ahmido
440e63edff
## Summary
Implements Spec 145 for tenant action taxonomy and lifecycle-safe visibility.
This PR:
- adds a central tenant action policy surface and supporting value objects
- aligns tenant list, detail, edit, onboarding, and widget surfaces around lifecycle-safe actions
- standardizes operator-facing lifecycle wording around View, Resume onboarding, Archive, Restore, and Complete onboarding
- tightens onboarding and tenant lifecycle authorization semantics, including honest 404 vs 403 behavior
- updates related regression coverage and spec artifacts for Spec 145
- fixes follow-on full-suite regressions uncovered during validation, including onboarding browser flows, provider consent fixtures, workspace redirect DI expectations, and critical table/action/UI expectation drift
## Validation
Executed and passed:
- vendor/bin/sail bin pint --dirty --format agent
- vendor/bin/sail artisan test --compact
Result:
- 2581 passed
- 8 skipped
- 13534 assertions
## Notes
- Base branch: dev
- Feature branch commit: a33a41b
- Filament v5 / Livewire v4 compliance preserved
- No panel provider registration changes; Laravel 12 provider registration remains in bootstrap/providers.php
- No new globally searchable resource behavior added in this slice
- Destructive lifecycle actions remain confirmation-gated and authorization-protected
Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #174
104 lines
3.5 KiB
PHP
104 lines
3.5 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Filament\Resources\TenantResource;
|
|
use App\Models\Tenant;
|
|
use App\Models\User;
|
|
|
|
describe('Tenant resource authorization', function () {
|
|
it('cannot be created by non-members', function () {
|
|
$user = User::factory()->create();
|
|
|
|
$this->actingAs($user);
|
|
|
|
expect(TenantResource::canCreate())->toBeFalse();
|
|
});
|
|
|
|
it('cannot be created via CRUD (onboarding wizard is the only path)', function () {
|
|
[$user] = createUserWithTenant(role: 'manager');
|
|
|
|
$this->actingAs($user);
|
|
|
|
expect(TenantResource::canCreate())->toBeFalse();
|
|
});
|
|
|
|
it('can be edited by managers (TENANT_MANAGE)', function () {
|
|
[$user, $tenant] = createUserWithTenant(role: 'manager');
|
|
|
|
$this->actingAs($user);
|
|
|
|
expect(TenantResource::canEdit($tenant))->toBeTrue();
|
|
});
|
|
|
|
it('cannot be deleted by managers (TENANT_DELETE)', function () {
|
|
[$user, $tenant] = createUserWithTenant(role: 'manager');
|
|
|
|
$this->actingAs($user);
|
|
|
|
expect(TenantResource::canDelete($tenant))->toBeFalse();
|
|
});
|
|
|
|
it('can be deleted by owners (TENANT_DELETE)', function () {
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
|
|
$this->actingAs($user);
|
|
|
|
expect(TenantResource::canDelete($tenant))->toBeTrue();
|
|
});
|
|
|
|
it('cannot edit tenants it cannot access', function () {
|
|
[$user] = createUserWithTenant(role: 'manager');
|
|
$otherTenant = Tenant::factory()->create();
|
|
|
|
$this->actingAs($user);
|
|
|
|
expect(TenantResource::canEdit($otherTenant))->toBeFalse();
|
|
});
|
|
|
|
it('does not grant lifecycle mutation abilities for inaccessible tenants regardless of lifecycle state', function (\Closure $tenantFactory): void {
|
|
[$user] = createUserWithTenant(role: 'owner', ensureDefaultMicrosoftProviderConnection: false);
|
|
$otherTenant = $tenantFactory();
|
|
|
|
$this->actingAs($user);
|
|
|
|
expect(TenantResource::canEdit($otherTenant))->toBeFalse()
|
|
->and(TenantResource::canDelete($otherTenant))->toBeFalse();
|
|
})->with([
|
|
'draft' => [fn (): Tenant => Tenant::factory()->draft()->create()],
|
|
'onboarding' => [fn (): Tenant => Tenant::factory()->onboarding()->create()],
|
|
'active' => [fn (): Tenant => Tenant::factory()->active()->create()],
|
|
'archived' => [fn (): Tenant => Tenant::factory()->archived()->create()],
|
|
]);
|
|
|
|
it('keeps onboarding and archived tenants manageable when the actor is entitled', function () {
|
|
$onboardingTenant = Tenant::factory()->onboarding()->create();
|
|
[$user, $onboardingTenant] = createUserWithTenant(
|
|
tenant: $onboardingTenant,
|
|
role: 'manager',
|
|
ensureDefaultMicrosoftProviderConnection: false,
|
|
);
|
|
|
|
$archivedTenant = Tenant::factory()->archived()->create([
|
|
'workspace_id' => (int) $onboardingTenant->workspace_id,
|
|
]);
|
|
|
|
createUserWithTenant(
|
|
tenant: $archivedTenant,
|
|
user: $user,
|
|
role: 'manager',
|
|
workspaceRole: 'manager',
|
|
ensureDefaultMicrosoftProviderConnection: false,
|
|
);
|
|
|
|
$archivedTenant = Tenant::withTrashed()->findOrFail((int) $archivedTenant->getKey());
|
|
|
|
$this->actingAs($user);
|
|
|
|
expect(TenantResource::canEdit($onboardingTenant))->toBeTrue()
|
|
->and(TenantResource::canEdit($archivedTenant))->toBeTrue()
|
|
->and(TenantResource::canDelete($onboardingTenant))->toBeFalse()
|
|
->and(TenantResource::canDelete($archivedTenant))->toBeFalse();
|
|
});
|
|
});
|