TenantAtlas/tests/Feature/Filament/BaselineProfileFoundationScopeTest.php

<?php

declare(strict_types=1);

use App\Filament\Resources\BaselineProfileResource\Pages\CreateBaselineProfile;
use App\Models\BaselineProfile;
use Filament\Forms\Components\Select;
use Livewire\Livewire;

it('shows only baseline-supported foundation types in the baseline profile scope picker', function (): void {
    [$user] = createUserWithTenant(role: 'owner');

    Livewire::actingAs($user)
        ->test(CreateBaselineProfile::class)
        ->assertOk()
        ->assertFormFieldExists('scope_jsonb.foundation_types', function (Select $field): bool {
            $options = $field->getOptions();

            return $field->isMultiple()
                && ($options['assignmentFilter'] ?? null) === 'Assignment Filter'
                && ($options['intuneRoleDefinition'] ?? null) === 'Intune RBAC Role Definition'
                && ! array_key_exists('intuneRoleAssignment', $options);
        });
});

it('persists baseline-supported foundation types on baseline profile create', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');

    Livewire::actingAs($user)
        ->test(CreateBaselineProfile::class)
        ->fillForm([
            'name' => 'RBAC baseline',
            'scope_jsonb.policy_types' => [],
            'scope_jsonb.foundation_types' => ['intuneRoleDefinition'],
        ])
        ->call('create')
        ->assertHasNoFormErrors()
        ->assertNotified();

    $profile = BaselineProfile::query()
        ->where('workspace_id', (int) $tenant->workspace_id)
        ->where('name', 'RBAC baseline')
        ->sole();

    expect(data_get($profile->scope_jsonb, 'foundation_types'))
        ->toBe(['intuneRoleDefinition']);
});

it('rejects unsupported foundation types when baseline profile scope is submitted', function (): void {
    [$user] = createUserWithTenant(role: 'owner');

    Livewire::actingAs($user)
        ->test(CreateBaselineProfile::class)
        ->fillForm([
            'name' => 'Invalid RBAC baseline',
            'scope_jsonb.policy_types' => [],
            'scope_jsonb.foundation_types' => ['intuneRoleAssignment'],
        ])
        ->call('create')
        ->assertHasFormErrors(['scope_jsonb.foundation_types.0' => ['in']]);

    expect(BaselineProfile::query()->where('name', 'Invalid RBAC baseline')->exists())->toBeFalse();
});