ahmido/TenantAtlas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity
a989ef1a23
TenantAtlas/specs/072-managed-tenants-workspace-enforcement/plan.md
ahmido a989ef1a23 feat: workspace context enforcement (specs 070–072) (#85) 
Implements specs 070–072 (workspace foundation, workspace-scoped tenant selection, managed-tenants workspace enforcement).

Highlights
- Adds Workspace + WorkspaceMembership models/migrations + middleware to persist/enforce current workspace context.
- Scopes tenant selection to the current workspace.
- Makes legacy `/admin/managed-tenants*` routes redirect into workspace-scoped URLs.
- Enforces tenant routes under `/admin/t/{tenant}` to 404 when workspace context is missing or mismatched.
- Fixes Filament page Blade wrappers so header actions render on choose-workspace / choose-tenant / no-access pages.

Verification
- Pint: `vendor/bin/sail bin pint --dirty`
- Tests: `vendor/bin/sail artisan test --compact tests/Feature/Guards/NoAdHocFilamentAuthPatternsTest.php tests/Feature/Workspaces tests/Feature/Filament/ChooseTenantIsWorkspaceScopedTest.php tests/Feature/Filament/ChooseTenantRequiresWorkspaceTest.php tests/Feature/Filament/TenantSwitcherUrlResolvesTenantTest.php tests/Feature/ManagedTenants tests/Feature/AdminNewRedirectTest.php`

Notes
- Filament v5 / Livewire v4 compatible.
- Panel provider registration stays in `bootstrap/providers.php` (Laravel 11+ rule).
- No new heavy frontend assets added.

Co-authored-by: Ahmed Darrazi <ahmeddarrazi@MacBookPro.fritz.box>
Reviewed-on: #85
2026-02-02 10:07:41 +00:00

1.6 KiB
Raw Blame History

Plan — 072 Managed Tenants workspace context enforcement

Tech

  • Laravel 12
  • Filament v5 + Livewire v4
  • Pest v4

Approach

  1. Treat /admin/w/{workspace}/... as the portfolio / workspace entry space.
  2. Move Managed Tenants list/onboarding UX to workspace-scoped routes.
  3. Make /admin/managed-tenants/* legacy-only (redirect to the correct workspace-scoped URL).
  4. Enforce workspace/tenant consistency for all /admin/t/{tenant} routes (deny-as-not-found on mismatch).

Key decisions

  • Workspace is not Filament tenancy; it remains session + middleware.
  • Hard enforcement is implemented in middleware that runs on tenant-scoped routes.
  • Prefer redirects over removing routes immediately, to avoid breaking deep links, but ensure they are no longer primary UX.

Files (expected)

  • routes/web.php
  • app/Providers/Filament/AdminPanelProvider.php
  • app/Http/Middleware/EnsureWorkspaceSelected.php
  • app/Support/Middleware/DenyNonMemberTenantAccess.php (or EnsureFilamentTenantSelected.php, depending on existing enforcement location)
  • app/Filament/Pages/ManagedTenants/* (legacy redirects / removal)
  • New/updated workspace landing page under app/Filament/Pages/Workspaces/* (or equivalent)
  • Pest tests in tests/Feature/Routing/ or tests/Feature/Filament/

Test plan

  • Feature test: /admin/managed-tenants redirects to /admin/w/{workspace}/managed-tenants when workspace is selected.
  • Feature test: /admin/t/{tenant} returns 404 when workspace context missing.
  • Feature test: /admin/t/{tenant} returns 404 when tenant.workspace_id != current workspace.
  • Optional: workspace landing lists only workspace tenants.