ahmido
53e799fea7
## Summary - add Spec 185 workspace recovery posture visibility artifacts under `specs/185-workspace-recovery-posture-visibility` - promote tenant backup health and recovery evidence onto the workspace overview with separate metrics, attention ordering, calmness coverage, and tenant-dashboard drill-throughs - batch visible-tenant backup/recovery derivation to keep the workspace overview query-bounded - align follow-up fixes from the authoritative suite rerun, including dashboard truth-alignment fixtures, canonical backup schedule tenant context, guard-path cleanup, smoke-fixture credential removal, and robust theme asset manifest handling ## Testing - `cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent` - `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Unit/Filament/PanelThemeAssetTest.php tests/Feature/Guards/DerivedStateConsumerAdoptionGuardTest.php` - focused regression pack for the previously failing cases passed - full suite JUnit run passed: `3401` tests, `18849` assertions, `0` failures, `0` errors, `8` skips ## Notes - no new schema or persisted workspace recovery model - no provider-registration changes; Filament/Livewire stack remains on Filament v5 and Livewire v4 - no new destructive actions or global search changes Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #216
106 lines
3.5 KiB
PHP
106 lines
3.5 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Filament\Pages\TenantDashboard;
|
|
use App\Filament\Resources\BackupSetResource;
|
|
use App\Filament\Widgets\Dashboard\NeedsAttention;
|
|
use App\Filament\Widgets\Dashboard\RecoveryReadiness;
|
|
use App\Models\BackupItem;
|
|
use App\Models\BackupSet;
|
|
use App\Models\Finding;
|
|
use App\Models\InventoryItem;
|
|
use App\Models\OperationRun;
|
|
use App\Models\Tenant;
|
|
use App\Services\Auth\CapabilityResolver;
|
|
use App\Support\Auth\Capabilities;
|
|
use App\Support\Rbac\UiTooltips;
|
|
use Filament\Facades\Filament;
|
|
use Illuminate\Support\Facades\Gate;
|
|
use Livewire\Livewire;
|
|
|
|
use function Pest\Laravel\mock;
|
|
|
|
it('does not leak data across tenants on the dashboard', function (): void {
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
$otherTenant = Tenant::factory()->create();
|
|
|
|
InventoryItem::factory()->create([
|
|
'tenant_id' => $otherTenant->getKey(),
|
|
'external_id' => 'other-tenant-finding',
|
|
'display_name' => 'Other Tenant Policy',
|
|
]);
|
|
|
|
Finding::factory()->create([
|
|
'tenant_id' => $otherTenant->getKey(),
|
|
'finding_type' => Finding::FINDING_TYPE_DRIFT,
|
|
'subject_external_id' => 'other-tenant-finding',
|
|
]);
|
|
|
|
OperationRun::factory()->create([
|
|
'tenant_id' => $otherTenant->getKey(),
|
|
'type' => 'inventory_sync',
|
|
'status' => 'running',
|
|
'outcome' => 'pending',
|
|
'initiator_name' => 'System',
|
|
]);
|
|
|
|
$this->actingAs($user);
|
|
|
|
$this->get(TenantDashboard::getUrl(tenant: $tenant))
|
|
->assertOk()
|
|
->assertDontSee('Other Tenant Policy');
|
|
});
|
|
|
|
it('keeps backup summary truth visible on the dashboard while blocked backup drill-through routes still fail with 403', function (): void {
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner', ensureDefaultMicrosoftProviderConnection: false);
|
|
$this->actingAs($user);
|
|
|
|
$backupSet = BackupSet::factory()->for($tenant)->create([
|
|
'name' => 'Stale scoped backup',
|
|
'item_count' => 1,
|
|
'completed_at' => now()->subDays(2),
|
|
]);
|
|
|
|
BackupItem::factory()->for($tenant)->for($backupSet)->create([
|
|
'payload' => ['id' => 'policy-stale'],
|
|
'metadata' => [],
|
|
'assignments' => [],
|
|
]);
|
|
|
|
Gate::define(Capabilities::TENANT_VIEW, fn (): bool => false);
|
|
|
|
mock(CapabilityResolver::class, function ($mock) use ($tenant): void {
|
|
$mock->shouldReceive('isMember')
|
|
->andReturnUsing(static fn ($user, Tenant $resolvedTenant): bool => (int) $resolvedTenant->getKey() === (int) $tenant->getKey());
|
|
|
|
$mock->shouldReceive('can')
|
|
->andReturnUsing(static function ($user, Tenant $resolvedTenant, string $capability) use ($tenant): bool {
|
|
expect((int) $resolvedTenant->getKey())->toBe((int) $tenant->getKey());
|
|
|
|
return match ($capability) {
|
|
Capabilities::TENANT_VIEW => false,
|
|
default => true,
|
|
};
|
|
});
|
|
});
|
|
|
|
Filament::setCurrentPanel(Filament::getPanel('tenant'));
|
|
Filament::setTenant($tenant, true);
|
|
|
|
Livewire::test(NeedsAttention::class)
|
|
->assertSee('Latest backup is stale')
|
|
->assertSee(UiTooltips::INSUFFICIENT_PERMISSION)
|
|
->assertSee('Open latest backup');
|
|
|
|
Livewire::test(RecoveryReadiness::class)
|
|
->assertSee('Backup posture')
|
|
->assertSee('Stale');
|
|
|
|
$this->get(TenantDashboard::getUrl(tenant: $tenant))
|
|
->assertOk();
|
|
|
|
$this->get(BackupSetResource::getUrl('index', tenant: $tenant))
|
|
->assertForbidden();
|
|
});
|