ahmido
bda1d90fc4
Implements spec 094 (assignment fetch/restore observability hardening): - Adds OperationRun tracking for assignment fetch (during backup) and assignment restore (during restore execution) - Normalizes failure codes/reason_code and sanitizes failure messages - Ensures exactly one audit log entry per assignment restore execution - Enforces correct guard/membership vs capability semantics on affected admin surfaces - Switches assignment Graph services to depend on GraphClientInterface Also includes Postgres-only FK defense-in-depth check and a discoverable `composer test:pgsql` runner (scoped to the FK constraint test). Tests: - `vendor/bin/sail artisan test --compact` (passed) - `vendor/bin/sail composer test:pgsql` (passed) Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #113
38 lines
1.1 KiB
PHP
38 lines
1.1 KiB
PHP
<?php
|
|
|
|
use App\Models\Tenant;
|
|
use App\Support\Auth\Capabilities;
|
|
use App\Support\Rbac\UiEnforcement;
|
|
use Filament\Actions\Action;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\DB;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
it('preflights bulk selections with a set-based tenant_memberships query (no N+1)', function () {
|
|
$tenants = Tenant::factory()->count(25)->create();
|
|
[$user] = createUserWithTenant($tenants->first(), role: 'owner');
|
|
|
|
foreach ($tenants->slice(1) as $tenant) {
|
|
$user->tenants()->syncWithoutDetaching([
|
|
$tenant->getKey() => ['role' => 'owner'],
|
|
]);
|
|
}
|
|
|
|
$action = Action::make('test')->action(fn () => null);
|
|
|
|
$enforcement = UiEnforcement::forAction($action)
|
|
->requireCapability(Capabilities::TENANT_SYNC);
|
|
|
|
$membershipQueries = 0;
|
|
|
|
DB::listen(function ($query) use (&$membershipQueries): void {
|
|
if (str_contains($query->sql, 'tenant_memberships')) {
|
|
$membershipQueries++;
|
|
}
|
|
});
|
|
|
|
expect($enforcement->bulkSelectionIsAuthorized($user, $tenants))->toBeTrue();
|
|
expect($membershipQueries)->toBe(1);
|
|
});
|