TenantAtlas/apps/platform/tests/Feature/Filament/TenantPortfolioContextSwitchTest.php

<?php

use App\Filament\Resources\TenantResource\Pages\ListTenants;
use App\Jobs\BulkTenantSyncJob;
use App\Models\ManagedEnvironment;
use App\Support\Auth\UiTooltips;
use Filament\Events\TenantSet;
use Filament\Facades\Filament;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Bus;
use Illuminate\Support\Facades\Http;
use Livewire\Livewire;

uses(RefreshDatabase::class);

beforeEach(function (): void {
    Http::preventStrayRequests();
});

test('tenant-scoped pages return 404 for unauthorized tenant', function () {
    [$user, $authorizedTenant] = createUserWithTenant();
    $unauthorizedTenant = ManagedEnvironment::factory()->create();

    $this->actingAs($user)
        ->get(route('filament.tenant.resources.policies.index', filamentTenantRouteParams($unauthorizedTenant)))
        ->assertNotFound();
});

test('tenant portfolio tenant view returns 404 for non-member tenant record', function () {
    $authorizedTenant = ManagedEnvironment::factory()->create(['managed_environment_id' => 'tenant-portfolio-authorized-view']);
    $unauthorizedTenant = ManagedEnvironment::factory()->create(['managed_environment_id' => 'tenant-portfolio-unauthorized-view']);

    [$user, $authorizedTenant] = createUserWithTenant($authorizedTenant, role: 'owner');
    $this->actingAs($user);

    $this->get(route('filament.admin.resources.tenants.view', array_merge(
        filamentTenantRouteParams($unauthorizedTenant),
        ['record' => $unauthorizedTenant],
    )))->assertNotFound();
});

test('tenant portfolio tenant edit returns 404 for non-member tenant record', function () {
    $authorizedTenant = ManagedEnvironment::factory()->create(['managed_environment_id' => 'tenant-portfolio-authorized-edit']);
    $unauthorizedTenant = ManagedEnvironment::factory()->create(['managed_environment_id' => 'tenant-portfolio-unauthorized-edit']);

    [$user, $authorizedTenant] = createUserWithTenant($authorizedTenant, role: 'owner');
    $this->actingAs($user);

    $this->get(route('filament.admin.resources.tenants.edit', array_merge(
        filamentTenantRouteParams($unauthorizedTenant),
        ['record' => $unauthorizedTenant],
    )))->assertNotFound();
});

test('tenant portfolio lists only tenants the user can access', function () {
    $authorizedTenant = ManagedEnvironment::factory()->create([
        'managed_environment_id' => 'tenant-portfolio-authorized',
        'name' => 'Authorized ManagedEnvironment',
    ]);

    $unauthorizedTenant = ManagedEnvironment::factory()->create([
        'managed_environment_id' => 'tenant-portfolio-unauthorized',
        'name' => 'Unauthorized ManagedEnvironment',
    ]);

    [$user, $authorizedTenant] = createUserWithTenant($authorizedTenant, role: 'owner');
    $this->actingAs($user);

    $this->get(route('filament.admin.resources.tenants.index', filamentTenantRouteParams($authorizedTenant)))
        ->assertOk()
        ->assertSee($authorizedTenant->name)
        ->assertDontSee($unauthorizedTenant->name);
});

test('tenant portfolio bulk sync dispatches one job per eligible tenant', function () {
    Bus::fake();

    $tenantA = ManagedEnvironment::factory()->create(['managed_environment_id' => 'tenant-bulk-a']);
    [$user, $tenantA] = createUserWithTenant($tenantA, role: 'owner');
    $this->actingAs($user);

    $tenantB = ManagedEnvironment::factory()->create([
        'managed_environment_id' => 'tenant-bulk-b',
        'workspace_id' => (int) $tenantA->workspace_id,
    ]);

    $user->tenants()->syncWithoutDetaching([
        $tenantB->getKey() => ['role' => 'operator'],
    ]);

    Filament::setTenant($tenantA, true);

    Livewire::test(ListTenants::class)
        ->assertTableBulkActionVisible('syncSelected')
        ->callTableBulkAction('syncSelected', collect([$tenantA, $tenantB]));

    Bus::assertDispatchedTimes(BulkTenantSyncJob::class, 1);

    $this->assertDatabaseHas('operation_runs', [
        'managed_environment_id' => $tenantA->id,
        'user_id' => $user->id,
        'type' => 'tenant.sync',
        'status' => 'queued',
    ]);
});

test('tenant portfolio bulk sync is disabled for readonly users', function () {
    Bus::fake();

    $tenant = ManagedEnvironment::factory()->create(['managed_environment_id' => 'tenant-bulk-readonly']);
    [$user, $tenant] = createUserWithTenant($tenant, role: 'readonly');
    $this->actingAs($user);

    Filament::setTenant($tenant, true);

    $livewire = Livewire::actingAs($user)
        ->test(ListTenants::class)
        ->selectTableRecords([$tenant])
        ->assertTableBulkActionVisible('syncSelected')
        ->assertTableBulkActionDisabled('syncSelected');

    $actions = $livewire->parseNestedTableBulkActions('syncSelected');
    $livewire->assertActionExists($actions, fn ($action): bool => $action->getTooltip() === UiTooltips::insufficientPermission());

    $livewire->callTableBulkAction('syncSelected', collect([$tenant]));

    Bus::assertNotDispatched(BulkTenantSyncJob::class);
});

test('tenant portfolio bulk sync is disabled when selection includes unauthorized tenants', function () {
    Bus::fake();

    $tenantA = ManagedEnvironment::factory()->create(['managed_environment_id' => 'tenant-bulk-mixed-a']);
    [$user, $tenantA] = createUserWithTenant($tenantA, role: 'owner');
    $this->actingAs($user);

    $tenantB = ManagedEnvironment::factory()->create([
        'managed_environment_id' => 'tenant-bulk-mixed-b',
        'workspace_id' => (int) $tenantA->workspace_id,
    ]);

    $user->tenants()->syncWithoutDetaching([
        $tenantB->getKey() => ['role' => 'readonly'],
    ]);

    Filament::setTenant($tenantA, true);

    $livewire = Livewire::actingAs($user)
        ->test(ListTenants::class)
        ->selectTableRecords([$tenantA, $tenantB])
        ->assertTableBulkActionVisible('syncSelected')
        ->assertTableBulkActionDisabled('syncSelected');

    $actions = $livewire->parseNestedTableBulkActions('syncSelected');
    $livewire->assertActionExists($actions, fn ($action): bool => $action->getTooltip() === UiTooltips::insufficientPermission());

    $livewire->callTableBulkAction('syncSelected', collect([$tenantA, $tenantB]));

    Bus::assertNotDispatched(BulkTenantSyncJob::class);
});

test('tenant set event updates user tenant preference last used timestamp', function () {
    [$user, $tenant] = createUserWithTenant();

    TenantSet::dispatch($tenant, $user);

    $this->assertDatabaseHas('user_managed_environment_preferences', [
        'user_id' => $user->id,
        'managed_environment_id' => $tenant->id,
    ]);
});