TenantAtlas/tests/Feature/Guards/AdminTenantResolverGuardTest.php

<?php

declare(strict_types=1);

function adminTenantResolverGuardedFiles(): array
{
    return [
        'app/Filament/Pages/Monitoring/Operations.php',
        'app/Filament/Pages/Operations/TenantlessOperationRunViewer.php',
        'app/Filament/Widgets/Operations/OperationsKpiHeader.php',
        'app/Filament/Resources/OperationRunResource.php',
        'app/Filament/Resources/AlertDeliveryResource.php',
        'app/Filament/Resources/AlertDeliveryResource/Pages/ListAlertDeliveries.php',
        'app/Filament/Resources/EntraGroupResource/Pages/ListEntraGroups.php',
        'app/Filament/Resources/EntraGroupResource/Pages/ViewEntraGroup.php',
    ];
}

function adminTenantResolverExceptionFiles(): array
{
    return [
        'app/Filament/Pages/ChooseTenant.php',
        'app/Http/Controllers/SelectTenantController.php',
        'app/Support/Middleware/EnsureFilamentTenantSelected.php',
        'app/Filament/Resources/EntraGroupResource.php',
    ];
}

it('keeps raw panel-native tenant reads out of canonical admin resolver surfaces', function (): void {
    $forbiddenPatterns = [
        '/\bFilament::getTenant\s*\(/',
        '/\bTenant::current\s*\(/',
    ];

    $violations = [];

    foreach (adminTenantResolverGuardedFiles() as $relativePath) {
        $contents = file_get_contents(base_path($relativePath));

        expect($contents)->not->toBeFalse();

        foreach ($forbiddenPatterns as $pattern) {
            if (preg_match($pattern, (string) $contents) === 1) {
                $violations[] = $relativePath;

                break;
            }
        }
    }

    expect($violations)
        ->toBeEmpty('Canonical admin surfaces must delegate tenant resolution to OperateHubShell. Offenders: '.implode(', ', $violations));
});

it('documents the approved panel-native exception inventory', function (): void {
    $notes = file_get_contents(base_path('docs/research/canonical-tenant-context-resolution.md'));

    expect($notes)->not->toBeFalse();

    foreach (adminTenantResolverExceptionFiles() as $relativePath) {
        expect($notes)->toContain($relativePath);
    }
});

it('keeps the mixed-surface entra group resource explicit about admin and tenant-panel resolution', function (): void {
    $contents = file_get_contents(base_path('app/Filament/Resources/EntraGroupResource.php'));

    expect($contents)->not->toBeFalse()
        ->and($contents)->toContain('activeEntitledTenant(request())')
        ->and($contents)->toContain('Tenant::current()');
});