TenantAtlas/tests/Feature/TenantRBAC/TenantSwitcherScopeTest.php

126 lines
4.2 KiB
PHP

<?php
declare(strict_types=1);
use App\Filament\Pages\ChooseTenant;
use App\Filament\Resources\TenantResource;
use App\Models\Tenant;
use App\Models\User;
use App\Support\Workspaces\WorkspaceContext;
use Filament\Facades\Filament;
use Filament\PanelRegistry;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Livewire\Livewire;
uses(RefreshDatabase::class);
it('only returns active membership tenants for normal users', function (): void {
$user = User::factory()->create();
$allowed = Tenant::factory()->active()->create(['name' => 'Allowed']);
$onboarding = Tenant::factory()->onboarding()->create([
'workspace_id' => (int) $allowed->workspace_id,
'name' => 'Onboarding',
]);
$archived = Tenant::factory()->archived()->create([
'workspace_id' => (int) $allowed->workspace_id,
'name' => 'Archived',
]);
$user->tenants()->syncWithoutDetaching([
$allowed->getKey() => ['role' => 'readonly'],
$onboarding->getKey() => ['role' => 'readonly'],
$archived->getKey() => ['role' => 'readonly'],
]);
/** @var \Filament\Panel $panel */
$panel = app(PanelRegistry::class)->get('admin');
$tenants = $user->getTenants($panel);
expect($tenants)->toHaveCount(1);
expect($tenants->first()?->getKey())->toBe($allowed->getKey());
expect($tenants->contains(fn (Tenant $tenant): bool => $tenant->name === 'Onboarding'))->toBeFalse();
expect($tenants->contains(fn (Tenant $tenant): bool => $tenant->name === 'Archived'))->toBeFalse();
});
it('returns no tenants for users without active tenant memberships', function (): void {
$user = User::factory()->create();
$draft = Tenant::factory()->draft()->create(['name' => 'Draft']);
$archived = Tenant::factory()->archived()->create([
'workspace_id' => (int) $draft->workspace_id,
'name' => 'Archived',
]);
$user->tenants()->syncWithoutDetaching([
$draft->getKey() => ['role' => 'readonly'],
$archived->getKey() => ['role' => 'readonly'],
]);
/** @var \Filament\Panel $panel */
$panel = app(PanelRegistry::class)->get('admin');
expect($user->getTenants($panel))->toHaveCount(0);
});
it('rejects selecting non-active memberships as tenant context', function (): void {
$user = User::factory()->create();
$active = Tenant::factory()->active()->create(['name' => 'Allowed']);
$onboarding = Tenant::factory()->onboarding()->create([
'workspace_id' => (int) $active->workspace_id,
'name' => 'Onboarding',
]);
$archived = Tenant::factory()->archived()->create([
'workspace_id' => (int) $active->workspace_id,
'name' => 'Archived',
]);
$user->tenants()->syncWithoutDetaching([
$active->getKey() => ['role' => 'readonly'],
$onboarding->getKey() => ['role' => 'readonly'],
$archived->getKey() => ['role' => 'readonly'],
]);
Livewire::actingAs($user)
->test(ChooseTenant::class)
->call('selectTenant', $onboarding->getKey())
->assertStatus(404);
Livewire::actingAs($user)
->test(ChooseTenant::class)
->call('selectTenant', $archived->getKey())
->assertStatus(404);
});
it('returns no tenant global-search results when the user lacks any active tenant membership', function (): void {
$user = User::factory()->create();
$draft = Tenant::factory()->draft()->create(['name' => 'Search Draft']);
$onboarding = Tenant::factory()->onboarding()->create([
'workspace_id' => (int) $draft->workspace_id,
'name' => 'Search Onboarding',
]);
$archived = Tenant::factory()->archived()->create([
'workspace_id' => (int) $draft->workspace_id,
'name' => 'Search Archived',
]);
$user->tenants()->syncWithoutDetaching([
$draft->getKey() => ['role' => 'readonly'],
$onboarding->getKey() => ['role' => 'readonly'],
$archived->getKey() => ['role' => 'readonly'],
]);
$this->actingAs($user);
Filament::setCurrentPanel('admin');
Filament::setTenant(null, true);
Filament::bootCurrentPanel();
session()->put(WorkspaceContext::SESSION_KEY, (int) $draft->workspace_id);
expect(TenantResource::getGlobalSearchResults('Search'))->toHaveCount(0);
});