117 lines
4.7 KiB
PHP
117 lines
4.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\EvidenceSnapshot;
|
|
use App\Models\Finding;
|
|
use App\Models\ManagedEnvironment;
|
|
use App\Models\ManagedEnvironmentMembership;
|
|
use App\Models\ReviewPack;
|
|
use App\Models\TenantReview;
|
|
use App\Models\User;
|
|
use App\Models\Workspace;
|
|
use App\Models\WorkspaceMembership;
|
|
use App\Services\Auth\ManagedEnvironmentAccessScopeResolver;
|
|
use App\Support\Evidence\EvidenceCompletenessState;
|
|
use App\Support\Evidence\EvidenceSnapshotStatus;
|
|
use Illuminate\Support\Facades\Gate;
|
|
|
|
it('authorizes governance artifacts from workspace role without environment membership rows', function (): void {
|
|
$workspace = Workspace::factory()->create();
|
|
$tenant = ManagedEnvironment::factory()->active()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
]);
|
|
$user = User::factory()->create();
|
|
|
|
WorkspaceMembership::factory()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'user_id' => (int) $user->getKey(),
|
|
'role' => 'owner',
|
|
]);
|
|
|
|
$tenant->makeCurrent();
|
|
|
|
$finding = Finding::factory()->for($tenant)->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
]);
|
|
$snapshot = spec285EvidenceSnapshot($tenant);
|
|
$reviewPack = ReviewPack::factory()->ready()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'managed_environment_id' => (int) $tenant->getKey(),
|
|
'evidence_snapshot_id' => (int) $snapshot->getKey(),
|
|
'initiated_by_user_id' => (int) $user->getKey(),
|
|
]);
|
|
$tenantReview = TenantReview::factory()->ready()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'managed_environment_id' => (int) $tenant->getKey(),
|
|
'evidence_snapshot_id' => (int) $snapshot->getKey(),
|
|
'initiated_by_user_id' => (int) $user->getKey(),
|
|
]);
|
|
|
|
expect(Gate::forUser($user)->allows('view', $finding))->toBeTrue()
|
|
->and(Gate::forUser($user)->allows('view', $snapshot))->toBeTrue()
|
|
->and(Gate::forUser($user)->allows('view', $reviewPack))->toBeTrue()
|
|
->and(Gate::forUser($user)->allows('view', $tenantReview))->toBeTrue();
|
|
});
|
|
|
|
it('denies out-of-scope governance artifacts as not found before capability checks', function (): void {
|
|
$workspace = Workspace::factory()->create();
|
|
$allowedTenant = ManagedEnvironment::factory()->active()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
]);
|
|
$deniedTenant = ManagedEnvironment::factory()->active()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
]);
|
|
$user = User::factory()->create();
|
|
|
|
WorkspaceMembership::factory()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'user_id' => (int) $user->getKey(),
|
|
'role' => 'owner',
|
|
]);
|
|
ManagedEnvironmentMembership::query()->create([
|
|
'managed_environment_id' => (int) $allowedTenant->getKey(),
|
|
'user_id' => (int) $user->getKey(),
|
|
'role' => 'owner',
|
|
'source' => 'manual',
|
|
]);
|
|
app(ManagedEnvironmentAccessScopeResolver::class)->clearCache();
|
|
|
|
$deniedTenant->makeCurrent();
|
|
|
|
$finding = Finding::factory()->for($deniedTenant)->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
]);
|
|
$snapshot = spec285EvidenceSnapshot($deniedTenant);
|
|
$reviewPack = ReviewPack::factory()->ready()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'managed_environment_id' => (int) $deniedTenant->getKey(),
|
|
'evidence_snapshot_id' => (int) $snapshot->getKey(),
|
|
'initiated_by_user_id' => (int) $user->getKey(),
|
|
]);
|
|
$tenantReview = TenantReview::factory()->ready()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'managed_environment_id' => (int) $deniedTenant->getKey(),
|
|
'evidence_snapshot_id' => (int) $snapshot->getKey(),
|
|
'initiated_by_user_id' => (int) $user->getKey(),
|
|
]);
|
|
|
|
expect(Gate::forUser($user)->inspect('view', $finding)->status())->toBe(404)
|
|
->and(Gate::forUser($user)->inspect('view', $snapshot)->status())->toBe(404)
|
|
->and(Gate::forUser($user)->inspect('view', $reviewPack)->status())->toBe(404)
|
|
->and(Gate::forUser($user)->inspect('view', $tenantReview)->status())->toBe(404);
|
|
});
|
|
|
|
function spec285EvidenceSnapshot(ManagedEnvironment $tenant): EvidenceSnapshot
|
|
{
|
|
return EvidenceSnapshot::query()->create([
|
|
'managed_environment_id' => (int) $tenant->getKey(),
|
|
'workspace_id' => (int) $tenant->workspace_id,
|
|
'status' => EvidenceSnapshotStatus::Active->value,
|
|
'completeness_state' => EvidenceCompletenessState::Complete->value,
|
|
'summary' => [],
|
|
'fingerprint' => hash('sha256', 'spec-285-'.$tenant->getKey().'-'.microtime()),
|
|
'generated_at' => now(),
|
|
]);
|
|
}
|