TenantAtlas/app/Support/Auth/Capabilities.php

<?php

namespace App\Support\Auth;

/**
 * Canonical Capability Registry
 *
 * This is the single source of truth for all capability strings in the system.
 * All role-to-capability mappings must reference only these constants.
 */
class Capabilities
{
    /**
     * @var array<string>|null
     */
    private static ?array $all = null;

    // Workspaces
    public const WORKSPACE_VIEW = 'workspace.view';

    public const WORKSPACE_MANAGE = 'workspace.manage';

    public const WORKSPACE_ARCHIVE = 'workspace.archive';

    // Workspace memberships
    public const WORKSPACE_MEMBERSHIP_VIEW = 'workspace_membership.view';

    public const WORKSPACE_MEMBERSHIP_MANAGE = 'workspace_membership.manage';

    // Managed tenant onboarding
    public const WORKSPACE_MANAGED_TENANT_ONBOARD = 'workspace_managed_tenant.onboard';

    public const WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY = 'workspace_managed_tenant.onboard.identify';

    public const WORKSPACE_MANAGED_TENANT_ONBOARD_CANCEL = 'workspace_managed_tenant.onboard.cancel';

    public const WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW = 'workspace_managed_tenant.onboard.connection.view';

    public const WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_MANAGE = 'workspace_managed_tenant.onboard.connection.manage';

    public const WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_MANAGE_DEDICATED = 'workspace_managed_tenant.onboard.connection.manage_dedicated';

    public const WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START = 'workspace_managed_tenant.onboard.verification.start';

    public const WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC = 'workspace_managed_tenant.onboard.bootstrap.inventory_sync';

    public const WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC = 'workspace_managed_tenant.onboard.bootstrap.policy_sync';

    public const WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP = 'workspace_managed_tenant.onboard.bootstrap.backup_bootstrap';

    public const WORKSPACE_MANAGED_TENANT_ONBOARD_ACTIVATE = 'workspace_managed_tenant.onboard.activate';

    // Workspace settings
    public const WORKSPACE_SETTINGS_VIEW = 'workspace_settings.view';

    public const WORKSPACE_SETTINGS_MANAGE = 'workspace_settings.manage';

    // Workspace alerts
    public const ALERTS_VIEW = 'workspace_alerts.view';

    public const ALERTS_MANAGE = 'workspace_alerts.manage';

    // Tenants
    public const TENANT_VIEW = 'tenant.view';

    public const TENANT_MANAGE = 'tenant.manage';

    public const TENANT_DELETE = 'tenant.delete';

    public const TENANT_SYNC = 'tenant.sync';

    // Inventory
    public const TENANT_INVENTORY_SYNC_RUN = 'tenant_inventory_sync.run';

    // Findings
    public const TENANT_FINDINGS_VIEW = 'tenant_findings.view';

    public const TENANT_FINDINGS_TRIAGE = 'tenant_findings.triage';

    public const TENANT_FINDINGS_ASSIGN = 'tenant_findings.assign';

    public const TENANT_FINDINGS_RESOLVE = 'tenant_findings.resolve';

    public const TENANT_FINDINGS_CLOSE = 'tenant_findings.close';

    public const TENANT_FINDINGS_RISK_ACCEPT = 'tenant_findings.risk_accept';

    public const TENANT_FINDINGS_ACKNOWLEDGE = 'tenant_findings.acknowledge';

    public const FINDING_EXCEPTION_VIEW = 'finding_exception.view';

    public const FINDING_EXCEPTION_MANAGE = 'finding_exception.manage';

    public const FINDING_EXCEPTION_APPROVE = 'finding_exception.approve';

    // Verification
    public const TENANT_VERIFICATION_ACKNOWLEDGE = 'tenant_verification.acknowledge';

    // Tenant memberships
    public const TENANT_MEMBERSHIP_VIEW = 'tenant_membership.view';

    public const TENANT_MEMBERSHIP_MANAGE = 'tenant_membership.manage';

    // Optional mappings (no Graph resolution in v1)
    public const TENANT_ROLE_MAPPING_VIEW = 'tenant_role_mapping.view';

    public const TENANT_ROLE_MAPPING_MANAGE = 'tenant_role_mapping.manage';

    // Backup schedules
    public const TENANT_BACKUP_SCHEDULES_MANAGE = 'tenant_backup_schedules.manage';

    public const TENANT_BACKUP_SCHEDULES_RUN = 'tenant_backup_schedules.run';

    // Providers (existing gate names used throughout the app)
    public const PROVIDER_VIEW = 'provider.view';

    public const PROVIDER_MANAGE = 'provider.manage';

    public const PROVIDER_MANAGE_DEDICATED = 'provider.manage_dedicated';

    public const PROVIDER_RUN = 'provider.run';

    // Workspace baselines (Golden Master governance)
    public const WORKSPACE_BASELINES_VIEW = 'workspace_baselines.view';

    public const WORKSPACE_BASELINES_MANAGE = 'workspace_baselines.manage';

    // Audit
    public const AUDIT_VIEW = 'audit.view';

    // Entra admin roles
    public const ENTRA_ROLES_VIEW = 'entra_roles.view';

    public const ENTRA_ROLES_MANAGE = 'entra_roles.manage';

    // Review packs
    public const REVIEW_PACK_VIEW = 'review_pack.view';

    public const REVIEW_PACK_MANAGE = 'review_pack.manage';

    // Evidence snapshots
    public const EVIDENCE_VIEW = 'evidence.view';

    public const EVIDENCE_MANAGE = 'evidence.manage';

    /**
     * Get all capability constants
     *
     * @return array<string>
     */
    public static function all(): array
    {
        if (self::$all !== null) {
            return self::$all;
        }

        $reflection = new \ReflectionClass(self::class);

        return self::$all = array_values($reflection->getConstants());
    }

    public static function isKnown(string $capability): bool
    {
        return in_array($capability, self::all(), true);
    }
}