TenantAtlas/tests/Feature/OpsUx/BulkTenantIsolationTest.php

<?php

use App\Models\Tenant;
use App\Services\OperationRunService;
use App\Services\Operations\BulkSelectionIdentity;

it('rejects bulk enqueue when target_scope entra_tenant_id mismatches tenant', function () {
    $tenant = Tenant::factory()->create([
        'tenant_id' => 'tenant-a',
        'external_id' => 'tenant-a',
    ]);

    /** @var BulkSelectionIdentity $selection */
    $selection = app(BulkSelectionIdentity::class);

    $selectionIdentity = $selection->fromIds([1, 2, 3]);

    /** @var OperationRunService $runs */
    $runs = app(OperationRunService::class);

    $runs->enqueueBulkOperation(
        tenant: $tenant,
        type: 'policy.bulk_delete',
        targetScope: ['entra_tenant_id' => 'tenant-b'],
        selectionIdentity: $selectionIdentity,
        dispatcher: fn (): null => null,
        initiator: null,
        extraContext: [],
        emitQueuedNotification: false,
    );
})->throws(InvalidArgumentException::class);