3b1dd98f52
This commit introduces a comprehensive Role-Based Access Control (RBAC) system for TenantAtlas. - Implements authentication via Microsoft Entra ID (OIDC). - Manages authorization on a per-Suite-Tenant basis using a table. - Follows a capabilities-first approach, using Gates and Policies. - Includes a break-glass mechanism for platform superadmins. - Adds policies for bootstrapping tenants and managing admin responsibilities.
47 lines
1.4 KiB
PHP
47 lines
1.4 KiB
PHP
<?php
|
|
|
|
use App\Models\Tenant;
|
|
use App\Models\User;
|
|
use Filament\PanelRegistry;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
it('only returns membership tenants for normal users', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$allowed = Tenant::factory()->create(['name' => 'Allowed']);
|
|
$blocked = Tenant::factory()->create(['name' => 'Blocked']);
|
|
|
|
$user->tenants()->syncWithoutDetaching([
|
|
$allowed->getKey() => ['role' => 'readonly'],
|
|
]);
|
|
|
|
/** @var \Filament\Panel $panel */
|
|
$panel = app(PanelRegistry::class)->get('admin');
|
|
|
|
$tenants = $user->getTenants($panel);
|
|
|
|
expect($tenants)->toHaveCount(1);
|
|
expect($tenants->first()?->getKey())->toBe($allowed->getKey());
|
|
expect($tenants->first()?->name)->toBe('Allowed');
|
|
|
|
expect($tenants->contains(fn (Tenant $tenant) => $tenant->getKey() === $blocked->getKey()))->toBeFalse();
|
|
});
|
|
|
|
it('returns all active tenants for platform superadmins', function () {
|
|
$user = User::factory()->create(['is_platform_superadmin' => true]);
|
|
|
|
$a = Tenant::factory()->create(['name' => 'A']);
|
|
$b = Tenant::factory()->create(['name' => 'B']);
|
|
|
|
/** @var \Filament\Panel $panel */
|
|
$panel = app(PanelRegistry::class)->get('admin');
|
|
|
|
$tenants = $user->getTenants($panel);
|
|
|
|
expect($tenants->pluck('id')->all())
|
|
->toContain($a->getKey())
|
|
->toContain($b->getKey());
|
|
});
|