Quickstart: Tenant-Owned Query Canon and Wrong-Tenant Guards

Goal

Implement a reusable tenant-owned query contract that keeps list, detail, search, relation-manager, and protected action paths aligned to the same tenant boundary.

Suggested Implementation Order

Identify the first-slice family inventory from TenantOwnedTables and map each family to its primary Filament surface.
Introduce the shared tenant-owned query and explicit record-resolution helper(s) for representative families.
Migrate representative resources to the shared helper, starting with EntraGroupResource, PolicyResource, PolicyVersionResource, BackupScheduleResource, BackupSetResource, RestoreRunResource, FindingResource, and InventoryItemResource.
Update relation managers in the first slice so their action targets prove owner-record and tenant congruence.
Align global search posture per family: keep it scoped where parity exists, disable it deliberately where parity still does not exist.
Add the wrong-tenant regression matrix and the lightweight architectural guard.

Expected Code Areas

app/Filament/Concerns/
app/Filament/Resources/
app/Policies/
app/Support/WorkspaceIsolation/
routes/web.php
tests/Feature/Filament/
tests/Feature/Rbac/
tests/Feature/Guards/

Verification Flow

Run the minimum relevant checks through Sail:

vendor/bin/sail artisan test --compact tests/Feature/Filament/EntraGroupAdminScopeTest.php
vendor/bin/sail artisan test --compact tests/Feature/BackupScheduling/BackupScheduleAdminTenantParityTest.php
vendor/bin/sail artisan test --compact tests/Feature/Guards/AdminTenantResolverGuardTest.php
vendor/bin/sail artisan test --compact tests/Feature/Guards/NoAdHocFilamentAuthPatternsTest.php
vendor/bin/sail artisan test --compact tests/Feature/Rbac
vendor/bin/sail bin pint --dirty --format agent

Completion Criteria

Representative tenant-owned families share one canonical query and lookup pattern.
Wrong-tenant index, detail, relation-manager, and protected action regressions are covered.
Global search is either safely scoped or explicitly disabled per family.
Guard coverage prevents new forbidden query patterns on covered surfaces.

2.2 KiB Raw Blame History