TenantAtlas/tests/Feature/Rbac/EntraGroupSyncRunsUiEnforcementTest.php

<?php

use App\Filament\Resources\EntraGroupSyncRunResource\Pages\ListEntraGroupSyncRuns;
use App\Jobs\EntraGroupSyncJob;
use App\Models\Tenant;
use Filament\Facades\Filament;
use Illuminate\Support\Facades\Notification;
use Illuminate\Support\Facades\Queue;
use Livewire\Livewire;

describe('Entra group sync runs UI enforcement', function () {
    beforeEach(function () {
        Queue::fake();
        Notification::fake();
    });

    it('hides sync action for non-members', function () {
        // Mount as a valid tenant member first, then revoke membership mid-session.
        [$user, $tenant] = createUserWithTenant(role: 'owner');

        $this->actingAs($user);
        $tenant->makeCurrent();
        Filament::setTenant($tenant, true);

        $component = Livewire::test(ListEntraGroupSyncRuns::class)
            ->assertActionVisible('sync_groups');

        $user->tenants()->detach($tenant->getKey());
        app(\App\Services\Auth\CapabilityResolver::class)->clearCache();

        $component->assertActionHidden('sync_groups');

        Queue::assertNothingPushed();
    });

    it('shows sync action as visible but disabled for readonly members', function () {
        [$user, $tenant] = createUserWithTenant(role: 'readonly');

        $this->actingAs($user);
        $tenant->makeCurrent();
        Filament::setTenant($tenant, true);

        Livewire::test(ListEntraGroupSyncRuns::class)
            ->assertActionVisible('sync_groups')
            ->assertActionDisabled('sync_groups');

        Queue::assertNothingPushed();
    });

    it('allows owner members to execute sync action (dispatches job)', function () {
        [$user, $tenant] = createUserWithTenant(role: 'owner');

        $this->actingAs($user);
        $tenant->makeCurrent();
        Filament::setTenant($tenant, true);

        Livewire::test(ListEntraGroupSyncRuns::class)
            ->assertActionVisible('sync_groups')
            ->assertActionEnabled('sync_groups')
            ->mountAction('sync_groups')
            ->callMountedAction()
            ->assertHasNoActionErrors();

        Queue::assertPushed(EntraGroupSyncJob::class);
    });
});