app_client_id\b/', '/->app_client_secret\b/', ]; $hits = []; foreach ($files as $relativePath) { $absolutePath = $root.'/'.$relativePath; if (! is_file($absolutePath)) { continue; } $contents = file_get_contents($absolutePath); if (! is_string($contents) || $contents === '') { continue; } if ($relativePath === 'app/Filament/Resources/TenantResource.php') { preg_match('/public static function adminConsentUrl\(Tenant \$tenant\): \?string\s*\{(?P.*?)^ \}/ms', $contents, $matches); $contents = is_string($matches['body'] ?? null) ? (string) $matches['body'] : ''; } $lines = preg_split('/\R/', $contents) ?: []; foreach ($patterns as $pattern) { foreach ($lines as $index => $line) { if (preg_match($pattern, $line) === 1) { $hits[] = $relativePath.':'.($index + 1).' -> '.trim($line); } } } } expect($hits)->toBeEmpty("Legacy tenant credential reads detected in platform builders:\n".implode("\n", $hits)); }); it('prevents platform consent and runtime builders from reading provider credential payloads directly', function (): void { $root = base_path(); $files = [ 'app/Filament/Resources/TenantResource.php', 'app/Support/Links/RequiredPermissionsLinks.php', 'app/Services/Providers/AdminConsentUrlFactory.php', 'app/Services/Providers/ProviderConnectionResolver.php', 'app/Services/Providers/ProviderGateway.php', 'app/Services/Providers/MicrosoftGraphOptionsResolver.php', ]; $patterns = [ '/->credential\b/', '/->payload\b/', ]; $hits = []; foreach ($files as $relativePath) { $absolutePath = $root.'/'.$relativePath; if (! is_file($absolutePath)) { continue; } $contents = file_get_contents($absolutePath); if (! is_string($contents) || $contents === '') { continue; } if ($relativePath === 'app/Filament/Resources/TenantResource.php') { preg_match('/public static function adminConsentUrl\(Tenant \$tenant\): \?string\s*\{(?P.*?)^ \}/ms', $contents, $matches); $contents = is_string($matches['body'] ?? null) ? (string) $matches['body'] : ''; } $lines = preg_split('/\R/', $contents) ?: []; foreach ($patterns as $pattern) { foreach ($lines as $index => $line) { if (preg_match($pattern, $line) === 1) { $hits[] = $relativePath.':'.($index + 1).' -> '.trim($line); } } } } expect($hits)->toBeEmpty("Provider credential payload fallback detected in platform builders:\n".implode("\n", $hits)); });