants();
+        @endphp
+
+        @if ($tenants->isEmpty())
+            <div class="rounded-md border border-gray-200 bg-gray-50 p-4 text-sm text-gray-700 dark:border-gray-800 dark:bg-gray-900 dark:text-gray-200">
+                No tenants are available for your account.
+            </div>
+        @else
+            <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-3">
+                @foreach ($tenants as $tenant)
+                    <div wire:key="tenant-{{ $tenant->id }}" class="rounded-lg border border-gray-200 p-4 dark:border-gray-800">
+                        <div class="flex flex-col gap-3">
+                            <div class="font-medium text-gray-900 dark:text-gray-100">
+                                {{ $tenant->name }}
+                            </div>
+
+                            <x-filament::button
+                                type="button"
+                                color="primary"
+                                wire:click="selectTenant({{ (int) $tenant->id }})"
+                            >
+                                Continue
+                            </x-filament::button>
+                        </div>
+                    </div>
+                @endforeach
+            </div>
+        @endif
+    </div>
+</x-filament::section>

resources/views/filament/pages/choose-workspace.blade.php

@@ -1,40 +0,0 @@
-<x-filament-panels::page>
-    <x-filament::section>
-        <div class="flex flex-col gap-4">
-            <div class="text-sm text-gray-600 dark:text-gray-300">
-                Select a workspace to continue.
-            </div>
-
-            @php
-                $workspaces = $this->getWorkspaces();
-            @endphp
-
-            @if ($workspaces->isEmpty())
-                <div class="rounded-md border border-gray-200 bg-gray-50 p-4 text-sm text-gray-700 dark:border-gray-800 dark:bg-gray-900 dark:text-gray-200">
-                    No active workspaces are available for your account.
-                    You can create one using the button above.
-                </div>
-            @else
-                <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-3">
-                    @foreach ($workspaces as $workspace)
-                        <div wire:key="workspace-{{ $workspace->id }}" class="rounded-lg border border-gray-200 p-4 dark:border-gray-800">
-                            <div class="flex flex-col gap-3">
-                                <div class="font-medium text-gray-900 dark:text-gray-100">
-                                    {{ $workspace->name }}
-                                </div>
-
-                                <x-filament::button
-                                    type="button"
-                                    color="primary"
-                                    wire:click="selectWorkspace({{ (int) $workspace->id }})"
-                                >
-                                    Continue
-                                </x-filament::button>
-                            </div>
-                        </div>
-                    @endforeach
-                </div>
-            @endif
-        </div>
-    </x-filament::section>
-</x-filament-panels::page>

resources/views/filament/pages/no-access.blade.php

@@ -1,13 +1,11 @@
-<x-filament-panels::page>
+<x-filament::section>
-    <x-filament::section>
+    <div class="flex flex-col gap-3">
-        <div class="flex flex-col gap-3">
+        <div class="text-lg font-semibold text-gray-900 dark:text-gray-100">
-            <div class="text-lg font-semibold text-gray-900 dark:text-gray-100">
+            You don’t have access to any tenants yet.
-                You don’t have access to any tenants yet.
-            </div>
-
-            <div class="text-sm text-gray-600 dark:text-gray-300">
-                Ask an administrator to add you to a tenant, then sign in again.
-            </div>
         </div>
-    </x-filament::section>
+
-</x-filament-panels::page>
+        <div class="text-sm text-gray-600 dark:text-gray-300">
+            Ask an administrator to add you to a tenant, then sign in again.
+        </div>
+    </div>
+</x-filament::section>

routes/web.php

@@ -1,18 +1,9 @@
 <?php
 
-use App\Filament\Pages\Tenancy\RegisterTenant;
 use App\Http\Controllers\AdminConsentCallbackController;
 use App\Http\Controllers\Auth\EntraController;
 use App\Http\Controllers\RbacDelegatedAuthController;
 use App\Http\Controllers\TenantOnboardingController;
-use App\Models\Workspace;
-use App\Support\Middleware\DenyNonMemberTenantAccess;
-use App\Support\Workspaces\WorkspaceContext;
-use App\Support\Workspaces\WorkspaceResolver;
-use Filament\Http\Middleware\Authenticate as FilamentAuthenticate;
-use Filament\Http\Middleware\DisableBladeIconComponents;
-use Filament\Http\Middleware\DispatchServingFilamentEvent;
-use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Route;
 
 Route::get('/', function () {
@@ -25,24 +16,6 @@
 Route::get('/admin/consent/start', TenantOnboardingController::class)
     ->name('admin.consent.start');
 
-// Fallback route: Filament's layout generates this URL when tenancy registration is enabled.
-// In this app, package route registration may not always define it early enough, which breaks
-// rendering on tenant-scoped routes.
-Route::middleware([
-    'web',
-    'panel:admin',
-    'ensure-correct-guard:web',
-    DenyNonMemberTenantAccess::class,
-    DisableBladeIconComponents::class,
-    DispatchServingFilamentEvent::class,
-    FilamentAuthenticate::class,
-    'ensure-workspace-selected',
-])
-    ->prefix('/admin')
-    ->name('filament.admin.')
-    ->get('/register-tenant', RegisterTenant::class)
-    ->name('tenant.registration');
-
 Route::get('/admin/rbac/start', [RbacDelegatedAuthController::class, 'start'])
     ->name('admin.rbac.start');
 
@@ -55,76 +28,3 @@
 Route::get('/auth/entra/callback', [EntraController::class, 'callback'])
     ->middleware('throttle:entra-callback')
     ->name('auth.entra.callback');
-
-Route::middleware(['web', 'auth', 'ensure-workspace-selected'])
-    ->get('/admin/managed-tenants', function (Request $request) {
-        $workspace = app(WorkspaceContext::class)->currentWorkspace($request);
-
-        if (! $workspace instanceof Workspace) {
-            return redirect('/admin/choose-workspace');
-        }
-
-        return redirect('/admin/w/'.($workspace->slug ?? $workspace->getKey()).'/managed-tenants');
-    })
-    ->name('admin.legacy.managed-tenants.index');
-
-Route::middleware(['web', 'auth', 'ensure-workspace-selected'])
-    ->get('/admin/managed-tenants/onboarding', function (Request $request) {
-        $workspace = app(WorkspaceContext::class)->currentWorkspace($request);
-
-        if (! $workspace instanceof Workspace) {
-            return redirect('/admin/choose-workspace');
-        }
-
-        return redirect('/admin/w/'.($workspace->slug ?? $workspace->getKey()).'/managed-tenants/onboarding');
-    })
-    ->name('admin.legacy.managed-tenants.onboarding');
-
-Route::middleware(['web', 'auth', 'ensure-workspace-selected'])
-    ->get('/admin/new', function (Request $request) {
-        $workspace = app(WorkspaceContext::class)->currentWorkspace($request);
-
-        if (! $workspace instanceof Workspace) {
-            return redirect('/admin/choose-workspace');
-        }
-
-        return redirect('/admin/w/'.($workspace->slug ?? $workspace->getKey()).'/managed-tenants/onboarding');
-    })
-    ->name('admin.legacy.onboarding');
-
-Route::bind('workspace', function (string $value): Workspace {
-    /** @var WorkspaceResolver $resolver */
-    $resolver = app(WorkspaceResolver::class);
-
-    $workspace = $resolver->resolve($value);
-
-    abort_unless($workspace instanceof Workspace, 404);
-
-    return $workspace;
-});
-
-Route::middleware(['web', 'auth', 'ensure-workspace-member'])
-    ->prefix('/admin/w/{workspace}')
-    ->group(function (): void {
-        Route::get('/', fn () => redirect('/admin/tenants'))
-            ->name('admin.workspace.home');
-
-        Route::get('/ping', fn () => response()->noContent())->name('admin.workspace.ping');
-
-        Route::get('/managed-tenants', fn () => redirect('/admin/tenants'))
-            ->name('admin.workspace.managed-tenants.index');
-
-        Route::get('/managed-tenants/onboarding', fn () => redirect('/admin/tenants/create'))
-            ->name('admin.workspace.managed-tenants.onboarding');
-    });
-
-if (app()->runningUnitTests()) {
-    Route::middleware(['web', 'auth', 'ensure-workspace-selected'])
-        ->get('/admin/_test/workspace-context', function (Request $request) {
-            $workspaceId = app(\App\Support\Workspaces\WorkspaceContext::class)->currentWorkspaceId($request);
-
-            return response()->json([
-                'workspace_id' => $workspaceId,
-            ]);
-        });
-}

specs/070-workspace-create-membership-fix/plan.md

@@ -1,15 +0,0 @@
-# Plan — 070 Workspace create: ensure creator membership
-
-## Tech
-- Laravel 12
-- Filament v5 + Livewire v4
-
-## Approach
-1. Hook into the Workspaces resource create page lifecycle (CreateRecord) to run post-create logic.
-2. Create (or ensure) a `workspace_memberships` row for the creator with role `owner`.
-3. Set the created workspace as the current workspace in `WorkspaceContext`.
-4. Add a Pest regression test that creates a workspace via the Filament create page and asserts membership exists.
-
-## Files
-- `app/Filament/Resources/Workspaces/Pages/CreateWorkspace.php`
-- `tests/Feature/Workspaces/CreateWorkspaceCreatesMembershipTest.php`

specs/070-workspace-create-membership-fix/spec.md

@@ -1,16 +0,0 @@
-# Spec — 070 Workspace create: ensure creator membership
-
-## Problem
-Creating a workspace via the Filament **Workspaces** Resource can create the `workspaces` row but not grant the creating user a `workspace_memberships` record. Since workspace listings are membership-scoped, the newly created workspace may not appear for the creator.
-
-## Goals
-- When a workspace is created via the Workspaces resource, the creating user becomes an `owner` member of that workspace.
-- The created workspace becomes the current workspace context for the user.
-
-## Non-goals
-- Changing workspace listing scoping rules.
-- Changing roles/permissions beyond assigning `owner` on creation.
-
-## Acceptance criteria
-- Creating a workspace via the Filament Workspaces resource results in a `workspace_memberships` row for the creating user.
-- A regression test covers the behavior.

specs/070-workspace-create-membership-fix/tasks.md

@@ -1,11 +0,0 @@
-# Tasks — 070 Workspace create: ensure creator membership
-
-## Core
-- [x] T020 Ensure creating via Workspaces resource grants creator a workspace membership.
-
-## Tests
-- [x] T010 Add regression test for workspace creation creating membership.
-
-## Validation
-- [x] T900 Run Pint on dirty files.
-- [x] T910 Run targeted Pest test(s).

specs/071-tenant-selection-workspace-scope/plan.md

@@ -1,14 +0,0 @@
-# Plan — 071 Workspace-scoped tenant selection
-
-## Tech
-- Laravel 12
-- Filament v5 + Livewire v4
-
-## Approach
-1. Update the Filament tenant provider on `User` (`getTenants()` and `getDefaultTenant()`) to optionally filter by the current workspace id from `WorkspaceContext`.
-2. Add a feature test asserting `/admin/choose-tenant` only shows tenants from the selected workspace.
-3. Run Pint and targeted tests.
-
-## Files
-- `app/Models/User.php`
-- `tests/Feature/Filament/ChooseTenantIsWorkspaceScopedTest.php`

specs/071-tenant-selection-workspace-scope/spec.md

@@ -1,18 +0,0 @@
-# Spec — 071 Workspace-scoped tenant selection
-
-## Problem
-Tenant selection and the Filament tenant menu were not scoped to the currently selected workspace. As a result, selecting a newly created workspace could still show tenants from a different workspace (e.g. “Entra ID (DEV)”), leading to confusing flows where tenant-scoped pages show empty lists.
-
-## Goals
-- Only show tenants belonging to the currently selected workspace in:
-  - `/admin/choose-tenant`
-  - Filament tenant menu dropdown
-- Keep behavior unchanged when no workspace is selected.
-
-## Non-goals
-- Auto-creating tenants when a workspace is created.
-- Changing authorization rules beyond filtering the selectable tenant list.
-
-## Acceptance criteria
-- With workspace A selected, a user who is a member of tenants in A and B only sees A’s tenants on `/admin/choose-tenant`.
-- Regression test covers the behavior.

specs/071-tenant-selection-workspace-scope/tasks.md

@@ -1,11 +0,0 @@
-# Tasks — 071 Workspace-scoped tenant selection
-
-## Core
-- [x] T020 Scope `User::getTenants()` and `User::getDefaultTenant()` to current workspace when selected.
-
-## Tests
-- [x] T010 Add regression test for workspace-scoped choose-tenant.
-
-## Validation
-- [x] T900 Run Pint on dirty files.
-- [x] T910 Run targeted Pest test(s).

specs/072-managed-tenants-workspace-enforcement/plan.md

@@ -1,32 +0,0 @@
-# Plan — 072 Managed Tenants workspace context enforcement
-
-## Tech
-- Laravel 12
-- Filament v5 + Livewire v4
-- Pest v4
-
-## Approach
-1. Treat `/admin/w/{workspace}/...` as the portfolio / workspace entry space.
-2. Move Managed Tenants list/onboarding UX to workspace-scoped routes.
-3. Make `/admin/managed-tenants/*` legacy-only (redirect to the correct workspace-scoped URL).
-4. Enforce workspace/tenant consistency for all `/admin/t/{tenant}` routes (deny-as-not-found on mismatch).
-
-## Key decisions
-- **Workspace is not Filament tenancy**; it remains session + middleware.
-- Hard enforcement is implemented in middleware that runs on tenant-scoped routes.
-- Prefer redirects over removing routes immediately, to avoid breaking deep links, but ensure they are no longer primary UX.
-
-## Files (expected)
-- `routes/web.php`
-- `app/Providers/Filament/AdminPanelProvider.php`
-- `app/Http/Middleware/EnsureWorkspaceSelected.php`
-- `app/Support/Middleware/DenyNonMemberTenantAccess.php` (or `EnsureFilamentTenantSelected.php`, depending on existing enforcement location)
-- `app/Filament/Pages/ManagedTenants/*` (legacy redirects / removal)
-- New/updated workspace landing page under `app/Filament/Pages/Workspaces/*` (or equivalent)
-- Pest tests in `tests/Feature/Routing/` or `tests/Feature/Filament/`
-
-## Test plan
-- Feature test: `/admin/managed-tenants` redirects to `/admin/w/{workspace}/managed-tenants` when workspace is selected.
-- Feature test: `/admin/t/{tenant}` returns 404 when workspace context missing.
-- Feature test: `/admin/t/{tenant}` returns 404 when tenant.workspace_id != current workspace.
-- Optional: workspace landing lists only workspace tenants.

specs/072-managed-tenants-workspace-enforcement/spec.md

@@ -1,34 +0,0 @@
-# Spec — 072 Managed Tenants workspace context enforcement
-
-## Problem
-Managed Tenant pages exist in an unscoped URL space (`/admin/managed-tenants/*`) while Managed Tenants are product-scoped to a Workspace (MSP portfolio). This makes workspace context feel optional and allows confusing / insecure navigation patterns where tenant context and workspace context can drift.
-
-## Mental model (source of truth)
-- **Managed Tenant** = the Entra/Intune tenant. All policy/backup/drift/inventory features are always scoped to a Managed Tenant.
-  - In code: Filament tenancy (`/admin/t/{tenant_external_id}/...`).
-- **Workspace** = portfolio container. Controls which Managed Tenants a user can see + portfolio-level settings.
-  - In code: session + `last_workspace_id` + middleware (not Filament tenancy).
-
-## Goals
-- Workspace becomes a real, enforced context for all tenant-scoped pages.
-- Keep Filament tenancy URL space unchanged: `/admin/t/{tenant_external_id}/...`.
-- Introduce / use a workspace-scoped landing space for portfolio UX: `/admin/w/{workspace}/...`.
-- Eliminate or redirect legacy unscoped Managed Tenants routes under `/admin/managed-tenants/*`.
-
-## Non-goals
-- Redesigning all navigation IA or introducing a second Filament panel.
-- Migrating existing tenant data beyond enforcing `tenants.workspace_id` consistency.
-
-## Hard rule (security / enterprise)
-When accessing `/admin/t/{tenant}` routes:
-- `current_workspace_id` must be set, and
-- `tenant.workspace_id == current_workspace_id`, and
-- user must be a member of the workspace (and/or tenant, per current auth model).
-Otherwise: **deny as not found** (404).
-
-## Acceptance criteria
-- `/admin/managed-tenants/*` does not act as a primary UX entry point anymore (redirects to workspace-scoped UX).
-- `/admin/w/{workspace}/managed-tenants` exists as the primary portfolio landing for Managed Tenants.
-- Tenant switcher only shows tenants from the current workspace.
-- Visiting `/admin/t/{tenant}` with missing or mismatched workspace context results in 404.
-- Pest tests cover redirects + workspace/tenant mismatch denial.

specs/072-managed-tenants-workspace-enforcement/tasks.md

@@ -1,20 +0,0 @@
-# Tasks — 072 Managed Tenants workspace context enforcement
-
-## Setup
-- [x] T001 Confirm legacy managed-tenants routes and current workspace middleware behavior.
-
-## Tests (TDD)
-- [x] T010 Add regression test: `/admin/managed-tenants` redirects to workspace landing when a workspace is selected.
-- [x] T020 Add regression test: `/admin/t/{tenant}` is 404 when workspace context is missing.
-- [x] T030 Add regression test: `/admin/t/{tenant}` is 404 when tenant.workspace_id mismatches current workspace.
-- [x] T040 Add regression test: `/admin/choose-tenant` redirects to `/admin/choose-workspace` when workspace is not selected.
-
-## Core
-- [x] T100 Create workspace-scoped Managed Tenants landing at `/admin/w/{workspace}/managed-tenants`.
-- [x] T110 Make unscoped `/admin/managed-tenants/*` legacy-only (redirect to workspace-scoped URLs).
-- [x] T120 Implement hard enforcement: tenant routes require workspace context and tenant.workspace_id match.
-- [x] T130 Ensure `/admin/choose-tenant` requires selected workspace.
-
-## Validation
-- [x] T900 Run Pint on dirty files.
-- [x] T910 Run targeted Pest tests.

tests/Feature/AdminNewRedirectTest.php

@@ -1,8 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-it('redirects /admin/new to /admin/login for guests', function (): void {
-    $this->get('/admin/new')
-        ->assertRedirect('/admin/login');
-});

tests/Feature/Filament/ChooseTenantIsWorkspaceScopedTest.php

@@ -1,69 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Models\Tenant;
-use App\Models\TenantMembership;
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use App\Support\Workspaces\WorkspaceContext;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-
-uses(RefreshDatabase::class);
-
-it('only shows tenants from the currently selected workspace on choose-tenant', function (): void {
-    $user = User::factory()->create();
-
-    $workspaceA = Workspace::factory()->create(['name' => 'Workspace A']);
-    $workspaceB = Workspace::factory()->create(['name' => 'Workspace B']);
-
-    $tenantA = Tenant::factory()->create([
-        'workspace_id' => $workspaceA->getKey(),
-        'name' => 'Tenant A',
-        'status' => 'active',
-    ]);
-
-    $tenantB = Tenant::factory()->create([
-        'workspace_id' => $workspaceB->getKey(),
-        'name' => 'Tenant B',
-        'status' => 'active',
-    ]);
-
-    WorkspaceMembership::factory()->create([
-        'workspace_id' => $workspaceA->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-    ]);
-
-    WorkspaceMembership::factory()->create([
-        'workspace_id' => $workspaceB->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-    ]);
-
-    TenantMembership::query()->create([
-        'tenant_id' => $tenantA->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-        'source' => 'manual',
-        'source_ref' => null,
-        'created_by_user_id' => null,
-    ]);
-
-    TenantMembership::query()->create([
-        'tenant_id' => $tenantB->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-        'source' => 'manual',
-        'source_ref' => null,
-        'created_by_user_id' => null,
-    ]);
-
-    $this->actingAs($user)
-        ->withSession([WorkspaceContext::SESSION_KEY => (int) $workspaceA->getKey()])
-        ->get('/admin/choose-tenant')
-        ->assertSuccessful()
-        ->assertSee('Tenant A')
-        ->assertDontSee('Tenant B');
-});

tests/Feature/Filament/ChooseTenantRequiresWorkspaceTest.php

@@ -1,35 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-
-uses(RefreshDatabase::class);
-
-it('redirects choose-tenant to choose-workspace when workspace is not selected', function (): void {
-    $user = User::factory()->create([
-        'last_workspace_id' => null,
-    ]);
-
-    $workspaceA = Workspace::factory()->create();
-    $workspaceB = Workspace::factory()->create();
-
-    WorkspaceMembership::factory()->create([
-        'workspace_id' => $workspaceA->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-    ]);
-
-    WorkspaceMembership::factory()->create([
-        'workspace_id' => $workspaceB->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-    ]);
-
-    $this->actingAs($user)
-        ->get('/admin/choose-tenant')
-        ->assertRedirect('/admin/choose-workspace');
-});

tests/Feature/Filament/TenantSwitcherUrlResolvesTenantTest.php

@@ -1,37 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Models\Tenant;
-use App\Models\Workspace;
-use Filament\Facades\Filament;
-
-it('switches tenant when visiting the tenant menu URL', function (): void {
-    $workspace = Workspace::factory()->create();
-
-    $tenantA = Tenant::factory()->create([
-        'workspace_id' => $workspace->getKey(),
-        'name' => 'Tenant A',
-        'status' => 'active',
-    ]);
-
-    $tenantB = Tenant::factory()->create([
-        'workspace_id' => $workspace->getKey(),
-        'name' => 'Tenant B',
-        'status' => 'active',
-    ]);
-
-    [$user] = createUserWithTenant($tenantA, role: 'owner');
-
-    createUserWithTenant($tenantB, user: $user, role: 'owner');
-
-    Filament::setTenant($tenantA, true);
-    expect(Filament::getTenant()?->is($tenantA))->toBeTrue();
-
-    $response = $this->actingAs($user)
-        ->get('/admin/t/'.$tenantB->external_id);
-
-    expect(in_array($response->getStatusCode(), [200, 302], true))->toBeTrue();
-    expect(Filament::getTenant())->toBeInstanceOf(Tenant::class);
-    expect(Filament::getTenant()?->is($tenantB))->toBeTrue();
-});

tests/Feature/ManagedTenants/AuthorizationSemanticsTest.php

@@ -1,38 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Models\Tenant;
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-
-it('returns 403 for a member without managed-tenant manage capability when accessing edit', function (): void {
-    $tenant = Tenant::factory()->create();
-    [$user] = createUserWithTenant($tenant, role: 'readonly');
-
-    $this->actingAs($user)
-        ->get("/admin/t/{$tenant->external_id}/tenants/{$tenant->id}/edit")
-        ->assertForbidden();
-});
-
-it('returns 404 for a non-member attempting to access a workspace managed-tenant list', function (): void {
-    $workspace = Workspace::factory()->create();
-    Tenant::factory()->create(['workspace_id' => $workspace->getKey()]);
-
-    $user = User::factory()->create();
-
-    $otherWorkspace = Workspace::factory()->create();
-
-    WorkspaceMembership::factory()->create([
-        'workspace_id' => $otherWorkspace->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'readonly',
-    ]);
-
-    $user->forceFill(['last_workspace_id' => $otherWorkspace->getKey()])->save();
-
-    $this->actingAs($user)
-        ->get('/admin/w/'.$workspace->slug.'/managed-tenants')
-        ->assertNotFound();
-});

tests/Feature/ManagedTenants/OnboardingRedirectTest.php

@@ -1,17 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Models\Tenant;
-
-it('redirects /admin/new to the canonical managed-tenant onboarding page', function (): void {
-    $tenant = Tenant::factory()->create();
-    [$user] = createUserWithTenant($tenant, role: 'owner');
-
-    $workspace = $tenant->workspace;
-    expect($workspace)->not->toBeNull();
-
-    $this->actingAs($user)
-        ->get('/admin/new')
-        ->assertRedirect('/admin/w/'.$workspace->slug.'/managed-tenants/onboarding');
-});

tests/Feature/Workspaces/ChooseWorkspaceRedirectsToChooseTenantTest.php

@@ -1,28 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\Pages\ChooseWorkspace;
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Livewire\Livewire;
-
-uses(RefreshDatabase::class);
-
-it('redirects to choose-tenant after selecting a workspace', function (): void {
-    $user = User::factory()->create();
-
-    $workspace = Workspace::factory()->create();
-    WorkspaceMembership::factory()->create([
-        'workspace_id' => $workspace->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-    ]);
-
-    Livewire::actingAs($user)
-        ->test(ChooseWorkspace::class)
-        ->call('selectWorkspace', $workspace->getKey())
-        ->assertRedirect('/admin/choose-tenant');
-});

tests/Feature/Workspaces/CreateWorkspaceCreatesMembershipTest.php

@@ -1,64 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\Resources\Workspaces\Pages\CreateWorkspace;
-use App\Models\Tenant;
-use App\Models\TenantMembership;
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use App\Support\Workspaces\WorkspaceContext;
-use Filament\Facades\Filament;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Livewire\Livewire;
-
-uses(RefreshDatabase::class);
-
-it('creates an owner membership when a workspace is created via the Workspaces resource', function () {
-    $user = User::factory()->create();
-
-    $existingWorkspace = Workspace::factory()->create();
-    WorkspaceMembership::factory()->create([
-        'workspace_id' => $existingWorkspace->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-    ]);
-
-    app(WorkspaceContext::class)->setCurrentWorkspace($existingWorkspace, $user);
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => $existingWorkspace->getKey(),
-        'status' => 'active',
-    ]);
-    TenantMembership::query()->create([
-        'tenant_id' => $tenant->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-        'source' => 'manual',
-        'source_ref' => null,
-        'created_by_user_id' => null,
-    ]);
-    Filament::setTenant($tenant, true);
-
-    Livewire::actingAs($user)
-        ->test(CreateWorkspace::class)
-        ->fillForm([
-            'name' => 'Acme Workspace',
-            'slug' => 'acme-workspace',
-        ])
-        ->call('create')
-        ->assertHasNoFormErrors();
-
-    $createdWorkspace = Workspace::query()
-        ->where('slug', 'acme-workspace')
-        ->first();
-
-    expect($createdWorkspace)->not->toBeNull();
-
-    $this->assertDatabaseHas('workspace_memberships', [
-        'workspace_id' => $createdWorkspace->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-    ]);
-});

tests/Feature/Workspaces/ManagedTenantsWorkspaceRoutingTest.php

@@ -1,93 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\Pages\TenantDashboard;
-use App\Models\Tenant;
-use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
-use App\Support\Workspaces\WorkspaceContext;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\Http;
-
-uses(RefreshDatabase::class);
-
-beforeEach(function (): void {
-    Http::preventStrayRequests();
-});
-
-it('redirects legacy managed-tenants entry to workspace landing when workspace is selected', function (): void {
-    $user = User::factory()->create();
-
-    $workspace = Workspace::factory()->create(['slug' => 'acme']);
-    WorkspaceMembership::factory()->create([
-        'workspace_id' => $workspace->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-    ]);
-
-    $this->actingAs($user)
-        ->withSession([WorkspaceContext::SESSION_KEY => (int) $workspace->getKey()])
-        ->get('/admin/managed-tenants')
-        ->assertRedirect("/admin/w/{$workspace->slug}/managed-tenants");
-});
-
-it('returns 404 on tenant routes when workspace context is missing', function (): void {
-    $user = User::factory()->create();
-
-    $workspace = Workspace::factory()->create();
-    WorkspaceMembership::factory()->create([
-        'workspace_id' => $workspace->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-    ]);
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => (int) $workspace->getKey(),
-        'external_id' => '11111111-1111-1111-1111-111111111111',
-        'tenant_id' => '11111111-1111-1111-1111-111111111111',
-    ]);
-
-    $user->tenants()->syncWithoutDetaching([
-        $tenant->getKey() => ['role' => 'owner'],
-    ]);
-
-    $this->actingAs($user)
-        ->get(TenantDashboard::getUrl(tenant: $tenant))
-        ->assertNotFound();
-});
-
-it('returns 404 on tenant routes when tenant workspace mismatches current workspace', function (): void {
-    $user = User::factory()->create();
-
-    $workspaceA = Workspace::factory()->create(['slug' => 'ws-a']);
-    $workspaceB = Workspace::factory()->create(['slug' => 'ws-b']);
-
-    WorkspaceMembership::factory()->create([
-        'workspace_id' => $workspaceA->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-    ]);
-
-    WorkspaceMembership::factory()->create([
-        'workspace_id' => $workspaceB->getKey(),
-        'user_id' => $user->getKey(),
-        'role' => 'owner',
-    ]);
-
-    $tenantInA = Tenant::factory()->create([
-        'workspace_id' => (int) $workspaceA->getKey(),
-        'external_id' => 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
-        'tenant_id' => 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
-    ]);
-
-    $user->tenants()->syncWithoutDetaching([
-        $tenantInA->getKey() => ['role' => 'owner'],
-    ]);
-
-    $this->actingAs($user)
-        ->withSession([WorkspaceContext::SESSION_KEY => (int) $workspaceB->getKey()])
-        ->get(TenantDashboard::getUrl(tenant: $tenantInA))
-        ->assertNotFound();
-});

tests/Pest.php

@@ -2,10 +2,7 @@
 
 use App\Models\Tenant;
 use App\Models\User;
-use App\Models\Workspace;
-use App\Models\WorkspaceMembership;
 use App\Services\Graph\GraphClientInterface;
-use App\Support\Workspaces\WorkspaceContext;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Tests\Support\AssertsNoOutboundHttp;
 use Tests\Support\FailHardGraphClient;
@@ -93,30 +90,6 @@ function createUserWithTenant(?Tenant $tenant = null, ?User $user = null, string
     $user ??= User::factory()->create();
     $tenant ??= Tenant::factory()->create();
 
-    $workspace = null;
-
-    if ($tenant->workspace_id !== null) {
-        $workspace = Workspace::query()->whereKey($tenant->workspace_id)->first();
-    }
-
-    if (! $workspace instanceof Workspace) {
-        $workspace = Workspace::factory()->create();
-
-        $tenant->forceFill([
-            'workspace_id' => (int) $workspace->getKey(),
-        ])->save();
-    }
-
-    WorkspaceMembership::query()->firstOrCreate([
-        'workspace_id' => (int) $workspace->getKey(),
-        'user_id' => (int) $user->getKey(),
-    ], [
-        'role' => 'owner',
-    ]);
-
-    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
-    $user->forceFill(['last_workspace_id' => (int) $workspace->getKey()])->save();
-
     $user->tenants()->syncWithoutDetaching([
         $tenant->getKey() => ['role' => $role],
     ]);