TenantAtlas/apps/platform/tests/Feature/Rbac/InventoryItemResourceAuthorizationTest.php

<?php

declare(strict_types=1);

use App\Filament\Resources\InventoryItemResource;
use App\Filament\Resources\InventoryItemResource\Pages\ListInventoryItems;
use App\Models\InventoryItem;
use App\Models\OperationRun;
use App\Models\ManagedEnvironment;
use App\Models\User;
use App\Support\Inventory\InventoryCoverage as InventoryCoveragePayload;
use App\Support\Workspaces\WorkspaceContext;
use Filament\Facades\Filament;
use Livewire\Livewire;

describe('Inventory item resource authorization', function () {
    it('is not visible for non-members', function () {
        $user = User::factory()->create();
        $tenant = ManagedEnvironment::factory()->create();

        $this->actingAs($user);
        $tenant->makeCurrent();

        expect(InventoryItemResource::canViewAny())->toBeFalse();
    });

    it('is visible for readonly members', function () {
        [$user, $tenant] = createUserWithTenant(role: 'readonly');

        $this->actingAs($user);
        $tenant->makeCurrent();

        expect(InventoryItemResource::canViewAny())->toBeTrue();
    });

    it('prevents viewing inventory items from other tenants', function () {
        [$user, $tenant] = createUserWithTenant(role: 'owner');
        $otherTenant = ManagedEnvironment::factory()->create();

        $this->actingAs($user);
        $tenant->makeCurrent();

        $record = InventoryItem::factory()->create([
            'managed_environment_id' => $otherTenant->getKey(),
        ]);

        expect(InventoryItemResource::canView($record))->toBeFalse();
    });

    it('allows viewing inventory items from the current tenant', function () {
        [$user, $tenant] = createUserWithTenant(role: 'readonly');

        $this->actingAs($user);
        $tenant->makeCurrent();

        $record = InventoryItem::factory()->create([
            'managed_environment_id' => $tenant->getKey(),
        ]);

        expect(InventoryItemResource::canView($record))->toBeTrue();
    });

    it('keeps composed persisted inventory filters scoped to the active tenant', function () {
        $tenantA = ManagedEnvironment::factory()->create();
        [$user, $tenantA] = createUserWithTenant(tenant: $tenantA, role: 'owner');

        $tenantB = ManagedEnvironment::factory()->create([
            'workspace_id' => (int) $tenantA->workspace_id,
        ]);

        createUserWithTenant(tenant: $tenantB, user: $user, role: 'owner');

        $tenantAFresh = InventoryItem::factory()->create([
            'managed_environment_id' => (int) $tenantA->getKey(),
            'display_name' => 'ManagedEnvironment A Fresh Windows',
            'platform' => 'windows',
            'last_seen_at' => now(),
        ]);

        $tenantAStale = InventoryItem::factory()->create([
            'managed_environment_id' => (int) $tenantA->getKey(),
            'display_name' => 'ManagedEnvironment A Stale Windows',
            'platform' => 'windows',
            'last_seen_at' => now()->subDays(3),
        ]);

        $tenantBStale = InventoryItem::factory()->create([
            'managed_environment_id' => (int) $tenantB->getKey(),
            'display_name' => 'ManagedEnvironment B Stale Windows',
            'platform' => 'windows',
            'last_seen_at' => now()->subDays(3),
        ]);

        $this->actingAs($user);
        $tenantA->makeCurrent();
        Filament::setTenant($tenantA, true);

        Livewire::test(ListInventoryItems::class)
            ->filterTable('platform', 'windows')
            ->filterTable('stale', '1')
            ->assertCanSeeTableRecords([$tenantAStale])
            ->assertCanNotSeeTableRecords([$tenantAFresh, $tenantBStale]);

        Livewire::test(ListInventoryItems::class)
            ->assertSet('tableFilters.platform.value', 'windows')
            ->assertSet('tableFilters.stale.value', '1')
            ->assertCanSeeTableRecords([$tenantAStale])
            ->assertCanNotSeeTableRecords([$tenantAFresh, $tenantBStale]);
    });

    it('keeps persisted admin inventory search and filters inside the remembered canonical tenant after tenant changes', function () {
        $tenantA = ManagedEnvironment::factory()->create();
        [$user, $tenantA] = createUserWithTenant(tenant: $tenantA, role: 'owner');

        $tenantB = ManagedEnvironment::factory()->create([
            'workspace_id' => (int) $tenantA->workspace_id,
        ]);

        createUserWithTenant(tenant: $tenantB, user: $user, role: 'owner');

        $tenantARecord = InventoryItem::factory()->create([
            'managed_environment_id' => (int) $tenantA->getKey(),
            'display_name' => 'Shared Windows Device',
            'platform' => 'windows',
            'last_seen_at' => now()->subDays(3),
        ]);

        $tenantBRecord = InventoryItem::factory()->create([
            'managed_environment_id' => (int) $tenantB->getKey(),
            'display_name' => 'Shared Windows Device',
            'platform' => 'windows',
            'last_seen_at' => now()->subDays(3),
        ]);

        $this->actingAs($user);
        Filament::setCurrentPanel('admin');
        Filament::setTenant(null, true);
        Filament::bootCurrentPanel();

        session()->put(WorkspaceContext::SESSION_KEY, (int) $tenantA->workspace_id);
        session()->put(WorkspaceContext::LAST_TENANT_IDS_SESSION_KEY, [
            (string) $tenantA->workspace_id => (int) $tenantA->getKey(),
        ]);

        Livewire::actingAs($user)->test(ListInventoryItems::class)
            ->searchTable('Shared Windows')
            ->filterTable('platform', 'windows')
            ->filterTable('stale', '1')
            ->assertCanSeeTableRecords([$tenantARecord])
            ->assertCanNotSeeTableRecords([$tenantBRecord]);

        session()->put(WorkspaceContext::LAST_TENANT_IDS_SESSION_KEY, [
            (string) $tenantA->workspace_id => (int) $tenantB->getKey(),
        ]);

        Livewire::actingAs($user)->test(ListInventoryItems::class)
            ->assertSet('tableSearch', 'Shared Windows')
            ->assertSet('tableFilters.platform.value', 'windows')
            ->assertSet('tableFilters.stale.value', '1')
            ->assertCanSeeTableRecords([$tenantBRecord])
            ->assertCanNotSeeTableRecords([$tenantARecord]);
    });

    it('shows coverage truth without a basis-run link for readonly members missing inventory-sync capability', function () {
        $tenant = ManagedEnvironment::factory()->create();
        [$user, $tenant] = createUserWithTenant(tenant: $tenant, role: 'readonly');

        OperationRun::factory()->create([
            'managed_environment_id' => (int) $tenant->getKey(),
            'workspace_id' => (int) $tenant->workspace_id,
            'type' => 'inventory_sync',
            'status' => 'completed',
            'outcome' => 'failed',
            'context' => [
                'inventory' => [
                    'coverage' => InventoryCoveragePayload::buildPayload([
                        'deviceConfiguration' => [
                            'status' => InventoryCoveragePayload::StatusFailed,
                            'item_count' => 0,
                            'error_code' => 'graph_forbidden',
                        ],
                    ], []),
                ],
            ],
            'completed_at' => now(),
        ]);

        $this->actingAs($user)
            ->get(InventoryItemResource::getUrl('index', tenant: $tenant))
            ->assertOk()
            ->assertSee('Coverage basis')
            ->assertSee('Latest run detail is not available with your current role.')
            ->assertDontSee('Open basis run');
    });
});