ahmido
1acbf8cc54
## Summary - remove tenant-based Graph options access from runtime service paths and enforce provider-only resolution - add `MicrosoftGraphOptionsResolver` and `ProviderConfigurationRequiredException` for centralized, actionable provider-config errors - turn `Tenant::graphOptions()` into a fail-fast kill switch to prevent legacy runtime usage - add and update tests (including guardrail) to enforce no reintroduction in `app/` - update Spec 088 artifacts (`spec`, `plan`, `research`, `tasks`, checklist) ## Validation - `vendor/bin/sail bin pint --dirty` - `vendor/bin/sail artisan test --compact --filter=NoLegacyTenantGraphOptions` - `vendor/bin/sail artisan test --compact tests/Feature/Filament` - `CI=1 vendor/bin/sail artisan test --compact` ## Notes - Branch includes the guardrail test for legacy callsite detection in `app/`. - Full suite currently green: 1227 passed, 5 skipped. Co-authored-by: Ahmed Darrazi <ahmeddarrazi@MacBookPro.fritz.box> Reviewed-on: #105
86 lines
2.9 KiB
PHP
86 lines
2.9 KiB
PHP
<?php
|
|
|
|
use App\Models\ProviderConnection;
|
|
use App\Models\ProviderCredential;
|
|
use App\Models\Tenant;
|
|
use App\Services\Providers\MicrosoftGraphOptionsResolver;
|
|
use App\Services\Providers\ProviderConfigurationRequiredException;
|
|
use App\Support\Providers\ProviderReasonCodes;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
it('throws when no default provider connection exists', function (): void {
|
|
$tenant = Tenant::factory()->create();
|
|
|
|
$resolver = app(MicrosoftGraphOptionsResolver::class);
|
|
|
|
$call = fn (): array => $resolver->resolveForTenant($tenant);
|
|
|
|
expect($call)->toThrow(ProviderConfigurationRequiredException::class);
|
|
|
|
try {
|
|
$call();
|
|
} catch (ProviderConfigurationRequiredException $exception) {
|
|
expect($exception->reasonCode)->toBe(ProviderReasonCodes::ProviderConnectionMissing);
|
|
expect($exception->provider)->toBe('microsoft');
|
|
expect($exception->tenantId)->toBe((int) $tenant->getKey());
|
|
}
|
|
});
|
|
|
|
it('throws when default provider connection needs consent', function (): void {
|
|
$tenant = Tenant::factory()->create();
|
|
|
|
ProviderConnection::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'workspace_id' => $tenant->workspace_id,
|
|
'provider' => 'microsoft',
|
|
'is_default' => true,
|
|
'status' => 'needs_consent',
|
|
]);
|
|
|
|
$resolver = app(MicrosoftGraphOptionsResolver::class);
|
|
|
|
$call = fn (): array => $resolver->resolveForTenant($tenant);
|
|
|
|
expect($call)->toThrow(ProviderConfigurationRequiredException::class);
|
|
|
|
try {
|
|
$call();
|
|
} catch (ProviderConfigurationRequiredException $exception) {
|
|
expect($exception->reasonCode)->toBe(ProviderReasonCodes::ProviderConsentMissing);
|
|
}
|
|
});
|
|
|
|
it('builds graph options from default provider connection credentials', function (): void {
|
|
$tenant = Tenant::factory()->create();
|
|
|
|
$connection = ProviderConnection::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'workspace_id' => $tenant->workspace_id,
|
|
'provider' => 'microsoft',
|
|
'entra_tenant_id' => 'entra-tenant-id',
|
|
'is_default' => true,
|
|
'status' => 'connected',
|
|
]);
|
|
|
|
ProviderCredential::factory()->create([
|
|
'provider_connection_id' => $connection->getKey(),
|
|
'type' => 'client_secret',
|
|
'payload' => [
|
|
'client_id' => 'client-id',
|
|
'client_secret' => 'client-secret',
|
|
],
|
|
]);
|
|
|
|
$resolver = app(MicrosoftGraphOptionsResolver::class);
|
|
|
|
$options = $resolver->resolveForTenant($tenant, ['query' => ['a' => 'b']]);
|
|
|
|
expect($options['tenant'])->toBe('entra-tenant-id');
|
|
expect($options['client_id'])->toBe('client-id');
|
|
expect($options['client_secret'])->toBe('client-secret');
|
|
expect($options['client_request_id'])->toBeString()->not->toBeEmpty();
|
|
expect($options['query'])->toBe(['a' => 'b']);
|
|
});
|