ahmido
e64bae9cfc
## Summary - replace the legacy Tenant and TenantMembership core models with ManagedEnvironment and ManagedEnvironmentMembership - propagate the managed environment naming and key changes across Filament resources, pages, controllers, jobs, models, and supporting runtime paths - add feature 279 spec artifacts and focused managed-environment test coverage for model behavior, route binding, panel context, authorization, and legacy guardrails ## Validation - `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/ManagedEnvironment/LegacyTenantCoreGuardTest.php tests/Feature/ManagedEnvironment/ManagedEnvironmentAuthorizationTest.php tests/Feature/ManagedEnvironment/ManagedEnvironmentPanelContextTest.php tests/Feature/ManagedEnvironment/ManagedEnvironmentRouteBindingTest.php tests/Unit/ManagedEnvironment/ManagedEnvironmentContextResolverTest.php tests/Unit/ManagedEnvironment/ManagedEnvironmentModelTest.php` - `cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent` ## Notes - branch pushed from commit `1123b122` - browser smoke test file was added but not run in this pass Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #335
105 lines
3.4 KiB
PHP
105 lines
3.4 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
it('prevents platform consent and runtime builders from reading legacy tenant credential fields', function (): void {
|
|
$root = base_path();
|
|
|
|
$files = [
|
|
'app/Filament/Resources/TenantResource.php',
|
|
'app/Support/Links/RequiredPermissionsLinks.php',
|
|
'app/Services/Providers/AdminConsentUrlFactory.php',
|
|
'app/Services/Providers/ProviderGateway.php',
|
|
'app/Services/Providers/MicrosoftGraphOptionsResolver.php',
|
|
];
|
|
|
|
$patterns = [
|
|
'/->app_client_id\b/',
|
|
'/->app_client_secret\b/',
|
|
];
|
|
|
|
$hits = [];
|
|
|
|
foreach ($files as $relativePath) {
|
|
$absolutePath = $root.'/'.$relativePath;
|
|
|
|
if (! is_file($absolutePath)) {
|
|
continue;
|
|
}
|
|
|
|
$contents = file_get_contents($absolutePath);
|
|
|
|
if (! is_string($contents) || $contents === '') {
|
|
continue;
|
|
}
|
|
|
|
if ($relativePath === 'app/Filament/Resources/TenantResource.php') {
|
|
preg_match('/public static function adminConsentUrl\(ManagedEnvironment \$tenant\): \?string\s*\{(?P<body>.*?)^ \}/ms', $contents, $matches);
|
|
$contents = is_string($matches['body'] ?? null) ? (string) $matches['body'] : '';
|
|
}
|
|
|
|
$lines = preg_split('/\R/', $contents) ?: [];
|
|
|
|
foreach ($patterns as $pattern) {
|
|
foreach ($lines as $index => $line) {
|
|
if (preg_match($pattern, $line) === 1) {
|
|
$hits[] = $relativePath.':'.($index + 1).' -> '.trim($line);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
expect($hits)->toBeEmpty("Legacy tenant credential reads detected in platform builders:\n".implode("\n", $hits));
|
|
});
|
|
|
|
it('prevents platform consent and runtime builders from reading provider credential payloads directly', function (): void {
|
|
$root = base_path();
|
|
|
|
$files = [
|
|
'app/Filament/Resources/TenantResource.php',
|
|
'app/Support/Links/RequiredPermissionsLinks.php',
|
|
'app/Services/Providers/AdminConsentUrlFactory.php',
|
|
'app/Services/Providers/ProviderConnectionResolver.php',
|
|
'app/Services/Providers/ProviderGateway.php',
|
|
'app/Services/Providers/MicrosoftGraphOptionsResolver.php',
|
|
];
|
|
|
|
$patterns = [
|
|
'/->credential\b/',
|
|
'/->payload\b/',
|
|
];
|
|
|
|
$hits = [];
|
|
|
|
foreach ($files as $relativePath) {
|
|
$absolutePath = $root.'/'.$relativePath;
|
|
|
|
if (! is_file($absolutePath)) {
|
|
continue;
|
|
}
|
|
|
|
$contents = file_get_contents($absolutePath);
|
|
|
|
if (! is_string($contents) || $contents === '') {
|
|
continue;
|
|
}
|
|
|
|
if ($relativePath === 'app/Filament/Resources/TenantResource.php') {
|
|
preg_match('/public static function adminConsentUrl\(ManagedEnvironment \$tenant\): \?string\s*\{(?P<body>.*?)^ \}/ms', $contents, $matches);
|
|
$contents = is_string($matches['body'] ?? null) ? (string) $matches['body'] : '';
|
|
}
|
|
|
|
$lines = preg_split('/\R/', $contents) ?: [];
|
|
|
|
foreach ($patterns as $pattern) {
|
|
foreach ($lines as $index => $line) {
|
|
if (preg_match($pattern, $line) === 1) {
|
|
$hits[] = $relativePath.':'.($index + 1).' -> '.trim($line);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
expect($hits)->toBeEmpty("Provider credential payload fallback detected in platform builders:\n".implode("\n", $hits));
|
|
});
|