TenantAtlas/apps/platform/tests/Unit/Support/CreateUserWithTenantProfilesTest.php

<?php

declare(strict_types=1);

use App\Models\ProviderConnection;
use App\Models\ProviderCredential;
use App\Models\WorkspaceMembership;
use App\Services\Auth\CapabilityResolver;
use App\Services\Auth\WorkspaceCapabilityResolver;
use App\Support\Workspaces\WorkspaceContext;
use Filament\Facades\Filament;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

beforeEach(function (): void {
    Filament::setTenant(null, true);
});

it('keeps the default tenant helper profile cheap by skipping provider setup and cache clears', function (): void {
    $capabilities = \Mockery::mock(CapabilityResolver::class);
    $workspaceCapabilities = \Mockery::mock(WorkspaceCapabilityResolver::class);

    $capabilities->shouldNotReceive('clearCache');
    $workspaceCapabilities->shouldNotReceive('clearCache');

    app()->instance(CapabilityResolver::class, $capabilities);
    app()->instance(WorkspaceCapabilityResolver::class, $workspaceCapabilities);

    [$user, $tenant] = createUserWithTenant();

    expect(WorkspaceMembership::query()
        ->where('workspace_id', (int) $tenant->workspace_id)
        ->where('user_id', (int) $user->getKey())
        ->exists())->toBeTrue()
        ->and(session(WorkspaceContext::SESSION_KEY))->toBe((int) $tenant->workspace_id)
        ->and(ProviderConnection::query()->where('managed_environment_id', (int) $tenant->getKey())->exists())->toBeFalse();
});

it('opt-ins a standard provider context only when the canonical standard profile asks for it', function (): void {
    $capabilities = \Mockery::mock(CapabilityResolver::class);
    $workspaceCapabilities = \Mockery::mock(WorkspaceCapabilityResolver::class);

    $capabilities->shouldNotReceive('clearCache');
    $workspaceCapabilities->shouldNotReceive('clearCache');

    app()->instance(CapabilityResolver::class, $capabilities);
    app()->instance(WorkspaceCapabilityResolver::class, $workspaceCapabilities);

    [, $tenant] = createStandardUserWithTenant();

    $connection = ProviderConnection::query()
        ->where('managed_environment_id', (int) $tenant->getKey())
        ->where('is_default', true)
        ->first();

    expect($connection)->not->toBeNull()
        ->and($connection?->credential()->exists())->toBeFalse()
        ->and(Filament::getTenant())->toBeNull();
});

it('keeps the credential-enabled alias explicit without forcing cache or ui side effects', function (): void {
    $capabilities = \Mockery::mock(CapabilityResolver::class);
    $workspaceCapabilities = \Mockery::mock(WorkspaceCapabilityResolver::class);

    $capabilities->shouldNotReceive('clearCache');
    $workspaceCapabilities->shouldNotReceive('clearCache');

    app()->instance(CapabilityResolver::class, $capabilities);
    app()->instance(WorkspaceCapabilityResolver::class, $workspaceCapabilities);

    [, $tenant] = createCredentialEnabledUserWithTenant();

    $connection = ProviderConnection::query()
        ->where('managed_environment_id', (int) $tenant->getKey())
        ->where('is_default', true)
        ->first();

    expect($connection)->not->toBeNull()
        ->and($connection?->credential()->exists())->toBeTrue()
        ->and(ProviderCredential::query()->where('provider_connection_id', (int) $connection?->getKey())->exists())->toBeTrue()
        ->and(Filament::getTenant())->toBeNull();
});

it('keeps the ui-context alias explicit without provider or credential side effects', function (): void {
    $capabilities = \Mockery::mock(CapabilityResolver::class);
    $workspaceCapabilities = \Mockery::mock(WorkspaceCapabilityResolver::class);

    $capabilities->shouldReceive('clearCache')->once();
    $workspaceCapabilities->shouldReceive('clearCache')->once();

    app()->instance(CapabilityResolver::class, $capabilities);
    app()->instance(WorkspaceCapabilityResolver::class, $workspaceCapabilities);

    [, $tenant] = createUiContextUserWithTenant();

    expect(ProviderConnection::query()->where('managed_environment_id', (int) $tenant->getKey())->exists())->toBeFalse()
        ->and(Filament::getTenant()?->is($tenant))->toBeTrue();
});

it('opt-ins provider, credential, ui-context, and cache resets only when the canonical full profile asks for them', function (): void {
    $capabilities = \Mockery::mock(CapabilityResolver::class);
    $workspaceCapabilities = \Mockery::mock(WorkspaceCapabilityResolver::class);

    $capabilities->shouldReceive('clearCache')->once();
    $workspaceCapabilities->shouldReceive('clearCache')->once();

    app()->instance(CapabilityResolver::class, $capabilities);
    app()->instance(WorkspaceCapabilityResolver::class, $workspaceCapabilities);

    [, $tenant] = createFullUserWithTenant();

    $connection = ProviderConnection::query()
        ->where('managed_environment_id', (int) $tenant->getKey())
        ->where('is_default', true)
        ->first();

    expect($connection)->not->toBeNull()
        ->and($connection?->credential()->exists())->toBeTrue()
        ->and(ProviderCredential::query()->where('provider_connection_id', (int) $connection?->getKey())->exists())->toBeTrue()
        ->and(Filament::getTenant()?->is($tenant))->toBeTrue();
});