TenantAtlas/apps/platform/app/Support/Concerns/DerivesWorkspaceIdFromTenant.php

<?php

declare(strict_types=1);

namespace App\Support\Concerns;

use App\Models\Tenant;
use App\Support\WorkspaceIsolation\WorkspaceIsolationViolation;
use Illuminate\Database\Eloquent\Model;

trait DerivesWorkspaceIdFromTenant
{
    public static function bootDerivesWorkspaceIdFromTenant(): void
    {
        static::creating(static function (Model $model): void {
            self::enforceWorkspaceBinding($model);
        });

        static::updating(static function (Model $model): void {
            self::enforceWorkspaceBinding($model);
        });
    }

    private static function enforceWorkspaceBinding(Model $model): void
    {
        $tenantId = self::resolveTenantId($model);

        self::ensureTenantIdIsImmutable($model, $tenantId);

        $tenantWorkspaceId = self::resolveTenantWorkspaceId($model, $tenantId);

        $workspaceId = $model->getAttribute('workspace_id');

        if ($workspaceId === null || $workspaceId === '') {
            $model->setAttribute('workspace_id', $tenantWorkspaceId);

            return;
        }

        if (! is_numeric($workspaceId)) {
            throw WorkspaceIsolationViolation::workspaceMismatch(
                class_basename($model),
                $tenantId,
                $tenantWorkspaceId,
                0,
            );
        }

        $workspaceId = (int) $workspaceId;

        if ($workspaceId !== $tenantWorkspaceId) {
            throw WorkspaceIsolationViolation::workspaceMismatch(
                class_basename($model),
                $tenantId,
                $tenantWorkspaceId,
                $workspaceId,
            );
        }
    }

    private static function resolveTenantId(Model $model): int
    {
        $tenantId = $model->getAttribute('tenant_id');

        if (! is_numeric($tenantId)) {
            throw WorkspaceIsolationViolation::missingTenantId(class_basename($model));
        }

        return (int) $tenantId;
    }

    private static function ensureTenantIdIsImmutable(Model $model, int $tenantId): void
    {
        if (! $model->exists || ! $model->isDirty('tenant_id')) {
            return;
        }

        $originalTenantId = $model->getOriginal('tenant_id');

        if (! is_numeric($originalTenantId)) {
            return;
        }

        $originalTenantId = (int) $originalTenantId;

        if ($originalTenantId === $tenantId) {
            return;
        }

        throw WorkspaceIsolationViolation::tenantImmutable(
            class_basename($model),
            $originalTenantId,
            $tenantId,
        );
    }

    private static function resolveTenantWorkspaceId(Model $model, int $tenantId): int
    {
        $tenant = $model->relationLoaded('tenant') ? $model->getRelation('tenant') : null;

        if (! $tenant instanceof Tenant || (int) $tenant->getKey() !== $tenantId) {
            $tenant = Tenant::query()->find($tenantId);
        }

        if (! $tenant instanceof Tenant) {
            throw WorkspaceIsolationViolation::tenantNotFound(class_basename($model), $tenantId);
        }

        if (! is_numeric($tenant->workspace_id)) {
            throw WorkspaceIsolationViolation::tenantWorkspaceMissing(class_basename($model), $tenantId);
        }

        return (int) $tenant->workspace_id;
    }
}