ahmido
023274c46c
## Summary - normalize provider-neutral target-scope and identity contracts across provider connection resolution, operation-start gating, verification reporting, and boundary configuration - align provider connection resource, onboarding, tenant summaries, and operation follow-up on the same shared scope contract while keeping Microsoft-specific profile details in provider-owned metadata - add Spec 281 artifacts and focused feature/browser coverage for the new provider-scope contract - move the tenant dashboard context-chip rail into Filament header widgets so the metadata row renders directly under the page subtitle ## Validation - `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/Providers/ProviderConnectionTargetScopeNeutralityTest.php tests/Feature/Providers/ProviderIdentityResolutionNeutralityTest.php tests/Feature/Providers/ProviderOperationStartGateTargetScopeContextTest.php tests/Feature/Filament/ProviderConnectionResourceScopeSummaryTest.php tests/Feature/Onboarding/ManagedTenantOnboardingProviderConnectionScopeTest.php tests/Feature/Guards/ProviderConnectionMicrosoftScopeLeakGuardTest.php` - `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Browser/Spec281ProviderConnectionScopeSmokeTest.php` - `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/Dashboard/TenantDashboardProductizationSummaryTest.php` - `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Browser/Dashboard/TenantDashboardProductizationSmokeTest.php` - `cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent` ## Notes - Filament remains on v5 with Livewire v4-compatible surfaces only. - Provider registration location is unchanged; Laravel 11+ providers stay in `apps/platform/bootstrap/providers.php`. - `ProviderConnectionResource` remains non-globally-searchable and still exposes View/Edit pages. - No new asset registration was added; deploy-time `filament:assets` expectations are unchanged. - No new destructive action path was introduced; existing server authorization and confirmation handling remain in place where applicable. Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #339
94 lines
3.9 KiB
PHP
94 lines
3.9 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\OperationRun;
|
|
use App\Models\ProviderConnection;
|
|
use App\Models\ProviderCredential;
|
|
use App\Models\ManagedEnvironment;
|
|
use App\Services\Providers\ProviderOperationStartGate;
|
|
use App\Support\OperationRunOutcome;
|
|
use App\Support\Providers\ProviderReasonCodes;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
it('stores neutral target-scope and nested provider context when provider operations start', function (): void {
|
|
$tenant = ManagedEnvironment::factory()->create([
|
|
'name' => 'Spec 281 Environment',
|
|
'managed_environment_id' => '44444444-4444-4444-4444-444444444444',
|
|
]);
|
|
$connection = ProviderConnection::factory()->dedicated()->consentGranted()->create([
|
|
'workspace_id' => (int) $tenant->workspace_id,
|
|
'managed_environment_id' => (int) $tenant->getKey(),
|
|
'provider' => 'microsoft',
|
|
'entra_tenant_id' => '44444444-4444-4444-4444-444444444444',
|
|
'consent_status' => 'granted',
|
|
]);
|
|
ProviderCredential::factory()->create([
|
|
'provider_connection_id' => (int) $connection->getKey(),
|
|
]);
|
|
|
|
$result = app(ProviderOperationStartGate::class)->start(
|
|
tenant: $tenant,
|
|
connection: $connection,
|
|
operationType: 'provider.connection.check',
|
|
dispatcher: fn (OperationRun $run): null => null,
|
|
);
|
|
|
|
$context = $result->run->fresh()->context;
|
|
|
|
expect($result->status)->toBe('started')
|
|
->and($context['target_scope'] ?? [])->toMatchArray([
|
|
'provider' => 'microsoft',
|
|
'scope_kind' => 'tenant',
|
|
'scope_identifier' => '44444444-4444-4444-4444-444444444444',
|
|
'scope_display_name' => 'Spec 281 Environment',
|
|
])
|
|
->and($context['target_scope'] ?? [])->not->toHaveKey('entra_tenant_id')
|
|
->and($context['provider_context']['details'][0] ?? [])->toMatchArray([
|
|
'detail_key' => 'microsoft_tenant_id',
|
|
'detail_value' => '44444444-4444-4444-4444-444444444444',
|
|
]);
|
|
});
|
|
|
|
it('stores neutral target-scope context when provider starts are blocked before a connection is resolved', function (): void {
|
|
$tenant = ManagedEnvironment::factory()->create([
|
|
'name' => 'Blocked Spec 281 Environment',
|
|
'managed_environment_id' => '55555555-5555-5555-5555-555555555555',
|
|
]);
|
|
|
|
$result = app(ProviderOperationStartGate::class)->start(
|
|
tenant: $tenant,
|
|
connection: null,
|
|
operationType: 'provider.connection.check',
|
|
dispatcher: fn (): null => null,
|
|
);
|
|
|
|
$context = $result->run->fresh()->context;
|
|
$report = $context['verification_report'] ?? [];
|
|
$report = is_array($report) ? $report : [];
|
|
$identity = $report['identity'] ?? [];
|
|
$identity = is_array($identity) ? $identity : [];
|
|
$evidence = $report['checks'][0]['evidence'] ?? [];
|
|
$evidence = is_array($evidence) ? $evidence : [];
|
|
|
|
expect($result->status)->toBe('blocked')
|
|
->and($result->run->outcome)->toBe(OperationRunOutcome::Blocked->value)
|
|
->and($context['reason_code'] ?? null)->toBe(ProviderReasonCodes::ProviderConnectionMissing)
|
|
->and($context['target_scope'] ?? [])->toMatchArray([
|
|
'provider' => 'microsoft',
|
|
'scope_kind' => 'tenant',
|
|
'scope_identifier' => '55555555-5555-5555-5555-555555555555',
|
|
])
|
|
->and($context['target_scope'] ?? [])->not->toHaveKey('entra_tenant_id')
|
|
->and($identity['target_scope'] ?? [])->toMatchArray([
|
|
'scope_identifier' => '55555555-5555-5555-5555-555555555555',
|
|
])
|
|
->and($identity)->not->toHaveKey('entra_tenant_id')
|
|
->and(collect($evidence)->contains(
|
|
fn (array $pointer): bool => ($pointer['kind'] ?? null) === 'target_scope_identifier'
|
|
&& ($pointer['value'] ?? null) === '55555555-5555-5555-5555-555555555555',
|
|
))->toBeTrue();
|
|
});
|