ahmido
eceeee9c5c
## Summary - retire the remaining tenant-scoped provider-connection legacy routes and update canonical verification and link behavior - complete the provider target-scope fallback cleanup so neutral shared scope data falls back to the managed environment when the raw connection tenant identifier is blank - stop mirroring workspace roles into managed-environment scope persistence and cut the targeted admin-panel test helpers over to the post-cutover context path - add and update the Spec 287 artifact package and targeted regression coverage for route retirement, provider-core neutralization, workspace-first RBAC, and helper cutover ## Validation - `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/ProviderConnections/LegacyRedirectTest.php tests/Feature/ProviderConnections/TenantlessListRouteTest.php tests/Feature/ProviderConnections/TenantlessListScopingTest.php tests/Feature/Auth/WorkspaceFirstManagedEnvironmentAccessTest.php tests/Feature/Rbac/ProviderConnectionWorkspaceFirstPolicyTest.php tests/Feature/Reviews/CustomerReviewWorkspaceLaunchLinksTest.php tests/Feature/Rbac/TriageReviewStateAuthorizationTest.php` - `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Browser/Spec281ProviderConnectionScopeSmokeTest.php tests/Browser/Spec285WorkspaceRbacEnvironmentAccessSmokeTest.php` - `cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent` ## Notes - Filament remains on Livewire v4 and provider registration stays unchanged in `apps/platform/bootstrap/providers.php`. - No new asset registration or deployment-step changes are included in this slice. Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #346
68 lines
4.3 KiB
Markdown
68 lines
4.3 KiB
Markdown
# Research: Cutover Prerequisite Completion
|
|
|
|
## Decision 1: Spec `287` now completes prerequisites; Spec `288` owns enforcement
|
|
|
|
- Use this package to finish the remaining runtime and test-harness seams that still block quality-gates / no-legacy enforcement.
|
|
- Do not add a guard suite, a full-suite baseline, or global quality gates here.
|
|
- Keep the follow-up boundary explicit: Spec `288` starts after this runtime baseline exists.
|
|
|
|
## Decision 2: Retire the provider-connection legacy route family instead of guarding it
|
|
|
|
- The provider-connection legacy alias family in `apps/platform/routes/web.php` is a runtime seam, not an enforcement-only concern.
|
|
- Remove it in this slice so later enforcement can guard the completed route truth instead of compensating for it.
|
|
|
|
## Decision 3: Finish provider target-scope core neutralization on shared seams only
|
|
|
|
- Neutralize the shared provider-core contract where repo truth still depends on Microsoft-shaped identity or target-scope fields.
|
|
- Keep Microsoft-specific tenant/profile, consent, and support detail nested under provider-owned seams only.
|
|
- Do not add a new provider profile table, registry, or framework.
|
|
|
|
## Decision 4: Complete workspace-first access persistence instead of layering more RBAC logic
|
|
|
|
- Treat workspace membership as the only role-bearing truth.
|
|
- Finish the cleanup that keeps managed-environment scope narrowing-only.
|
|
- Do not introduce a second role system, a compatibility shim, or a new role family.
|
|
|
|
## Decision 5: Replace tenant-panel-era test helpers with post-cutover admin or workspace helpers
|
|
|
|
- `apps/platform/tests/Pest.php` still carries tenant-panel-era setup such as `setTenantPanelContext()` and related legacy profile alias helpers.
|
|
- Replace the retired panel assumption on the shared helper path and the in-slice direct consumers `tests/Feature/Reviews/CustomerReviewWorkspaceLaunchLinksTest.php` plus `tests/Feature/Rbac/TriageReviewStateAuthorizationTest.php`.
|
|
- Do not turn this into a broad test-suite rewrite; keep it to the helpers and direct consumers needed by this slice.
|
|
|
|
## Decision 6: Validation must stay targeted
|
|
|
|
- Use focused feature tests and targeted browser validation for the changed seams only.
|
|
- Do not add a global guard family, broad source-scan package, or full-suite baseline under this spec.
|
|
|
|
## Rejected Alternatives
|
|
|
|
### Rejected: keep `287` as a blocked no-legacy guard package
|
|
|
|
That would force the later enforcement slice to compete with unfinished runtime work and would keep the package blocked for the wrong reason.
|
|
|
|
### Rejected: solve the route and helper drift with compatibility aliases
|
|
|
|
That would preserve the same ambiguity that Spec `288` is supposed to eliminate.
|
|
|
|
### Rejected: introduce a new provider profile or access-scope framework
|
|
|
|
The existing seams are already sufficient; they need completion, not a second architectural layer.
|
|
|
|
### Rejected: use a full-suite baseline as the proof requirement
|
|
|
|
The slice is bounded and should prove only the changed seams.
|
|
|
|
## Evidence Anchors
|
|
|
|
- `apps/platform/routes/web.php` still contains `/admin/tenants/{tenant:slug}/provider-connections` redirect routes.
|
|
- `apps/platform/app/Support/Providers/TargetScope/ProviderConnectionTargetScopeNormalizer.php` and related provider-core seams still participate in the shared target-scope contract that this slice completes.
|
|
- `apps/platform/app/Services/Auth/TenantMembershipManager.php` still persists managed-environment membership records with copied workspace role values.
|
|
- `apps/platform/tests/Pest.php` still contains `setTenantPanelContext()` and `createUserWithTenantLegacyProfileAliases()`.
|
|
- The in-slice direct consumer tests `tests/Feature/Reviews/CustomerReviewWorkspaceLaunchLinksTest.php` and `tests/Feature/Rbac/TriageReviewStateAuthorizationTest.php` still depend on the retired tenant-panel helper path.
|
|
|
|
## Implementation Boundary Summary
|
|
|
|
- The package is implementation-ready as a bounded prerequisite-completion slice.
|
|
- It is no longer a blocked-by-prerequisites guard package.
|
|
- If implementation starts adding guard suites, full-suite baselines, or adjacent feature work, stop and split that work out of `287`.
|
|
- The canonical executable command set lives only in `spec.md`, `plan.md`, `tasks.md`, and `quickstart.md`; this artifact intentionally references that command authority without restating a second command set. |