TenantAtlas/apps/platform/tests/Feature/Filament/PanelNavigationSegregationTest.php

<?php

declare(strict_types=1);

use App\Filament\Clusters\Inventory\InventoryCluster;
use App\Filament\Pages\InventoryCoverage;
use App\Filament\Resources\BackupScheduleResource;
use App\Filament\Resources\BackupSetResource;
use App\Filament\Resources\BaselineProfileResource;
use App\Filament\Resources\BaselineSnapshotResource;
use App\Filament\Resources\EntraGroupResource;
use App\Filament\Resources\FindingResource;
use App\Filament\Resources\InventoryItemResource;
use App\Filament\Resources\PolicyResource;
use App\Filament\Resources\PolicyVersionResource;
use App\Filament\Resources\RestoreRunResource;
use App\Support\Workspaces\WorkspaceContext;
use Filament\Facades\Filament;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

afterEach(function (): void {
    Filament::setCurrentPanel(null);
});

dataset('admin hidden navigation classes', [
    InventoryCluster::class,
    InventoryCoverage::class,
    EntraGroupResource::class,
]);

dataset('admin visible navigation classes', [
    InventoryItemResource::class,
    PolicyResource::class,
    PolicyVersionResource::class,
    BackupScheduleResource::class,
    BackupSetResource::class,
    RestoreRunResource::class,
    FindingResource::class,
]);

it('keeps admin-hidden tenant surfaces out of navigation registration', function (string $class): void {
    Filament::setCurrentPanel('admin');

    expect($class::shouldRegisterNavigation())->toBeFalse();
})->with('admin hidden navigation classes');

it('registers current tenant-owned surfaces on the admin navigation', function (string $class): void {
    Filament::setCurrentPanel('admin');

    expect($class::shouldRegisterNavigation())->toBeTrue();
})->with('admin visible navigation classes');

it('keeps retired tenant-panel entry routes unavailable', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get("/admin/t/{$tenant->external_id}")
        ->assertNotFound();
});

it('keeps baseline navigation on the admin panel and off retired tenant routes', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');

    Filament::setCurrentPanel('admin');

    expect(BaselineProfileResource::shouldRegisterNavigation())->toBeTrue();
    expect(BaselineSnapshotResource::shouldRegisterNavigation())->toBeTrue();

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get("/admin/t/{$tenant->external_id}/baseline-profiles")
        ->assertNotFound();

    $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
        ])
        ->get("/admin/t/{$tenant->external_id}/baseline-snapshots")
        ->assertNotFound();
});

it('keeps the workspace panel sidebar free of tenant-sensitive entries even with a remembered tenant', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');

    $response = $this->actingAs($user)
        ->withSession([
            WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id,
            WorkspaceContext::LAST_TENANT_IDS_SESSION_KEY => [
                (string) $tenant->workspace_id => (int) $tenant->getKey(),
            ],
        ])
        ->get(route('admin.workspace.home', ['workspace' => $tenant->workspace_id]))
        ->assertOk();

    $response->assertDontSee('>Items</span>', false);
    $response->assertDontSee('>Policies</span>', false);
    $response->assertDontSee('>Policy Versions</span>', false);
    $response->assertDontSee('>Backup Schedules</span>', false);
    $response->assertDontSee('>Backup Sets</span>', false);
    $response->assertDontSee('>Restore Runs</span>', false);
    $response->assertDontSee('>Findings</span>', false);
});