ahmido d90fb0f963 065-tenant-rbac-v1 (#79) ... PR Body Implements Spec 065 “Tenant RBAC v1” with capabilities-first RBAC, tenant membership scoping (Option 3), and consistent Filament action semantics. Key decisions / rules Tenancy Option 3: tenant switching is tenantless (ChooseTenant), tenant-scoped routes stay scoped, non-members get 404 (not 403). RBAC model: canonical capability registry + role→capability map + Gates for each capability (no role-string checks in UI logic). UX policy: for tenant members lacking permission → actions are visible but disabled + tooltip (avoid click→403). Security still enforced server-side. What’s included Capabilities foundation: Central capability registry (Capabilities::*) Role→capability mapping (RoleCapabilityMap) Gate registration + resolver/manager updates to support tenant-scoped authorization Filament enforcement hardening across the app: Tenant registration & tenant CRUD properly gated Backup/restore/policy flows aligned to “visible-but-disabled” where applicable Provider operations (health check / inventory sync / compliance snapshot) guarded and normalized Directory groups + inventory sync start surfaces normalized Policy version maintenance actions (archive/restore/prune/force delete) gated SpecKit artifacts for 065: spec.md, plan/tasks updates, checklists, enforcement hitlist Security guarantees Non-member → 404 via tenant scoping/membership guards. Member without capability → 403 on execution, even if UI is disabled. No destructive actions execute without proper authorization checks. Tests Adds/updates Pest coverage for: Tenant scoping & membership denial behavior Role matrix expectations (owner/manager/operator/readonly) Filament surface checks (visible/disabled actions, no side effects) Provider/Inventory/Groups run-start authorization Verified locally with targeted vendor/bin/sail artisan test --compact … Deployment / ops notes No new services required. Safe change: behavior is authorization + UI semantics; no breaking route changes intended. Co-authored-by: Ahmed Darrazi <ahmeddarrazi@MacBookPro.fritz.box> Reviewed-on: #79		2026-01-28 21:09:47 +00:00
..
AuditLog.php	feat: TenantPilot v1 - Complete implementation (Phases 1-12)	2025-12-12 02:27:54 +01:00
BackupItem.php	feat(006): foundations + assignment mapping and preview-only restore guard (#7)	2025-12-26 23:44:31 +00:00
BackupSchedule.php	feat/032-backup-scheduling-mvp (#34)	2026-01-05 04:22:13 +00:00
BackupScheduleRun.php	feat/032-backup-scheduling-mvp (#36)	2026-01-07 01:12:12 +00:00
BackupSet.php	feat: TenantPilot v1 - Complete implementation (Phases 1-12)	2025-12-12 02:27:54 +01:00
EntraGroup.php	051-entra-group-directory-cache (#57)	2026-01-11 23:24:12 +00:00
EntraGroupSyncRun.php	051-entra-group-directory-cache (#57)	2026-01-11 23:24:12 +00:00
Finding.php	feat/044-drift-mvp (#58)	2026-01-14 23:16:10 +00:00
InventoryItem.php	feat/040-inventory-core (#43)	2026-01-07 14:54:24 +00:00
InventoryLink.php	feat/042-inventory-dependencies-graph (#49)	2026-01-10 00:20:14 +00:00
InventorySyncRun.php	046-inventory-sync-button (#47)	2026-01-09 22:15:04 +00:00
OperationRun.php	054-unify-runs-suitewide (#63)	2026-01-17 22:25:00 +00:00
PlatformUser.php	feat: implement auth structure system panel (#77)	2026-01-27 21:49:18 +00:00
Policy.php	feat/005-bulk-operations (#5)	2025-12-25 13:32:36 +00:00
PolicyVersion.php	feat/005-bulk-operations (#5)	2025-12-25 13:32:36 +00:00
ProviderConnection.php	feat: unify provider connection actions and notifications (#73)	2026-01-25 01:01:37 +00:00
ProviderCredential.php	feat: unify provider connection actions and notifications (#73)	2026-01-25 01:01:37 +00:00
RestoreRun.php	056-remove-legacy-bulkops (#65)	2026-01-19 23:27:52 +00:00
SettingsCatalogCategory.php	dev-merges/c709b36 (#3)	2025-12-21 23:15:12 +00:00
SettingsCatalogDefinition.php	feat: merge 001-filament-json	2025-12-14 20:23:18 +01:00
Tenant.php	feat: implement auth structure system panel (#77)	2026-01-27 21:49:18 +00:00
TenantMembership.php	062-tenant-rbac-v1 (#74)	2026-01-25 15:27:39 +00:00
TenantPermission.php	feat: TenantPilot v1 - Complete implementation (Phases 1-12)	2025-12-12 02:27:54 +01:00
TenantRoleMapping.php	062-tenant-rbac-v1 (#74)	2026-01-25 15:27:39 +00:00
User.php	065-tenant-rbac-v1 (#79)	2026-01-28 21:09:47 +00:00
UserTenantPreference.php	feat/031-tenant-portfolio-context-switch (#32)	2026-01-04 21:28:08 +00:00