ahmido
73a879d061
## Summary
- implement Spec 147 for workspace-first tenant selector and remembered tenant context enforcement
- harden canonical and tenant-bound route behavior so selected tenant mismatch stays informational
- fix drift finding subject fallback for workspace-safe RBAC identifiers and centralize finding subject resolution
## Testing
- vendor/bin/sail artisan test --compact tests/Feature/Filament/FindingViewRbacEvidenceTest.php tests/Feature/Findings/FindingsListDefaultsTest.php
- vendor/bin/sail bin pint --dirty --format agent
## Notes
- branch pushed at de0679cd8b
- includes the spec artifacts under specs/147-tenant-selector-remembered-context-enforcement/
Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #176
84 lines
2.3 KiB
PHP
84 lines
2.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Models\User;
|
|
use App\Models\Workspace;
|
|
use App\Services\Audit\WorkspaceAuditLogger;
|
|
use App\Support\Audit\AuditActionId;
|
|
use App\Support\Workspaces\WorkspaceContext;
|
|
use App\Support\Workspaces\WorkspaceIntendedUrl;
|
|
use App\Support\Workspaces\WorkspaceRedirectResolver;
|
|
use Filament\Facades\Filament;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Http\Request;
|
|
|
|
final class SwitchWorkspaceController
|
|
{
|
|
public function __invoke(Request $request): RedirectResponse
|
|
{
|
|
$user = auth()->user();
|
|
|
|
if (! $user instanceof User) {
|
|
abort(403);
|
|
}
|
|
|
|
$validated = $request->validate([
|
|
'workspace_id' => ['required', 'integer'],
|
|
]);
|
|
|
|
$workspace = Workspace::query()->whereKey($validated['workspace_id'])->first();
|
|
|
|
if (! $workspace instanceof Workspace) {
|
|
abort(404);
|
|
}
|
|
|
|
if (! empty($workspace->archived_at)) {
|
|
abort(404);
|
|
}
|
|
|
|
$context = app(WorkspaceContext::class);
|
|
|
|
if (! $context->isMember($user, $workspace)) {
|
|
abort(404);
|
|
}
|
|
|
|
$prevWorkspaceId = $context->currentWorkspaceId($request);
|
|
|
|
$context->setCurrentWorkspace($workspace, $user, $request);
|
|
$context->rememberedTenant($request);
|
|
Filament::setTenant(null, true);
|
|
|
|
/** @var WorkspaceAuditLogger $auditLogger */
|
|
$auditLogger = app(WorkspaceAuditLogger::class);
|
|
|
|
$auditLogger->log(
|
|
workspace: $workspace,
|
|
action: AuditActionId::WorkspaceSelected->value,
|
|
context: [
|
|
'metadata' => [
|
|
'method' => 'manual',
|
|
'reason' => 'context_bar',
|
|
'prev_workspace_id' => $prevWorkspaceId,
|
|
],
|
|
],
|
|
actor: $user,
|
|
resourceType: 'workspace',
|
|
resourceId: (string) $workspace->getKey(),
|
|
);
|
|
|
|
$intendedUrl = WorkspaceIntendedUrl::consume($request);
|
|
|
|
if ($intendedUrl !== null) {
|
|
return redirect()->to($intendedUrl);
|
|
}
|
|
|
|
/** @var WorkspaceRedirectResolver $resolver */
|
|
$resolver = app(WorkspaceRedirectResolver::class);
|
|
|
|
return redirect()->to($resolver->resolve($workspace, $user));
|
|
}
|
|
}
|