TenantAtlas/tests/Feature/Rbac/BackupItemsRelationManagerUiEnforcementTest.php

<?php

declare(strict_types=1);

use App\Filament\Resources\BackupSetResource\Pages\EditBackupSet;
use App\Filament\Resources\BackupSetResource\RelationManagers\BackupItemsRelationManager;
use App\Models\BackupItem;
use App\Models\BackupSet;
use Filament\Actions\Action;
use Filament\Facades\Filament;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Livewire\Livewire;

uses(RefreshDatabase::class);

describe('Backup items relation manager UI enforcement', function () {
    it('shows add policies as visible but disabled for readonly members', function (): void {
        [$user, $tenant] = createUserWithTenant(role: 'readonly');

        $this->actingAs($user);
        $tenant->makeCurrent();
        Filament::setTenant($tenant, true);

        $backupSet = BackupSet::factory()->create([
            'tenant_id' => $tenant->id,
            'name' => 'Test backup',
        ]);

        $item = BackupItem::factory()->for($backupSet)->for($tenant)->create();

        Livewire::test(BackupItemsRelationManager::class, [
            'ownerRecord' => $backupSet,
            'pageClass' => EditBackupSet::class,
        ])
            ->assertTableActionVisible('addPolicies')
            ->assertTableActionDisabled('addPolicies')
            ->assertTableActionExists('addPolicies', function (Action $action): bool {
                return $action->getTooltip() === 'You do not have permission to add policies.';
            })
            ->assertTableBulkActionVisible('bulk_remove')
            ->assertTableBulkActionDisabled('bulk_remove', [$item]);
    });

    it('shows add policies as enabled for owner members', function (): void {
        [$user, $tenant] = createUserWithTenant(role: 'owner');

        $this->actingAs($user);
        $tenant->makeCurrent();
        Filament::setTenant($tenant, true);

        $backupSet = BackupSet::factory()->create([
            'tenant_id' => $tenant->id,
            'name' => 'Test backup',
        ]);

        $item = BackupItem::factory()->for($backupSet)->for($tenant)->create();

        Livewire::test(BackupItemsRelationManager::class, [
            'ownerRecord' => $backupSet,
            'pageClass' => EditBackupSet::class,
        ])
            ->assertTableActionVisible('addPolicies')
            ->assertTableActionEnabled('addPolicies')
            ->assertTableBulkActionVisible('bulk_remove')
            ->assertTableBulkActionEnabled('bulk_remove', [$item]);
    });

    it('hides actions after membership is revoked mid-session', function (): void {
        [$user, $tenant] = createUserWithTenant(role: 'owner');

        $this->actingAs($user);
        $tenant->makeCurrent();
        Filament::setTenant($tenant, true);

        $backupSet = BackupSet::factory()->create([
            'tenant_id' => $tenant->id,
            'name' => 'Test backup',
        ]);

        BackupItem::factory()->for($backupSet)->for($tenant)->create();

        $component = Livewire::test(BackupItemsRelationManager::class, [
            'ownerRecord' => $backupSet,
            'pageClass' => EditBackupSet::class,
        ])
            ->assertTableActionVisible('addPolicies')
            ->assertTableActionEnabled('addPolicies')
            ->assertTableBulkActionVisible('bulk_remove');

        $user->tenants()->detach($tenant->getKey());
        app(\App\Services\Auth\CapabilityResolver::class)->clearCache();

        $component
            ->call('$refresh')
            ->assertTableActionHidden('addPolicies')
            ->assertTableBulkActionHidden('bulk_remove');
    });
});