ahmido
971105daa9
Summary: Upgrade Filament to v5 (Livewire v4), replace Filament v4-only plugins, add first-party JSON renderer, and harden Monitoring/Ops UX guardrails. What I changed: Composer: upgraded filament/filament → v5, removed pepperfm/filament-json and lara-zeus/torch-filament, added torchlight/engine. Views: replaced JSON viewer with json-viewer.blade.php and updated snapshot display. Tests: added DB-only + tenant-isolation guard tests under Monitoring and OpsUx, plus Filament smoke tests. Specs: added/updated specs/057-filament-v5-upgrade/* (spec, tasks, plan, quickstart, research). Formatting: ran Pint; ran full test suite (641 passed, 5 skipped). Validation: Ran ./vendor/bin/sail artisan test (full suite) — all tests passed. Ran ./vendor/bin/sail pint --dirty — formatting applied. Ran npm run build locally (Vite) — assets generated. Notes / Rollback: Rollback: revert composer.json/composer.lock and build assets; documented in quickstart.md. One pending app migration was noted during validation; ensure migrations are applied in staging before deploy. Reviewers: @frontend, @backend (adjust as needed) Spec links: spec.md tasks.md quickstart.md Co-authored-by: Ahmed Darrazi <ahmeddarrazi@adsmac.local> Reviewed-on: #66
64 lines
1.8 KiB
PHP
64 lines
1.8 KiB
PHP
<?php
|
|
|
|
use App\Filament\Resources\OperationRunResource;
|
|
use App\Models\OperationRun;
|
|
use App\Models\Tenant;
|
|
|
|
it('scopes Monitoring → Operations list to the active tenant', function () {
|
|
$tenantA = Tenant::factory()->create();
|
|
$tenantB = Tenant::factory()->create();
|
|
|
|
[$user] = createUserWithTenant($tenantA, role: 'owner');
|
|
|
|
$user->tenants()->syncWithoutDetaching([
|
|
$tenantB->getKey() => ['role' => 'owner'],
|
|
]);
|
|
|
|
OperationRun::factory()->create([
|
|
'tenant_id' => $tenantA->getKey(),
|
|
'type' => 'policy.sync',
|
|
'status' => 'queued',
|
|
'outcome' => 'pending',
|
|
'initiator_name' => 'TenantA',
|
|
]);
|
|
|
|
OperationRun::factory()->create([
|
|
'tenant_id' => $tenantB->getKey(),
|
|
'type' => 'inventory.sync',
|
|
'status' => 'queued',
|
|
'outcome' => 'pending',
|
|
'initiator_name' => 'TenantB',
|
|
]);
|
|
|
|
$this->actingAs($user)
|
|
->get(OperationRunResource::getUrl('index', tenant: $tenantA))
|
|
->assertOk()
|
|
->assertSee('Policy sync')
|
|
->assertSee('TenantA')
|
|
->assertDontSee('Inventory sync')
|
|
->assertDontSee('TenantB');
|
|
});
|
|
|
|
it('prevents cross-tenant access to Monitoring → Operations detail', function () {
|
|
$tenantA = Tenant::factory()->create();
|
|
$tenantB = Tenant::factory()->create();
|
|
|
|
[$user] = createUserWithTenant($tenantA, role: 'owner');
|
|
|
|
$user->tenants()->syncWithoutDetaching([
|
|
$tenantB->getKey() => ['role' => 'owner'],
|
|
]);
|
|
|
|
$runB = OperationRun::factory()->create([
|
|
'tenant_id' => $tenantB->getKey(),
|
|
'type' => 'inventory.sync',
|
|
'status' => 'queued',
|
|
'outcome' => 'pending',
|
|
'initiator_name' => 'TenantB',
|
|
]);
|
|
|
|
$this->actingAs($user)
|
|
->get(OperationRunResource::getUrl('view', ['record' => $runB], tenant: $tenantA))
|
|
->assertNotFound();
|
|
});
|