TenantAtlas/apps/platform/tests/Feature/Workspaces/ManagedTenantsWorkspaceRoutingTest.php

<?php

declare(strict_types=1);

use App\Filament\Pages\TenantDashboard;
use App\Models\ManagedEnvironment;
use App\Models\User;
use App\Models\Workspace;
use App\Models\WorkspaceMembership;
use App\Support\Workspaces\WorkspaceContext;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Http;

uses(RefreshDatabase::class);

beforeEach(function (): void {
    Http::preventStrayRequests();
});

it('returns 404 for legacy managed-tenants entry even when workspace is selected', function (): void {
    $user = User::factory()->create();

    $workspace = Workspace::factory()->create(['slug' => 'acme']);
    WorkspaceMembership::factory()->create([
        'workspace_id' => $workspace->getKey(),
        'user_id' => $user->getKey(),
        'role' => 'owner',
    ]);

    $this->actingAs($user)
        ->withSession([WorkspaceContext::SESSION_KEY => (int) $workspace->getKey()])
        ->get('/admin/managed-tenants')
        ->assertNotFound();
});

it('keeps the managed-tenants landing tenantless even if the user has a tenant in another workspace', function (): void {
    $user = User::factory()->create();

    $workspaceEmpty = Workspace::factory()->create(['slug' => 'empty']);
    $workspaceOther = Workspace::factory()->create(['slug' => 'other']);

    WorkspaceMembership::factory()->create([
        'workspace_id' => $workspaceEmpty->getKey(),
        'user_id' => $user->getKey(),
        'role' => 'owner',
    ]);

    WorkspaceMembership::factory()->create([
        'workspace_id' => $workspaceOther->getKey(),
        'user_id' => $user->getKey(),
        'role' => 'owner',
    ]);

    $tenantInOther = ManagedEnvironment::factory()->create([
        'status' => 'active',
        'workspace_id' => (int) $workspaceOther->getKey(),
        'external_id' => 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb',
        'managed_environment_id' => 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb',
    ]);

    $tenantInOther->makeCurrent();

    $user->tenants()->syncWithoutDetaching([
        $tenantInOther->getKey() => ['role' => 'owner'],
    ]);

    $this->actingAs($user)
        ->withSession([WorkspaceContext::SESSION_KEY => (int) $workspaceEmpty->getKey()])
        ->get('/admin/w/'.$workspaceEmpty->slug.'/managed-tenants')
        ->assertSuccessful()
        ->assertDontSee('/admin/t/'.$tenantInOther->external_id, false);
});

it('uses the routed tenant workspace on tenant routes when workspace context is missing', function (): void {
    $user = User::factory()->create();

    $workspace = Workspace::factory()->create();
    WorkspaceMembership::factory()->create([
        'workspace_id' => $workspace->getKey(),
        'user_id' => $user->getKey(),
        'role' => 'owner',
    ]);

    $tenant = ManagedEnvironment::factory()->create([
        'workspace_id' => (int) $workspace->getKey(),
        'external_id' => '11111111-1111-1111-1111-111111111111',
        'managed_environment_id' => '11111111-1111-1111-1111-111111111111',
    ]);

    $user->tenants()->syncWithoutDetaching([
        $tenant->getKey() => ['role' => 'owner'],
    ]);

    $this->actingAs($user)
        ->get(TenantDashboard::getUrl(tenant: $tenant))
        ->assertSuccessful();
});

it('returns 404 on tenant routes when tenant workspace mismatches current workspace', function (): void {
    $user = User::factory()->create();

    $workspaceA = Workspace::factory()->create(['slug' => 'ws-a']);
    $workspaceB = Workspace::factory()->create(['slug' => 'ws-b']);

    WorkspaceMembership::factory()->create([
        'workspace_id' => $workspaceA->getKey(),
        'user_id' => $user->getKey(),
        'role' => 'owner',
    ]);

    WorkspaceMembership::factory()->create([
        'workspace_id' => $workspaceB->getKey(),
        'user_id' => $user->getKey(),
        'role' => 'owner',
    ]);

    $tenantInA = ManagedEnvironment::factory()->create([
        'workspace_id' => (int) $workspaceA->getKey(),
        'external_id' => 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
        'managed_environment_id' => 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
    ]);

    $user->tenants()->syncWithoutDetaching([
        $tenantInA->getKey() => ['role' => 'owner'],
    ]);

    $this->actingAs($user)
        ->withSession([WorkspaceContext::SESSION_KEY => (int) $workspaceB->getKey()])
        ->get(TenantDashboard::getUrl(tenant: $tenantInA))
        ->assertNotFound();
});