TenantAtlas/apps/platform/tests/Feature/Filament/BaselineActionAuthorizationTest.php

<?php

declare(strict_types=1);

use App\Filament\Pages\BaselineCompareLanding;
use App\Filament\Resources\BaselineProfileResource\Pages\ViewBaselineProfile;
use App\Models\BaselineProfile;
use App\Models\BaselineSnapshot;
use App\Models\BaselineTenantAssignment;
use App\Support\Workspaces\WorkspaceContext;
use Filament\Facades\Filament;
use Illuminate\Support\Facades\DB;
use Livewire\Livewire;

it('keeps baseline capture and compare actions capability-gated on the profile detail page', function (): void {
    [$readonlyUser, $tenant] = createUserWithTenant(role: 'readonly');
    [$ownerUser] = createUserWithTenant(tenant: $tenant, role: 'owner');

    $profile = BaselineProfile::factory()->active()->create([
        'workspace_id' => (int) $tenant->workspace_id,
    ]);

    $snapshot = BaselineSnapshot::factory()->complete()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'baseline_profile_id' => (int) $profile->getKey(),
    ]);

    $profile->update(['active_snapshot_id' => (int) $snapshot->getKey()]);

    BaselineTenantAssignment::factory()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'tenant_id' => (int) $tenant->getKey(),
        'baseline_profile_id' => (int) $profile->getKey(),
    ]);

    session()->put(WorkspaceContext::SESSION_KEY, (int) $tenant->workspace_id);

    Livewire::actingAs($readonlyUser)
        ->test(ViewBaselineProfile::class, ['record' => $profile->getKey()])
        ->assertActionDisabled('capture')
        ->assertActionDisabled('compareNow');

    Livewire::actingAs($ownerUser)
        ->test(ViewBaselineProfile::class, ['record' => $profile->getKey()])
        ->assertActionHidden('capture')
        ->assertActionEnabled('compareNow');
});

it('keeps tenant compare actions disabled for users without tenant.sync and enabled for owners', function (): void {
    [$readonlyUser, $tenant] = createUserWithTenant(role: 'readonly');
    [$ownerUser] = createUserWithTenant(tenant: $tenant, role: 'owner');

    $profile = BaselineProfile::factory()->active()->create([
        'workspace_id' => (int) $tenant->workspace_id,
    ]);

    $snapshot = BaselineSnapshot::factory()->complete()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'baseline_profile_id' => (int) $profile->getKey(),
    ]);

    $profile->update(['active_snapshot_id' => (int) $snapshot->getKey()]);

    BaselineTenantAssignment::factory()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'tenant_id' => (int) $tenant->getKey(),
        'baseline_profile_id' => (int) $profile->getKey(),
    ]);

    $tenant->makeCurrent();
    Filament::setTenant($tenant, true);

    Livewire::actingAs($readonlyUser)
        ->test(BaselineCompareLanding::class)
        ->assertActionDisabled('compareNow');

    Livewire::actingAs($ownerUser)
        ->test(BaselineCompareLanding::class)
        ->assertActionEnabled('compareNow');
});

it('keeps legacy-scope capture and compare actions capability-gated on the profile detail page', function (): void {
    [$readonlyUser, $tenant] = createUserWithTenant(role: 'readonly');
    [$ownerUser] = createUserWithTenant(tenant: $tenant, role: 'owner');

    $profile = BaselineProfile::factory()->active()->create([
        'workspace_id' => (int) $tenant->workspace_id,
    ]);

    $snapshot = BaselineSnapshot::factory()->complete()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'baseline_profile_id' => (int) $profile->getKey(),
    ]);

    $profile->update(['active_snapshot_id' => (int) $snapshot->getKey()]);

    BaselineTenantAssignment::factory()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'tenant_id' => (int) $tenant->getKey(),
        'baseline_profile_id' => (int) $profile->getKey(),
    ]);

    DB::table('baseline_profiles')
        ->where('id', (int) $profile->getKey())
        ->update([
            'scope_jsonb' => json_encode([
                'policy_types' => ['deviceConfiguration'],
                'foundation_types' => [],
            ], JSON_THROW_ON_ERROR),
            'updated_at' => now(),
        ]);

    session()->put(WorkspaceContext::SESSION_KEY, (int) $tenant->workspace_id);

    Livewire::actingAs($readonlyUser)
        ->test(ViewBaselineProfile::class, ['record' => $profile->getKey()])
        ->assertActionDisabled('capture')
        ->assertActionDisabled('compareNow');

    Livewire::actingAs($ownerUser)
        ->test(ViewBaselineProfile::class, ['record' => $profile->getKey()])
        ->assertActionHidden('capture')
        ->assertActionEnabled('compareNow');
});