ahmido
fcb03d2aee
## Summary - harden Provider Connection authority so workspace scope comes only from explicit workspace context and record ownership - require explicit `environment_id` for Provider Connection create flows and remove remembered-environment or Filament-tenant fallback authority - keep legacy query aliases such as `tenant`, `tenant_id`, and `managed_environment_id` inert for Provider Connection access - add targeted Spec 339 feature coverage for create authority, workspace authority, and wrong-workspace / legacy-query denial behavior - include Spec 339 artifacts (`spec.md`, `plan.md`, `tasks.md`) for the hardening slice ## Validation - `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/ProviderConnections --filter=ScopeHardening` ## Notes - no new uncommitted workspace changes were present to commit in this turn; the branch already contained the feature commits - Livewire v4 compliance unchanged - Filament provider registration remains in `bootstrap/providers.php` - no migrations, new assets, or route-family restructures Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #410
33 lines
993 B
PHP
33 lines
993 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\ManagedEnvironment;
|
|
use App\Models\User;
|
|
use App\Policies\ProviderConnectionPolicy;
|
|
use App\Support\Workspaces\WorkspaceContext;
|
|
use Filament\Facades\Filament;
|
|
use Illuminate\Auth\Access\Response;
|
|
|
|
it('ScopeHardening does not derive workspace authority from Filament tenant in ProviderConnectionPolicy', function (): void {
|
|
$environment = ManagedEnvironment::factory()->active()->create([
|
|
'external_id' => 'spec339-scopehardening-policy-env',
|
|
]);
|
|
|
|
[$user, $environment] = createUserWithTenant(tenant: $environment, role: 'owner');
|
|
|
|
expect($user)->toBeInstanceOf(User::class);
|
|
|
|
session()->forget(WorkspaceContext::SESSION_KEY);
|
|
|
|
Filament::setTenant($environment, true);
|
|
|
|
/** @var ProviderConnectionPolicy $policy */
|
|
$policy = app(ProviderConnectionPolicy::class);
|
|
|
|
$result = $policy->viewAny($user);
|
|
|
|
expect($result)->toBeInstanceOf(Response::class);
|
|
expect($result->denied())->toBeTrue();
|
|
});
|