Kontext / Ziel Diese PR standardisiert Tenant‑RBAC Enforcement in der Filament‑UI: statt ad-hoc Gate::*, abort_if/abort_unless und kopierten ->visible()/->disabled()‑Closures gibt es jetzt eine zentrale, wiederverwendbare Implementierung für Actions (Header/Table/Bulk). Links zur Spec: spec.md plan.md quickstart.md Was ist drin Neue zentrale Helper-API: UiEnforcement (Tenant-plane RBAC‑UX “source of truth” für Filament Actions) Standardisierte Tooltip-Texte und Context-DTO (UiTooltips, TenantAccessContext) Migration vieler tenant‑scoped Filament Action-Surfaces auf das Standardpattern (ohne ad-hoc Auth-Patterns) CI‑Guard (Test) gegen neue ad-hoc Patterns in app/Filament/**: verbietet Gate::allows/denies/check/authorize, use Illuminate\Support\Facades\Gate, abort_if/abort_unless Legacy-Allowlist ist aktuell leer (neue Verstöße failen sofort) RBAC-UX Semantik (konsequent & testbar) Non-member: UI Actions hidden (kein Tenant‑Leak); Execution wird blockiert (Filament hidden→disabled chain), Defense‑in‑depth enthält zusätzlich serverseitige Guards. Member ohne Capability: Action visible aber disabled + Standard-Tooltip; Execution wird blockiert (keine Side Effects). Member mit Capability: Action enabled und ausführbar. Destructive actions: über ->destructive() immer mit ->requiresConfirmation() + klare Warntexte (Execution bleibt über ->action(...)). Wichtig: In Filament v5 sind hidden/disabled Actions typischerweise “silently blocked” (200, keine Ausführung). Die Tests prüfen daher UI‑State + “no side effects”, nicht nur HTTP‑Statuscodes. Sicherheit / Scope Keine neuen DB-Tabellen, keine Migrations, keine Microsoft Graph Calls (DB‑only bei Render; kein outbound HTTP). Tenant Isolation bleibt Isolation‑Boundary (deny-as-not-found auf Tenant‑Ebene, Capability erst nach Membership). Kein Asset-Setup erforderlich; keine neuen Filament Assets. Compliance Notes (Repo-Regeln) Filament v5 / Livewire v4.0+ kompatibel. Keine Änderungen an Provider‑Registrierung (Laravel 11+/12: providers.php bleibt der Ort; hier unverändert). Global Search: keine gezielte Änderung am Global‑Search-Verhalten in dieser PR. Tests / Qualität Pest Feature/Unit Tests für Member/Non-member/Tooltip/Destructive/Regression‑Guard. Guard-Test: “No ad-hoc Filament auth patterns”. Full suite laut Tasks: vendor/bin/sail artisan test --compact → 837 passed, 5 skipped. Checklist: requirements.md vollständig (16/16). Review-Fokus API‑Usage in neuen/angepassten Filament Actions: UiEnforcement::forAction/forTableAction/forBulkAction(...)->requireCapability(...)->apply() Guard-Test soll “red” werden, sobald jemand neue ad-hoc Auth‑Patterns einführt (by design). Co-authored-by: Ahmed Darrazi <ahmeddarrazi@MacBookPro.fritz.box> Reviewed-on: #81
221 lines
7.9 KiB
PHP
221 lines
7.9 KiB
PHP
<?php
|
|
|
|
use App\Filament\Resources\InventoryItemResource\Pages\ListInventoryItems;
|
|
use App\Jobs\RunInventorySyncJob;
|
|
use App\Livewire\BulkOperationProgress;
|
|
use App\Models\InventorySyncRun;
|
|
use App\Models\OperationRun;
|
|
use App\Models\Tenant;
|
|
use App\Services\Inventory\InventorySyncService;
|
|
use App\Support\OpsUx\OpsUxBrowserEvents;
|
|
use Filament\Facades\Filament;
|
|
use Illuminate\Support\Facades\Queue;
|
|
use Livewire\Livewire;
|
|
|
|
it('dispatches inventory sync and creates observable run records', function () {
|
|
Queue::fake();
|
|
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
$this->actingAs($user);
|
|
|
|
$tenant->makeCurrent();
|
|
Filament::setTenant($tenant, true);
|
|
|
|
$sync = app(InventorySyncService::class);
|
|
$allTypes = $sync->defaultSelectionPayload()['policy_types'];
|
|
|
|
Livewire::test(ListInventoryItems::class)
|
|
->callAction('run_inventory_sync', data: ['policy_types' => $allTypes])
|
|
->assertDispatchedTo(BulkOperationProgress::class, OpsUxBrowserEvents::RunEnqueued, tenantId: (int) $tenant->getKey());
|
|
|
|
Queue::assertPushed(RunInventorySyncJob::class);
|
|
|
|
$run = InventorySyncRun::query()->where('tenant_id', $tenant->id)->latest('id')->first();
|
|
expect($run)->not->toBeNull();
|
|
expect($run->user_id)->toBe($user->id);
|
|
expect($run->status)->toBe(InventorySyncRun::STATUS_PENDING);
|
|
|
|
$opRun = OperationRun::query()
|
|
->where('tenant_id', $tenant->id)
|
|
->where('user_id', $user->id)
|
|
->where('type', 'inventory.sync')
|
|
->latest('id')
|
|
->first();
|
|
|
|
expect($opRun)->not->toBeNull();
|
|
});
|
|
|
|
it('dispatches inventory sync for selected policy types', function () {
|
|
Queue::fake();
|
|
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
$this->actingAs($user);
|
|
|
|
$tenant->makeCurrent();
|
|
Filament::setTenant($tenant, true);
|
|
|
|
$sync = app(InventorySyncService::class);
|
|
$allTypes = $sync->defaultSelectionPayload()['policy_types'];
|
|
$selectedTypes = array_slice($allTypes, 0, min(2, count($allTypes)));
|
|
|
|
Livewire::test(ListInventoryItems::class)
|
|
->mountAction('run_inventory_sync')
|
|
->set('mountedActions.0.data.policy_types', $selectedTypes)
|
|
->assertActionDataSet(['policy_types' => $selectedTypes])
|
|
->callMountedAction()
|
|
->assertHasNoActionErrors();
|
|
|
|
Queue::assertPushed(RunInventorySyncJob::class);
|
|
|
|
$run = InventorySyncRun::query()->where('tenant_id', $tenant->id)->latest('id')->first();
|
|
expect($run)->not->toBeNull();
|
|
expect($run->selection_payload['policy_types'] ?? [])->toEqualCanonicalizing($selectedTypes);
|
|
});
|
|
|
|
it('persists include dependencies toggle into the run selection payload', function () {
|
|
Queue::fake();
|
|
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
$this->actingAs($user);
|
|
|
|
$tenant->makeCurrent();
|
|
Filament::setTenant($tenant, true);
|
|
|
|
$sync = app(InventorySyncService::class);
|
|
$allTypes = $sync->defaultSelectionPayload()['policy_types'];
|
|
$selectedTypes = array_slice($allTypes, 0, min(2, count($allTypes)));
|
|
|
|
Livewire::test(ListInventoryItems::class)
|
|
->callAction('run_inventory_sync', data: [
|
|
'policy_types' => $selectedTypes,
|
|
'include_dependencies' => false,
|
|
])
|
|
->assertHasNoActionErrors();
|
|
|
|
$run = InventorySyncRun::query()->where('tenant_id', $tenant->id)->latest('id')->first();
|
|
expect($run)->not->toBeNull();
|
|
expect((bool) ($run->selection_payload['include_dependencies'] ?? true))->toBeFalse();
|
|
});
|
|
|
|
it('defaults include foundations toggle to true and persists it into the run selection payload', function () {
|
|
Queue::fake();
|
|
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
$this->actingAs($user);
|
|
|
|
$tenant->makeCurrent();
|
|
Filament::setTenant($tenant, true);
|
|
|
|
$sync = app(InventorySyncService::class);
|
|
$allTypes = $sync->defaultSelectionPayload()['policy_types'];
|
|
$selectedTypes = array_slice($allTypes, 0, min(2, count($allTypes)));
|
|
|
|
Livewire::test(ListInventoryItems::class)
|
|
->mountAction('run_inventory_sync')
|
|
->set('mountedActions.0.data.policy_types', $selectedTypes)
|
|
->assertActionDataSet(['include_foundations' => true])
|
|
->callMountedAction()
|
|
->assertHasNoActionErrors();
|
|
|
|
$run = InventorySyncRun::query()->where('tenant_id', $tenant->id)->latest('id')->first();
|
|
expect($run)->not->toBeNull();
|
|
expect((bool) ($run->selection_payload['include_foundations'] ?? false))->toBeTrue();
|
|
});
|
|
|
|
it('persists include foundations toggle into the run selection payload', function () {
|
|
Queue::fake();
|
|
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
$this->actingAs($user);
|
|
|
|
$tenant->makeCurrent();
|
|
Filament::setTenant($tenant, true);
|
|
|
|
$sync = app(InventorySyncService::class);
|
|
$allTypes = $sync->defaultSelectionPayload()['policy_types'];
|
|
$selectedTypes = array_slice($allTypes, 0, min(2, count($allTypes)));
|
|
|
|
Livewire::test(ListInventoryItems::class)
|
|
->callAction('run_inventory_sync', data: [
|
|
'policy_types' => $selectedTypes,
|
|
'include_foundations' => false,
|
|
])
|
|
->assertHasNoActionErrors();
|
|
|
|
$run = InventorySyncRun::query()->where('tenant_id', $tenant->id)->latest('id')->first();
|
|
expect($run)->not->toBeNull();
|
|
expect((bool) ($run->selection_payload['include_foundations'] ?? true))->toBeFalse();
|
|
});
|
|
|
|
it('rejects cross-tenant initiation attempts (403) with no side effects', function () {
|
|
Queue::fake();
|
|
|
|
[$user, $tenantA] = createUserWithTenant(role: 'owner');
|
|
$tenantB = Tenant::factory()->create();
|
|
|
|
$this->actingAs($user);
|
|
Filament::setTenant($tenantA, true);
|
|
|
|
$sync = app(InventorySyncService::class);
|
|
$allTypes = $sync->defaultSelectionPayload()['policy_types'];
|
|
|
|
Livewire::test(ListInventoryItems::class)
|
|
->callAction('run_inventory_sync', data: ['tenant_id' => $tenantB->getKey(), 'policy_types' => $allTypes])
|
|
->assertSuccessful();
|
|
|
|
Queue::assertNothingPushed();
|
|
|
|
expect(InventorySyncRun::query()->where('tenant_id', $tenantB->id)->exists())->toBeFalse();
|
|
expect(OperationRun::query()->where('tenant_id', $tenantB->id)->exists())->toBeFalse();
|
|
});
|
|
|
|
it('blocks dispatch when a matching run is already pending or running', function () {
|
|
Queue::fake();
|
|
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
$this->actingAs($user);
|
|
Filament::setTenant($tenant, true);
|
|
|
|
$sync = app(InventorySyncService::class);
|
|
$selectionPayload = $sync->defaultSelectionPayload();
|
|
$computed = $sync->normalizeAndHashSelection($selectionPayload);
|
|
|
|
InventorySyncRun::query()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'user_id' => $user->getKey(),
|
|
'selection_hash' => $computed['selection_hash'],
|
|
'selection_payload' => $computed['selection'],
|
|
'status' => InventorySyncRun::STATUS_RUNNING,
|
|
'had_errors' => false,
|
|
'error_codes' => [],
|
|
'error_context' => null,
|
|
'started_at' => now(),
|
|
'finished_at' => null,
|
|
'items_observed_count' => 0,
|
|
'items_upserted_count' => 0,
|
|
'errors_count' => 0,
|
|
]);
|
|
|
|
Livewire::test(ListInventoryItems::class)
|
|
->callAction('run_inventory_sync', data: ['policy_types' => $computed['selection']['policy_types']]);
|
|
|
|
Queue::assertNothingPushed();
|
|
expect(InventorySyncRun::query()->where('tenant_id', $tenant->id)->count())->toBe(1);
|
|
expect(OperationRun::query()->where('tenant_id', $tenant->id)->where('type', 'inventory.sync')->count())->toBe(1);
|
|
});
|
|
|
|
it('disables inventory sync start action for readonly users', function () {
|
|
Queue::fake();
|
|
|
|
[$user, $tenant] = createUserWithTenant(role: 'readonly');
|
|
$this->actingAs($user);
|
|
Filament::setTenant($tenant, true);
|
|
|
|
Livewire::test(ListInventoryItems::class)
|
|
->assertActionVisible('run_inventory_sync')
|
|
->assertActionDisabled('run_inventory_sync');
|
|
|
|
Queue::assertNothingPushed();
|
|
expect(InventorySyncRun::query()->where('tenant_id', $tenant->id)->exists())->toBeFalse();
|
|
});
|