TenantAtlas/apps/platform/tests/Feature/Filament/PanelNavigationSegregationTest.php

<?php

declare(strict_types=1);

use App\Filament\Clusters\Inventory\InventoryCluster;
use App\Filament\Pages\InventoryCoverage;
use App\Filament\Resources\BackupScheduleResource;
use App\Filament\Resources\BackupSetResource;
use App\Filament\Resources\BaselineProfileResource;
use App\Filament\Resources\BaselineSnapshotResource;
use App\Filament\Resources\EntraGroupResource;
use App\Filament\Resources\FindingResource;
use App\Filament\Resources\InventoryItemResource;
use App\Filament\Resources\PolicyResource;
use App\Filament\Resources\PolicyVersionResource;
use App\Filament\Resources\RestoreRunResource;
use App\Support\ManagedEnvironmentLinks;
use App\Support\Workspaces\WorkspaceContext;
use Filament\Facades\Filament;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Http\Request;

uses(RefreshDatabase::class);

afterEach(function (): void {
    Filament::setCurrentPanel(null);
});

dataset('environment visible navigation classes', [
    InventoryCluster::class,
    InventoryCoverage::class,
    InventoryItemResource::class,
    PolicyResource::class,
    PolicyVersionResource::class,
    EntraGroupResource::class,
    BackupScheduleResource::class,
    BackupSetResource::class,
    RestoreRunResource::class,
    FindingResource::class,
]);

function bindNavigationRequestPath(string $path): void
{
    $request = Request::create($path);
    $route = app('router')->getRoutes()->match($request);

    $request->setRouteResolver(static fn () => $route);

    app()->instance('request', $request);
}

it('hides environment-owned navigation classes on workspace surfaces', function (string $class): void {
    Filament::setCurrentPanel('admin');
    bindNavigationRequestPath('/admin/workspaces/workspace-alpha');

    expect($class::shouldRegisterNavigation())->toBeFalse();
})->with('environment visible navigation classes');

it('registers environment-owned surfaces only on environment surfaces', function (string $class): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');

    $this->actingAs($user);
    session()->put(WorkspaceContext::SESSION_KEY, (int) $tenant->workspace_id);

    Filament::setCurrentPanel('admin');
    bindNavigationRequestPath(ManagedEnvironmentLinks::viewUrl($tenant));

    expect($class::shouldRegisterNavigation())->toBeTrue();
})->with('environment visible navigation classes');

it('keeps retired tenant-panel entry routes unavailable', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get("/admin/t/{$tenant->external_id}")
        ->assertNotFound();

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get("/admin/tenants/{$tenant->external_id}")
        ->assertNotFound();
});

it('keeps baseline navigation route scoped and off retired tenant routes', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');

    Filament::setCurrentPanel('admin');
    bindNavigationRequestPath('/admin/workspaces/workspace-alpha');

    expect(BaselineProfileResource::shouldRegisterNavigation())->toBeFalse();
    expect(BaselineSnapshotResource::shouldRegisterNavigation())->toBeFalse();

    bindNavigationRequestPath('/admin/workspaces/workspace-alpha/environments/environment-alpha');

    expect(BaselineProfileResource::shouldRegisterNavigation())->toBeTrue();
    expect(BaselineSnapshotResource::shouldRegisterNavigation())->toBeTrue();

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get("/admin/t/{$tenant->external_id}/baseline-profiles")
        ->assertNotFound();

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get("/admin/t/{$tenant->external_id}/baseline-snapshots")
        ->assertNotFound();
});

it('keeps the workspace panel sidebar free of tenant-sensitive entries even with a remembered tenant', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');

    Filament::setTenant($tenant, true);

    $response = $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
            WorkspaceContext::LAST_TENANT_IDS_SESSION_KEY => [
                (string) $tenant->workspace_id => (int) $tenant->getKey(),
            ],
        ])
        ->get(route('admin.workspace.home', ['workspace' => $tenant->workspace_id]))
        ->assertOk();

    $response->assertSeeText('Overview');
    $response->assertSeeText('Operations');
    $response->assertSeeText('Alerts');
    $response->assertSeeText('Audit Log');
    $response->assertSeeText('Governance inbox');
    $response->assertSeeText('Customer reviews');
    $response->assertSeeText('Manage workspaces');
    $response->assertSeeText('Integrations');
    $response->assertSeeText('Settings');

    $response->assertDontSee('>Items</span>', false);
    $response->assertDontSee('>Policies</span>', false);
    $response->assertDontSee('>Policy Versions</span>', false);
    $response->assertDontSee('>Groups</span>', false);
    $response->assertDontSee('/entra-groups', false);
    $response->assertDontSee('>Backup Schedules</span>', false);
    $response->assertDontSee('>Backup Sets</span>', false);
    $response->assertDontSee('>Restore Runs</span>', false);
    $response->assertDontSee('>Findings</span>', false);
    $response->assertDontSee('>Baselines</span>', false);
    $response->assertDontSee('>Baseline Snapshots</span>', false);
    $response->assertDontSee('>Baseline Compare</span>', false);
    $response->assertDontSee('>Evidence</span>', false);
    $response->assertDontSee('>Risk exceptions</span>', false);
});

it('shows environment-owned sidebar entries on the canonical environment route', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');

    $response = $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get(ManagedEnvironmentLinks::viewUrl($tenant))
        ->assertOk();

    $response->assertSeeText('Policies');
    $response->assertSeeText('Policy Versions');
    $response->assertSeeText('Groups');
    $response->assertSee((string) parse_url(EntraGroupResource::getUrl(panel: 'admin', tenant: $tenant), PHP_URL_PATH), false);
    $response->assertDontSee('/admin/entra-groups', false);
    $response->assertSeeText('Items');
    $response->assertSeeText('Backup Schedules');
    $response->assertSeeText('Backup Sets');
    $response->assertSeeText('Restore Runs');
    $response->assertSeeText('Findings');
    $response->assertSeeText('Baselines');
    $response->assertSeeText('Baseline Snapshots');
    $response->assertSeeText('Baseline Compare');
    $response->assertSeeText('Evidence');
    $response->assertSeeText('Risk exceptions');

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get(InventoryItemResource::getUrl('index', panel: 'admin', tenant: $tenant))
        ->assertOk()
        ->assertSeeText('Coverage');
});