TenantAtlas/tests/Feature/Monitoring/OperationsTenantScopeTest.php

<?php

use App\Filament\Pages\Monitoring\Operations;
use App\Models\OperationRun;
use App\Models\Tenant;
use App\Support\Workspaces\WorkspaceContext;
use Filament\Facades\Filament;
use Illuminate\Support\Facades\Http;
use Livewire\Livewire;

beforeEach(function (): void {
    Http::preventStrayRequests();
});

it('defaults Monitoring → Operations list to the active tenant when tenant context is set', function () {
    $tenantA = Tenant::factory()->create();
    $tenantB = Tenant::factory()->create();

    [$user] = createUserWithTenant($tenantA, role: 'owner');

    $tenantB->forceFill(['workspace_id' => (int) $tenantA->workspace_id])->save();

    $user->tenants()->syncWithoutDetaching([
        $tenantB->getKey() => ['role' => 'owner'],
    ]);

    $runA = OperationRun::factory()->create([
        'tenant_id' => $tenantA->getKey(),
        'type' => 'policy.sync',
        'status' => 'queued',
        'outcome' => 'pending',
        'initiator_name' => 'TenantA',
    ]);

    $runB = OperationRun::factory()->create([
        'tenant_id' => $tenantB->getKey(),
        'type' => 'inventory_sync',
        'status' => 'queued',
        'outcome' => 'pending',
        'initiator_name' => 'TenantB',
    ]);

    Filament::setTenant($tenantA, true);

    $this->withSession([WorkspaceContext::SESSION_KEY => (int) $tenantA->workspace_id]);
    session([WorkspaceContext::SESSION_KEY => (int) $tenantA->workspace_id]);

    Livewire::actingAs($user)
        ->test(Operations::class)
        ->assertCanSeeTableRecords([$runA])
        ->assertCanNotSeeTableRecords([$runB])
        ->assertSet('tableFilters.tenant_id.value', (string) $tenantA->getKey());

    $this->actingAs($user)
        ->withSession([WorkspaceContext::SESSION_KEY => (int) $tenantA->workspace_id])
        ->get('/admin/operations')
        ->assertOk()
        ->assertSee('Policy sync')
        ->assertSee('Tenant scope: '.$tenantA->name);
});

it('defaults Monitoring → Operations list to the remembered tenant when Filament tenant is not available', function () {
    $tenantA = Tenant::factory()->create();
    $tenantB = Tenant::factory()->create();

    [$user] = createUserWithTenant($tenantA, role: 'owner');

    $tenantB->forceFill(['workspace_id' => (int) $tenantA->workspace_id])->save();

    $user->tenants()->syncWithoutDetaching([
        $tenantB->getKey() => ['role' => 'owner'],
    ]);

    $runA = OperationRun::factory()->create([
        'tenant_id' => $tenantA->getKey(),
        'type' => 'policy.sync',
        'status' => 'queued',
        'outcome' => 'pending',
        'initiator_name' => 'TenantA',
    ]);

    $runB = OperationRun::factory()->create([
        'tenant_id' => $tenantB->getKey(),
        'type' => 'inventory_sync',
        'status' => 'queued',
        'outcome' => 'pending',
        'initiator_name' => 'TenantB',
    ]);

    Filament::setTenant(null, true);

    $workspaceId = (int) $tenantA->workspace_id;
    app(WorkspaceContext::class)->rememberLastTenantId($workspaceId, (int) $tenantA->getKey());

    $this->withSession([WorkspaceContext::SESSION_KEY => $workspaceId]);
    session([WorkspaceContext::SESSION_KEY => $workspaceId]);

    Livewire::actingAs($user)
        ->test(Operations::class)
        ->assertCanSeeTableRecords([$runA])
        ->assertCanNotSeeTableRecords([$runB])
        ->assertSet('tableFilters.tenant_id.value', (string) $tenantA->getKey());

    $this->actingAs($user)
        ->withSession([WorkspaceContext::SESSION_KEY => $workspaceId])
        ->get('/admin/operations')
        ->assertOk()
        ->assertSee('Tenant scope: '.$tenantA->name)
        ->assertSee('Policy sync');
});

it('scopes Monitoring → Operations tabs to the active tenant', function () {
    $tenantA = Tenant::factory()->create();
    $tenantB = Tenant::factory()->create();

    [$user] = createUserWithTenant($tenantA, role: 'owner');

    $tenantB->forceFill(['workspace_id' => (int) $tenantA->workspace_id])->save();

    $user->tenants()->syncWithoutDetaching([
        $tenantB->getKey() => ['role' => 'owner'],
    ]);

    $runActiveA = OperationRun::factory()->create([
        'tenant_id' => $tenantA->getKey(),
        'type' => 'policy.sync',
        'status' => 'queued',
        'outcome' => 'pending',
        'initiator_name' => 'A-active',
    ]);

    $runSucceededA = OperationRun::factory()->create([
        'tenant_id' => $tenantA->getKey(),
        'type' => 'policy.sync',
        'status' => 'completed',
        'outcome' => 'succeeded',
        'initiator_name' => 'A-succeeded',
    ]);

    $runPartialA = OperationRun::factory()->create([
        'tenant_id' => $tenantA->getKey(),
        'type' => 'policy.sync',
        'status' => 'completed',
        'outcome' => 'partially_succeeded',
        'initiator_name' => 'A-partial',
    ]);

    $runFailedA = OperationRun::factory()->create([
        'tenant_id' => $tenantA->getKey(),
        'type' => 'policy.sync',
        'status' => 'completed',
        'outcome' => 'failed',
        'initiator_name' => 'A-failed',
    ]);

    $runActiveB = OperationRun::factory()->create([
        'tenant_id' => $tenantB->getKey(),
        'type' => 'inventory_sync',
        'status' => 'queued',
        'outcome' => 'pending',
        'initiator_name' => 'B-active',
    ]);

    $runFailedB = OperationRun::factory()->create([
        'tenant_id' => $tenantB->getKey(),
        'type' => 'inventory_sync',
        'status' => 'completed',
        'outcome' => 'failed',
        'initiator_name' => 'B-failed',
    ]);

    $tenantA->makeCurrent();
    Filament::setTenant($tenantA, true);

    $this->withSession([
        WorkspaceContext::SESSION_KEY => (int) $tenantA->workspace_id,
    ]);
    session([
        WorkspaceContext::SESSION_KEY => (int) $tenantA->workspace_id,
    ]);

    Livewire::actingAs($user)
        ->test(Operations::class)
        ->assertCanSeeTableRecords([$runActiveA, $runSucceededA, $runPartialA, $runFailedA])
        ->assertCanNotSeeTableRecords([$runActiveB, $runFailedB])
        ->set('activeTab', 'active')
        ->assertCanSeeTableRecords([$runActiveA])
        ->assertCanNotSeeTableRecords([$runSucceededA, $runPartialA, $runFailedA, $runActiveB, $runFailedB])
        ->set('activeTab', 'succeeded')
        ->assertCanSeeTableRecords([$runSucceededA])
        ->assertCanNotSeeTableRecords([$runActiveA, $runPartialA, $runFailedA, $runActiveB, $runFailedB])
        ->set('activeTab', 'partial')
        ->assertCanSeeTableRecords([$runPartialA])
        ->assertCanNotSeeTableRecords([$runActiveA, $runSucceededA, $runFailedA, $runActiveB, $runFailedB])
        ->set('activeTab', 'failed')
        ->assertCanSeeTableRecords([$runFailedA])
        ->assertCanNotSeeTableRecords([$runActiveA, $runSucceededA, $runPartialA, $runActiveB, $runFailedB]);
});

it('prevents cross-workspace access to Monitoring → Operations detail', function () {
    $tenantA = Tenant::factory()->create();
    [$user, $tenantA] = createUserWithTenant($tenantA, role: 'owner');

    $tenantB = Tenant::factory()->create();

    $runB = OperationRun::factory()->create([
        'tenant_id' => $tenantB->getKey(),
        'type' => 'inventory_sync',
        'status' => 'queued',
        'outcome' => 'pending',
        'initiator_name' => 'TenantB',
    ]);

    $this->actingAs($user)
        ->withSession([WorkspaceContext::SESSION_KEY => (int) $tenantA->workspace_id])
        ->get(route('admin.operations.view', ['run' => (int) $runB->getKey()]))
        ->assertNotFound();
});