ahmido/TenantAtlas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity
a9f0ace9f4
TenantAtlas/specs/287-cutover-prerequisite-completion/quickstart.md
Ahmed Darrazi a9f0ace9f4
Some checks failed
PR Fast Feedback / fast-feedback (pull_request) Failing after 9m28s
Details
feat: complete spec 287 prerequisite cutover
2026-05-10 16:59:30 +02:00

5.1 KiB
Raw Blame History

Quickstart: Cutover Prerequisite Completion

Purpose

Use this guide to review or implement Feature 287 as the bounded runtime and test-harness completion slice that unblocks Spec 288.

Preconditions

  • The package stays limited to the five named prerequisite areas:
    • provider connection legacy route retirement
    • provider target scope core neutralization
    • environment scope role persistence cleanup
    • tenant panel test helper cutover
    • targeted validation for the changed seams
  • Spec 288 is treated as the follow-up package for quality gates and no-legacy enforcement.
  • The implementation does not add a global guard suite, a full-suite baseline, package execution, guided operations, UI copy cleanup, or provider capability expansion.
  • Filament remains v5 on Livewire v4 and provider registration remains in apps/platform/bootstrap/providers.php.

Read Order

  1. spec.md
  2. plan.md
  3. research.md
  4. data-model.md
  5. contracts/cutover-prerequisite-completion.logical.openapi.yaml
  6. tasks.md
  7. checklists/requirements.md

Implementation Intent

  • retire the remaining legacy provider-connection route family instead of guarding it
  • finish provider target-scope and identity neutralization on the shared provider-core seams
  • complete the cleanup that keeps workspace membership role-bearing and environment scope narrowing-only
  • replace tenant-panel-era test helpers with post-cutover admin or workspace helpers and update apps/platform/tests/Feature/Reviews/CustomerReviewWorkspaceLaunchLinksTest.php plus apps/platform/tests/Feature/Rbac/TriageReviewStateAuthorizationTest.php
  • keep validation targeted to the changed seams only and leave quality gates to Spec 288

Review Scenarios

Scenario 1: Canonical provider-connection routing is the only runtime path

  • open canonical provider-connection paths and the launch-point inventory in apps/platform/app/Providers/Filament/AdminPanelProvider.php, apps/platform/app/Filament/Resources/TenantResource.php, apps/platform/app/Filament/Pages/TenantRequiredPermissions.php, apps/platform/app/Support/OperationRunLinks.php, apps/platform/app/Support/Providers/ProviderReasonTranslator.php, and apps/platform/app/Support/Verification/VerificationLinkBehavior.php
  • confirm they resolve through /admin/provider-connections...
  • confirm the retired legacy alias family no longer acts as accepted runtime fallback

Scenario 2: Shared provider target-scope truth is neutral

  • exercise the target-scope descriptor, provider identity resolution path, and provider-backed run or start context
  • confirm the shared contract no longer depends on Microsoft-only keys such as entra_tenant_id, tenantContext, or target_scope.entra_tenant_id
  • confirm provider-owned Microsoft detail remains nested where current consent or diagnostics still need it

Scenario 3: Workspace membership remains the only role-bearing truth

  • create workspace membership plus managed-environment access-scope combinations
  • confirm workspace membership still owns role authority
  • confirm environment scope only narrows visibility and does not behave like a second role matrix

Scenario 4: The shared test harness no longer boots the retired tenant panel

  • replace setTenantPanelContext() on the shared helper path, apps/platform/tests/Feature/Reviews/CustomerReviewWorkspaceLaunchLinksTest.php, and apps/platform/tests/Feature/Rbac/TriageReviewStateAuthorizationTest.php
  • rerun the targeted seam tests and browser validation
  • confirm the changed seams no longer require tenant-panel-only test state

Planned Validation Commands

export PATH="/bin:/usr/bin:/usr/local/bin:$PATH" && REPO_ROOT="$(git rev-parse --show-toplevel)" && (cd "$REPO_ROOT/apps/platform" && ./vendor/bin/sail artisan test --compact tests/Feature/ProviderConnections/LegacyRedirectTest.php tests/Feature/ProviderConnections/TenantlessListRouteTest.php tests/Feature/ProviderConnections/TenantlessListScopingTest.php tests/Feature/Auth/WorkspaceFirstManagedEnvironmentAccessTest.php tests/Feature/Rbac/ProviderConnectionWorkspaceFirstPolicyTest.php tests/Feature/Reviews/CustomerReviewWorkspaceLaunchLinksTest.php tests/Feature/Rbac/TriageReviewStateAuthorizationTest.php)

export PATH="/bin:/usr/bin:/usr/local/bin:$PATH" && REPO_ROOT="$(git rev-parse --show-toplevel)" && (cd "$REPO_ROOT/apps/platform" && ./vendor/bin/sail artisan test --compact tests/Browser/Spec281ProviderConnectionScopeSmokeTest.php tests/Browser/Spec285WorkspaceRbacEnvironmentAccessSmokeTest.php)

export PATH="/bin:/usr/bin:/usr/local/bin:$PATH" && REPO_ROOT="$(git rev-parse --show-toplevel)" && (cd "$REPO_ROOT/apps/platform" && ./vendor/bin/sail bin pint --dirty --format agent)

Explicit Stop Conditions

  • If implementation starts adding no-legacy guard families or quality gates, stop and move that work to Spec 288.
  • If implementation starts requiring a full-suite baseline to prove the slice, stop and narrow the seam inventory.
  • If implementation widens into UI copy cleanup, package execution, guided operations, or provider capability expansion, stop and split the extra work out of 287.