ahmido/TenantAtlas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity
b53d7d53f3
TenantAtlas/docs/research/canonical-tenant-context-resolution.md
Ahmed Darrazi b53d7d53f3 feat: canonical tenant context resolution
2026-03-11 22:22:22 +01:00

3.4 KiB
Raw Blame History

Canonical Tenant Context Resolution

Canonical Rule

  • Tenant-panel and tenant-scoped flows keep panel-native tenant semantics through Filament::getTenant() / Tenant::current().
  • Workspace-admin and monitoring flows under /admin/... resolve the active tenant only through App\Support\OperateHub\OperateHubShell::activeEntitledTenant(Request).
  • When both admin sources exist and disagree, the entitled Filament tenant wins for the full request and remembered workspace tenant state remains fallback-only.
  • Tenant-owned Entra groups remain tenant-panel-primary navigation. The admin-panel route may stay available for direct links or global search, but it must not appear as a regular workspace-admin sidebar entry.

Explicit No-Context Outcomes

Surface No-context outcome
/admin/operations Render the workspace-scoped All tenants state, clear tenant-default filters, and hide tenant-only KPI cards.
/admin/operations/{run} Render only when workspace membership and run-tenant entitlement still pass; otherwise return 404.
Admin Entra group list and view Return 404 instead of widening scope.
Admin Entra group global search Return no tenant-owned results.

Approved Exceptions

  • /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/ChooseTenant.php Tenant chooser remains panel-native because it is the explicit tenant-selection surface.
  • /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Http/Controllers/SelectTenantController.php Explicit tenant selection persists remembered tenant state after a user choice.
  • /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Support/Middleware/EnsureFilamentTenantSelected.php Middleware is allowed to read and set Filament::getTenant() because it owns panel bootstrapping and route/query synchronization.
  • /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/EntraGroupResource.php Mixed-surface resource keeps one tenant-panel-native branch through Tenant::current() while admin panel logic delegates to OperateHubShell.

Residual Inventory

  • Compliant admin call sites: /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/Monitoring/Operations.php /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Widgets/Operations/OperationsKpiHeader.php /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/Operations/TenantlessOperationRunViewer.php /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/OperationRunResource.php /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/AlertDeliveryResource.php /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/Monitoring/AuditLog.php /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/EntraGroupResource.php
  • Tenant-panel-native call sites intentionally outside the admin guard: /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/InventoryCoverage.php /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/BaselineCompareLanding.php tenant-owned resources under /Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/ that are routed only through tenant context.
  • Deferred admin remediation: none in the Spec 135 operations, OperationRun, alert-delivery reference, or Entra-group admin surfaces after this iteration.