ahmido/TenantAtlas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity
eceeee9c5c
TenantAtlas/specs/287-cutover-prerequisite-completion/quickstart.md
ahmido eceeee9c5c Complete Spec 287 prerequisite cutover (#346) 
## Summary
- retire the remaining tenant-scoped provider-connection legacy routes and update canonical verification and link behavior
- complete the provider target-scope fallback cleanup so neutral shared scope data falls back to the managed environment when the raw connection tenant identifier is blank
- stop mirroring workspace roles into managed-environment scope persistence and cut the targeted admin-panel test helpers over to the post-cutover context path
- add and update the Spec 287 artifact package and targeted regression coverage for route retirement, provider-core neutralization, workspace-first RBAC, and helper cutover

## Validation
- `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/ProviderConnections/LegacyRedirectTest.php tests/Feature/ProviderConnections/TenantlessListRouteTest.php tests/Feature/ProviderConnections/TenantlessListScopingTest.php tests/Feature/Auth/WorkspaceFirstManagedEnvironmentAccessTest.php tests/Feature/Rbac/ProviderConnectionWorkspaceFirstPolicyTest.php tests/Feature/Reviews/CustomerReviewWorkspaceLaunchLinksTest.php tests/Feature/Rbac/TriageReviewStateAuthorizationTest.php`
- `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Browser/Spec281ProviderConnectionScopeSmokeTest.php tests/Browser/Spec285WorkspaceRbacEnvironmentAccessSmokeTest.php`
- `cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent`

## Notes
- Filament remains on Livewire v4 and provider registration stays unchanged in `apps/platform/bootstrap/providers.php`.
- No new asset registration or deployment-step changes are included in this slice.

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #346
2026-05-10 18:22:34 +00:00

5.1 KiB
Raw Blame History

Quickstart: Cutover Prerequisite Completion

Purpose

Use this guide to review or implement Feature 287 as the bounded runtime and test-harness completion slice that unblocks Spec 288.

Preconditions

  • The package stays limited to the five named prerequisite areas:
    • provider connection legacy route retirement
    • provider target scope core neutralization
    • environment scope role persistence cleanup
    • tenant panel test helper cutover
    • targeted validation for the changed seams
  • Spec 288 is treated as the follow-up package for quality gates and no-legacy enforcement.
  • The implementation does not add a global guard suite, a full-suite baseline, package execution, guided operations, UI copy cleanup, or provider capability expansion.
  • Filament remains v5 on Livewire v4 and provider registration remains in apps/platform/bootstrap/providers.php.

Read Order

  1. spec.md
  2. plan.md
  3. research.md
  4. data-model.md
  5. contracts/cutover-prerequisite-completion.logical.openapi.yaml
  6. tasks.md
  7. checklists/requirements.md

Implementation Intent

  • retire the remaining legacy provider-connection route family instead of guarding it
  • finish provider target-scope and identity neutralization on the shared provider-core seams
  • complete the cleanup that keeps workspace membership role-bearing and environment scope narrowing-only
  • replace tenant-panel-era test helpers with post-cutover admin or workspace helpers and update apps/platform/tests/Feature/Reviews/CustomerReviewWorkspaceLaunchLinksTest.php plus apps/platform/tests/Feature/Rbac/TriageReviewStateAuthorizationTest.php
  • keep validation targeted to the changed seams only and leave quality gates to Spec 288

Review Scenarios

Scenario 1: Canonical provider-connection routing is the only runtime path

  • open canonical provider-connection paths and the launch-point inventory in apps/platform/app/Providers/Filament/AdminPanelProvider.php, apps/platform/app/Filament/Resources/TenantResource.php, apps/platform/app/Filament/Pages/TenantRequiredPermissions.php, apps/platform/app/Support/OperationRunLinks.php, apps/platform/app/Support/Providers/ProviderReasonTranslator.php, and apps/platform/app/Support/Verification/VerificationLinkBehavior.php
  • confirm they resolve through /admin/provider-connections...
  • confirm the retired legacy alias family no longer acts as accepted runtime fallback

Scenario 2: Shared provider target-scope truth is neutral

  • exercise the target-scope descriptor, provider identity resolution path, and provider-backed run or start context
  • confirm the shared contract no longer depends on Microsoft-only keys such as entra_tenant_id, tenantContext, or target_scope.entra_tenant_id
  • confirm provider-owned Microsoft detail remains nested where current consent or diagnostics still need it

Scenario 3: Workspace membership remains the only role-bearing truth

  • create workspace membership plus managed-environment access-scope combinations
  • confirm workspace membership still owns role authority
  • confirm environment scope only narrows visibility and does not behave like a second role matrix

Scenario 4: The shared test harness no longer boots the retired tenant panel

  • replace setTenantPanelContext() on the shared helper path, apps/platform/tests/Feature/Reviews/CustomerReviewWorkspaceLaunchLinksTest.php, and apps/platform/tests/Feature/Rbac/TriageReviewStateAuthorizationTest.php
  • rerun the targeted seam tests and browser validation
  • confirm the changed seams no longer require tenant-panel-only test state

Planned Validation Commands

export PATH="/bin:/usr/bin:/usr/local/bin:$PATH" && REPO_ROOT="$(git rev-parse --show-toplevel)" && (cd "$REPO_ROOT/apps/platform" && ./vendor/bin/sail artisan test --compact tests/Feature/ProviderConnections/LegacyRedirectTest.php tests/Feature/ProviderConnections/TenantlessListRouteTest.php tests/Feature/ProviderConnections/TenantlessListScopingTest.php tests/Feature/Auth/WorkspaceFirstManagedEnvironmentAccessTest.php tests/Feature/Rbac/ProviderConnectionWorkspaceFirstPolicyTest.php tests/Feature/Reviews/CustomerReviewWorkspaceLaunchLinksTest.php tests/Feature/Rbac/TriageReviewStateAuthorizationTest.php)

export PATH="/bin:/usr/bin:/usr/local/bin:$PATH" && REPO_ROOT="$(git rev-parse --show-toplevel)" && (cd "$REPO_ROOT/apps/platform" && ./vendor/bin/sail artisan test --compact tests/Browser/Spec281ProviderConnectionScopeSmokeTest.php tests/Browser/Spec285WorkspaceRbacEnvironmentAccessSmokeTest.php)

export PATH="/bin:/usr/bin:/usr/local/bin:$PATH" && REPO_ROOT="$(git rev-parse --show-toplevel)" && (cd "$REPO_ROOT/apps/platform" && ./vendor/bin/sail bin pint --dirty --format agent)

Explicit Stop Conditions

  • If implementation starts adding no-legacy guard families or quality gates, stop and move that work to Spec 288.
  • If implementation starts requiring a full-suite baseline to prove the slice, stop and narrow the seam inventory.
  • If implementation widens into UI copy cleanup, package execution, guided operations, or provider capability expansion, stop and split the extra work out of 287.