ahmido
292d555eac
## Summary - consolidate internal platform naming from `Tenant` to `Environment` / `ManagedEnvironment` across models, controllers, services, and Filament resources - rename environment-scoped UI surfaces such as dashboards, chooser flows, navigation, and related widgets to match the updated environment-first domain language - align middleware, onboarding/review lifecycle services, jobs, and route/context controllers with the new environment-scoped architecture ## Validation - not rerun as part of this commit/push/PR request ## Notes - branch is 1 commit ahead of `platform-dev` - main commit: `refactor: consolidate internal tenant model naming` Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #355
117 lines
4.7 KiB
PHP
117 lines
4.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\EvidenceSnapshot;
|
|
use App\Models\Finding;
|
|
use App\Models\ManagedEnvironment;
|
|
use App\Models\ManagedEnvironmentMembership;
|
|
use App\Models\ReviewPack;
|
|
use App\Models\EnvironmentReview;
|
|
use App\Models\User;
|
|
use App\Models\Workspace;
|
|
use App\Models\WorkspaceMembership;
|
|
use App\Services\Auth\ManagedEnvironmentAccessScopeResolver;
|
|
use App\Support\Evidence\EvidenceCompletenessState;
|
|
use App\Support\Evidence\EvidenceSnapshotStatus;
|
|
use Illuminate\Support\Facades\Gate;
|
|
|
|
it('authorizes governance artifacts from workspace role without environment membership rows', function (): void {
|
|
$workspace = Workspace::factory()->create();
|
|
$tenant = ManagedEnvironment::factory()->active()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
]);
|
|
$user = User::factory()->create();
|
|
|
|
WorkspaceMembership::factory()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'user_id' => (int) $user->getKey(),
|
|
'role' => 'owner',
|
|
]);
|
|
|
|
$tenant->makeCurrent();
|
|
|
|
$finding = Finding::factory()->for($tenant)->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
]);
|
|
$snapshot = spec285EvidenceSnapshot($tenant);
|
|
$reviewPack = ReviewPack::factory()->ready()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'managed_environment_id' => (int) $tenant->getKey(),
|
|
'evidence_snapshot_id' => (int) $snapshot->getKey(),
|
|
'initiated_by_user_id' => (int) $user->getKey(),
|
|
]);
|
|
$environmentReview = EnvironmentReview::factory()->ready()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'managed_environment_id' => (int) $tenant->getKey(),
|
|
'evidence_snapshot_id' => (int) $snapshot->getKey(),
|
|
'initiated_by_user_id' => (int) $user->getKey(),
|
|
]);
|
|
|
|
expect(Gate::forUser($user)->allows('view', $finding))->toBeTrue()
|
|
->and(Gate::forUser($user)->allows('view', $snapshot))->toBeTrue()
|
|
->and(Gate::forUser($user)->allows('view', $reviewPack))->toBeTrue()
|
|
->and(Gate::forUser($user)->allows('view', $environmentReview))->toBeTrue();
|
|
});
|
|
|
|
it('denies out-of-scope governance artifacts as not found before capability checks', function (): void {
|
|
$workspace = Workspace::factory()->create();
|
|
$allowedTenant = ManagedEnvironment::factory()->active()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
]);
|
|
$deniedTenant = ManagedEnvironment::factory()->active()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
]);
|
|
$user = User::factory()->create();
|
|
|
|
WorkspaceMembership::factory()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'user_id' => (int) $user->getKey(),
|
|
'role' => 'owner',
|
|
]);
|
|
ManagedEnvironmentMembership::query()->create([
|
|
'managed_environment_id' => (int) $allowedTenant->getKey(),
|
|
'user_id' => (int) $user->getKey(),
|
|
'role' => 'owner',
|
|
'source' => 'manual',
|
|
]);
|
|
app(ManagedEnvironmentAccessScopeResolver::class)->clearCache();
|
|
|
|
$deniedTenant->makeCurrent();
|
|
|
|
$finding = Finding::factory()->for($deniedTenant)->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
]);
|
|
$snapshot = spec285EvidenceSnapshot($deniedTenant);
|
|
$reviewPack = ReviewPack::factory()->ready()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'managed_environment_id' => (int) $deniedTenant->getKey(),
|
|
'evidence_snapshot_id' => (int) $snapshot->getKey(),
|
|
'initiated_by_user_id' => (int) $user->getKey(),
|
|
]);
|
|
$environmentReview = EnvironmentReview::factory()->ready()->create([
|
|
'workspace_id' => (int) $workspace->getKey(),
|
|
'managed_environment_id' => (int) $deniedTenant->getKey(),
|
|
'evidence_snapshot_id' => (int) $snapshot->getKey(),
|
|
'initiated_by_user_id' => (int) $user->getKey(),
|
|
]);
|
|
|
|
expect(Gate::forUser($user)->inspect('view', $finding)->status())->toBe(404)
|
|
->and(Gate::forUser($user)->inspect('view', $snapshot)->status())->toBe(404)
|
|
->and(Gate::forUser($user)->inspect('view', $reviewPack)->status())->toBe(404)
|
|
->and(Gate::forUser($user)->inspect('view', $environmentReview)->status())->toBe(404);
|
|
});
|
|
|
|
function spec285EvidenceSnapshot(ManagedEnvironment $tenant): EvidenceSnapshot
|
|
{
|
|
return EvidenceSnapshot::query()->create([
|
|
'managed_environment_id' => (int) $tenant->getKey(),
|
|
'workspace_id' => (int) $tenant->workspace_id,
|
|
'status' => EvidenceSnapshotStatus::Active->value,
|
|
'completeness_state' => EvidenceCompletenessState::Complete->value,
|
|
'summary' => [],
|
|
'fingerprint' => hash('sha256', 'spec-285-'.$tenant->getKey().'-'.microtime()),
|
|
'generated_at' => now(),
|
|
]);
|
|
}
|