ahmido
be314c577f
## Summary - rebuild the public Tenantial homepage around an evidence-first Microsoft tenant governance narrative - replace the old hero visual with a new static dashboard preview and add dedicated Trust Bar and Feature Pillars sections - update the shared public shell, navigation, footer, dark design tokens, assets, and homepage content to match the new brand direction - align website smoke coverage and Spec 400 artifacts with the rebuilt homepage ## Testing - not run in this pass - updated website smoke specs under apps/website/tests/smoke ## Note - `website-dev` was pushed to `origin` so the requested PR base exists remotely - the remote `website-dev` branch is an ancestor of `origin/dev`, so this PR may also show upstream `dev` history relative to that base Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #387
51 lines
3.6 KiB
Markdown
51 lines
3.6 KiB
Markdown
# Canonical Tenant Context Resolution
|
|
|
|
> **Status:** Historical
|
|
> **Last reviewed:** 2026-04-30
|
|
> **Use for:** Historical context for the canonical tenant resolution rule and exception model
|
|
> **Do not use for:** Current path truth or current panel behavior without repo verification
|
|
|
|
## Canonical Rule
|
|
|
|
- Tenant-panel and tenant-scoped flows keep panel-native tenant semantics through `Filament::getTenant()` / `Tenant::current()`.
|
|
- Workspace-admin and monitoring flows under `/admin/...` resolve the active tenant only through `App\Support\OperateHub\OperateHubShell::activeEntitledTenant(Request)`.
|
|
- When both admin sources exist and disagree, the entitled Filament tenant wins for the full request and remembered workspace tenant state remains fallback-only.
|
|
- Tenant-owned Entra groups remain tenant-panel-primary navigation. The admin-panel route may stay available for direct links or global search, but it must not appear as a regular workspace-admin sidebar entry.
|
|
|
|
## Explicit No-Context Outcomes
|
|
|
|
| Surface | No-context outcome |
|
|
| --- | --- |
|
|
| `/admin/operations` | Render the workspace-scoped `All tenants` state, clear tenant-default filters, and hide tenant-only KPI cards. |
|
|
| `/admin/operations/{run}` | Render only when workspace membership and run-tenant entitlement still pass; otherwise return `404`. |
|
|
| Admin Entra group list and view | Return `404` instead of widening scope. |
|
|
| Admin Entra group global search | Return no tenant-owned results. |
|
|
|
|
## Approved Exceptions
|
|
|
|
- `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/ChooseTenant.php`
|
|
Tenant chooser remains panel-native because it is the explicit tenant-selection surface.
|
|
- `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Http/Controllers/SelectTenantController.php`
|
|
Explicit tenant selection persists remembered tenant state after a user choice.
|
|
- `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Support/Middleware/EnsureFilamentTenantSelected.php`
|
|
Middleware is allowed to read and set `Filament::getTenant()` because it owns panel bootstrapping and route/query synchronization.
|
|
- `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/EntraGroupResource.php`
|
|
Mixed-surface resource keeps one tenant-panel-native branch through `Tenant::current()` while admin panel logic delegates to `OperateHubShell`.
|
|
|
|
## Residual Inventory
|
|
|
|
- Compliant admin call sites:
|
|
`/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/Monitoring/Operations.php`
|
|
`/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Widgets/Operations/OperationsKpiHeader.php`
|
|
`/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/Operations/TenantlessOperationRunViewer.php`
|
|
`/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/OperationRunResource.php`
|
|
`/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/AlertDeliveryResource.php`
|
|
`/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/Monitoring/AuditLog.php`
|
|
`/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/EntraGroupResource.php`
|
|
- Tenant-panel-native call sites intentionally outside the admin guard:
|
|
`/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/InventoryCoverage.php`
|
|
`/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/BaselineCompareLanding.php`
|
|
tenant-owned resources under `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/` that are routed only through tenant context.
|
|
- Deferred admin remediation:
|
|
none in the Spec 135 operations, OperationRun, alert-delivery reference, or Entra-group admin surfaces after this iteration.
|