TenantAtlas/apps/platform/tests/Feature/Rbac/TenantRequiredPermissionsTrustedStateTest.php

<?php

declare(strict_types=1);

use App\Filament\Pages\EnvironmentRequiredPermissions;
use App\Models\ManagedEnvironment;
use App\Models\ManagedEnvironmentPermission;
use App\Models\User;
use App\Models\Workspace;
use App\Models\WorkspaceMembership;
use App\Support\Links\RequiredPermissionsLinks;
use App\Support\Workspaces\WorkspaceContext;

it('keeps the route tenant authoritative when tenant-like query values are present', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'readonly');

    $otherTenant = ManagedEnvironment::factory()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'name' => 'Foreign Query ManagedEnvironment',
        'external_id' => 'foreign-query-tenant',
    ]);

    $response = $this->actingAs($user)
        ->withSession([WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id])
        ->get(RequiredPermissionsLinks::requiredPermissions($tenant, [
            'tenant' => $otherTenant->external_id,
            'managed_environment_id' => $otherTenant->getKey(),
            'status' => 'all',
        ]))
        ->assertSuccessful();

    $response
        ->assertSee($tenant->getFilamentName())
        ->assertDontSee($otherTenant->name);
});

it('keeps filter state usable without redefining tenant scope', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'readonly');

    config()->set('intune_permissions.permissions', [
        [
            'key' => 'ManagedEnvironment.Read.All',
            'type' => 'application',
            'description' => 'ManagedEnvironment read permission',
            'features' => ['backup'],
        ],
    ]);
    config()->set('entra_permissions.permissions', []);

    ManagedEnvironmentPermission::create([
        'managed_environment_id' => (int) $tenant->getKey(),
        'permission_key' => 'ManagedEnvironment.Read.All',
        'status' => 'granted',
        'details' => ['source' => 'db'],
        'last_checked_at' => now(),
    ]);

    $response = $this->actingAs($user)
        ->withSession([WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id])
        ->get(RequiredPermissionsLinks::requiredPermissions($tenant, [
            'status' => 'present',
            'type' => 'application',
            'search' => 'ManagedEnvironment',
        ]))
        ->assertSuccessful();

    $response
        ->assertSee($tenant->getFilamentName())
        ->assertSee('ManagedEnvironment.Read.All');
});

it('returns 404 when the current workspace no longer matches the tenant route scope', function (): void {
    $workspaceA = Workspace::factory()->create();
    $workspaceB = Workspace::factory()->create();
    $user = User::factory()->create();

    $tenant = ManagedEnvironment::factory()->create([
        'workspace_id' => (int) $workspaceA->getKey(),
        'external_id' => 'tenant-required-permissions-404',
    ]);

    createUserWithTenant(
        tenant: $tenant,
        user: $user,
        role: 'readonly',
        workspaceRole: 'readonly',
    );

    WorkspaceMembership::factory()->create([
        'workspace_id' => (int) $workspaceB->getKey(),
        'user_id' => (int) $user->getKey(),
        'role' => 'readonly',
    ]);

    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspaceB->getKey());

    $this->actingAs($user)
        ->get(RequiredPermissionsLinks::requiredPermissions($tenant))
        ->assertNotFound();
});

it('seeds native table state from deeplink filters without letting query values redefine the route tenant', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'readonly');

    $otherTenant = ManagedEnvironment::factory()->create([
        'workspace_id' => (int) $tenant->workspace_id,
        'name' => 'Ignored Query ManagedEnvironment',
        'external_id' => 'ignored-query-tenant',
    ]);

    config()->set('intune_permissions.permissions', [
        [
            'key' => 'ManagedEnvironment.Read.All',
            'type' => 'application',
            'description' => 'ManagedEnvironment read permission',
            'features' => ['backup'],
        ],
    ]);
    config()->set('entra_permissions.permissions', []);

    ManagedEnvironmentPermission::query()->create([
        'managed_environment_id' => (int) $tenant->getKey(),
        'permission_key' => 'ManagedEnvironment.Read.All',
        'status' => 'granted',
        'details' => ['source' => 'db'],
        'last_checked_at' => now(),
    ]);

    $this->actingAs($user)
        ->withSession([WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id])
        ->get(RequiredPermissionsLinks::requiredPermissions($tenant, [
            'tenant' => $tenant->external_id,
            'managed_environment_id' => (string) $otherTenant->getKey(),
            'status' => 'present',
            'type' => 'application',
            'features' => ['backup'],
            'search' => 'ManagedEnvironment',
        ]))
        ->assertSuccessful()
        ->assertSee($tenant->getFilamentName())
        ->assertDontSee($otherTenant->name)
        ->assertSee('ManagedEnvironment.Read.All');
});