PR Body Implements Spec 065 “Tenant RBAC v1” with capabilities-first RBAC, tenant membership scoping (Option 3), and consistent Filament action semantics. Key decisions / rules Tenancy Option 3: tenant switching is tenantless (ChooseTenant), tenant-scoped routes stay scoped, non-members get 404 (not 403). RBAC model: canonical capability registry + role→capability map + Gates for each capability (no role-string checks in UI logic). UX policy: for tenant members lacking permission → actions are visible but disabled + tooltip (avoid click→403). Security still enforced server-side. What’s included Capabilities foundation: Central capability registry (Capabilities::*) Role→capability mapping (RoleCapabilityMap) Gate registration + resolver/manager updates to support tenant-scoped authorization Filament enforcement hardening across the app: Tenant registration & tenant CRUD properly gated Backup/restore/policy flows aligned to “visible-but-disabled” where applicable Provider operations (health check / inventory sync / compliance snapshot) guarded and normalized Directory groups + inventory sync start surfaces normalized Policy version maintenance actions (archive/restore/prune/force delete) gated SpecKit artifacts for 065: spec.md, plan/tasks updates, checklists, enforcement hitlist Security guarantees Non-member → 404 via tenant scoping/membership guards. Member without capability → 403 on execution, even if UI is disabled. No destructive actions execute without proper authorization checks. Tests Adds/updates Pest coverage for: Tenant scoping & membership denial behavior Role matrix expectations (owner/manager/operator/readonly) Filament surface checks (visible/disabled actions, no side effects) Provider/Inventory/Groups run-start authorization Verified locally with targeted vendor/bin/sail artisan test --compact … Deployment / ops notes No new services required. Safe change: behavior is authorization + UI semantics; no breaking route changes intended. Co-authored-by: Ahmed Darrazi <ahmeddarrazi@MacBookPro.fritz.box> Reviewed-on: #79
203 lines
7.9 KiB
PHP
203 lines
7.9 KiB
PHP
<?php
|
|
|
|
namespace App\Filament\Resources;
|
|
|
|
use App\Filament\Clusters\Inventory\InventoryCluster;
|
|
use App\Filament\Resources\InventorySyncRunResource\Pages;
|
|
use App\Models\InventorySyncRun;
|
|
use App\Models\Tenant;
|
|
use App\Support\Auth\Capabilities;
|
|
use App\Support\Badges\BadgeDomain;
|
|
use App\Support\Badges\BadgeRenderer;
|
|
use App\Support\OperationRunLinks;
|
|
use BackedEnum;
|
|
use Filament\Actions;
|
|
use Filament\Infolists\Components\TextEntry;
|
|
use Filament\Infolists\Components\ViewEntry;
|
|
use Filament\Resources\Resource;
|
|
use Filament\Schemas\Components\Section;
|
|
use Filament\Schemas\Schema;
|
|
use Filament\Tables;
|
|
use Filament\Tables\Table;
|
|
use Illuminate\Database\Eloquent\Builder;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Support\Facades\Gate;
|
|
use UnitEnum;
|
|
|
|
class InventorySyncRunResource extends Resource
|
|
{
|
|
protected static ?string $model = InventorySyncRun::class;
|
|
|
|
protected static bool $shouldRegisterNavigation = true;
|
|
|
|
protected static ?string $cluster = InventoryCluster::class;
|
|
|
|
protected static ?int $navigationSort = 2;
|
|
|
|
protected static string|BackedEnum|null $navigationIcon = 'heroicon-o-clock';
|
|
|
|
protected static string|UnitEnum|null $navigationGroup = 'Inventory';
|
|
|
|
public static function canViewAny(): bool
|
|
{
|
|
$tenant = Tenant::current();
|
|
|
|
return $tenant instanceof Tenant
|
|
&& Gate::allows(Capabilities::TENANT_VIEW, $tenant);
|
|
}
|
|
|
|
public static function canView(Model $record): bool
|
|
{
|
|
$tenant = Tenant::current();
|
|
|
|
if (! $tenant instanceof Tenant) {
|
|
return false;
|
|
}
|
|
|
|
if (! Gate::allows(Capabilities::TENANT_VIEW, $tenant)) {
|
|
return false;
|
|
}
|
|
|
|
if ($record instanceof InventorySyncRun) {
|
|
return (int) $record->tenant_id === (int) $tenant->getKey();
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
public static function getNavigationLabel(): string
|
|
{
|
|
return 'Sync History';
|
|
}
|
|
|
|
public static function form(Schema $schema): Schema
|
|
{
|
|
return $schema;
|
|
}
|
|
|
|
public static function infolist(Schema $schema): Schema
|
|
{
|
|
return $schema
|
|
->schema([
|
|
Section::make('Legacy run view')
|
|
->description('Canonical monitoring is now available in Monitoring → Operations.')
|
|
->schema([
|
|
TextEntry::make('canonical_view')
|
|
->label('Canonical view')
|
|
->state('View in Operations')
|
|
->url(fn (InventorySyncRun $record): string => OperationRunLinks::index(Tenant::current() ?? $record->tenant))
|
|
->badge()
|
|
->color('primary'),
|
|
])
|
|
->columnSpanFull(),
|
|
|
|
Section::make('Sync Run')
|
|
->schema([
|
|
TextEntry::make('user.name')
|
|
->label('Initiator')
|
|
->placeholder('—'),
|
|
TextEntry::make('status')
|
|
->badge()
|
|
->formatStateUsing(BadgeRenderer::label(BadgeDomain::InventorySyncRunStatus))
|
|
->color(BadgeRenderer::color(BadgeDomain::InventorySyncRunStatus))
|
|
->icon(BadgeRenderer::icon(BadgeDomain::InventorySyncRunStatus))
|
|
->iconColor(BadgeRenderer::iconColor(BadgeDomain::InventorySyncRunStatus)),
|
|
TextEntry::make('selection_hash')->label('Selection hash')->copyable(),
|
|
TextEntry::make('started_at')->dateTime(),
|
|
TextEntry::make('finished_at')->dateTime(),
|
|
TextEntry::make('items_observed_count')->label('Observed')->numeric(),
|
|
TextEntry::make('items_upserted_count')->label('Upserted')->numeric(),
|
|
TextEntry::make('errors_count')->label('Errors')->numeric(),
|
|
TextEntry::make('had_errors')
|
|
->label('Had errors')
|
|
->badge()
|
|
->formatStateUsing(BadgeRenderer::label(BadgeDomain::BooleanHasErrors))
|
|
->color(BadgeRenderer::color(BadgeDomain::BooleanHasErrors))
|
|
->icon(BadgeRenderer::icon(BadgeDomain::BooleanHasErrors))
|
|
->iconColor(BadgeRenderer::iconColor(BadgeDomain::BooleanHasErrors)),
|
|
])
|
|
->columns(2)
|
|
->columnSpanFull(),
|
|
|
|
Section::make('Selection Payload')
|
|
->schema([
|
|
ViewEntry::make('selection_payload')
|
|
->label('')
|
|
->view('filament.infolists.entries.snapshot-json')
|
|
->state(fn (InventorySyncRun $record) => $record->selection_payload ?? [])
|
|
->columnSpanFull(),
|
|
])
|
|
->columnSpanFull(),
|
|
|
|
Section::make('Error Summary')
|
|
->schema([
|
|
ViewEntry::make('error_codes')
|
|
->label('Error codes')
|
|
->view('filament.infolists.entries.snapshot-json')
|
|
->state(fn (InventorySyncRun $record) => $record->error_codes ?? [])
|
|
->columnSpanFull(),
|
|
ViewEntry::make('error_context')
|
|
->label('Safe error context')
|
|
->view('filament.infolists.entries.snapshot-json')
|
|
->state(fn (InventorySyncRun $record) => $record->error_context ?? [])
|
|
->columnSpanFull(),
|
|
])
|
|
->columnSpanFull(),
|
|
]);
|
|
}
|
|
|
|
public static function table(Table $table): Table
|
|
{
|
|
return $table
|
|
->defaultSort('id', 'desc')
|
|
->columns([
|
|
Tables\Columns\TextColumn::make('user.name')
|
|
->label('Initiator')
|
|
->placeholder('—')
|
|
->toggleable(),
|
|
Tables\Columns\TextColumn::make('status')
|
|
->badge()
|
|
->formatStateUsing(BadgeRenderer::label(BadgeDomain::InventorySyncRunStatus))
|
|
->color(BadgeRenderer::color(BadgeDomain::InventorySyncRunStatus))
|
|
->icon(BadgeRenderer::icon(BadgeDomain::InventorySyncRunStatus))
|
|
->iconColor(BadgeRenderer::iconColor(BadgeDomain::InventorySyncRunStatus)),
|
|
Tables\Columns\TextColumn::make('selection_hash')
|
|
->label('Selection')
|
|
->copyable()
|
|
->limit(12),
|
|
Tables\Columns\TextColumn::make('started_at')->since(),
|
|
Tables\Columns\TextColumn::make('finished_at')->since(),
|
|
Tables\Columns\TextColumn::make('items_observed_count')
|
|
->label('Observed')
|
|
->numeric(),
|
|
Tables\Columns\TextColumn::make('items_upserted_count')
|
|
->label('Upserted')
|
|
->numeric(),
|
|
Tables\Columns\TextColumn::make('errors_count')
|
|
->label('Errors')
|
|
->numeric(),
|
|
])
|
|
->actions([
|
|
Actions\ViewAction::make(),
|
|
])
|
|
->bulkActions([]);
|
|
}
|
|
|
|
public static function getEloquentQuery(): Builder
|
|
{
|
|
$tenantId = Tenant::current()?->getKey();
|
|
|
|
return parent::getEloquentQuery()
|
|
->with('user')
|
|
->when($tenantId, fn (Builder $query) => $query->where('tenant_id', $tenantId));
|
|
}
|
|
|
|
public static function getPages(): array
|
|
{
|
|
return [
|
|
'index' => Pages\ListInventorySyncRuns::route('/'),
|
|
'view' => Pages\ViewInventorySyncRun::route('/{record}'),
|
|
];
|
|
}
|
|
}
|