bert.hausmans/crewli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(scope): declarative FK-chain strategy for OrganisationScope, register on 14 models per addendum Q2 + D-03/D-04

Browse Source 
Refactors OrganisationScope to support a declarative, recursive FK-chain
resolver and registers the scope on 14 models that previously relied on
caller-discipline for tenant isolation.

Scope resolver (app/Models/Scopes/OrganisationScope.php):
Models now declare their strategy via:

    public static function tenantScopeStrategy(): array
    {
        return ['column' => 'organisation_id'];           // terminal
        // OR
        return ['via' => FormSchema::class, 'fk' => 'form_schema_id'];
    }

The apply() path walks the chain recursively, building whereIn subqueries
against parent models until it hits a column-based strategy. Max 3 hops;
deeper chains raise App\Exceptions\TenantScopeResolutionException. The
walker accepts BOTH the new tenantScopeStrategy() and the legacy
$organisationScopeColumn property at every hop — so PersonIdentityMatch
can chain via Person, which still uses the legacy event_id bridge, without
requiring Person/Event/Shift/FestivalSection/TimeSlot to migrate to the
new convention in this work package. That migration is a separate
backlog ticket — explicitly scope-controlled per the addendum.

Fourteen newly-scoped models:

  Form-builder child models (D-03):
    FormSchemaSection             via FormSchema                    (1 hop)
    FormField                     via FormSchema                    (1 hop)
    FormSubmission                column organisation_id (Commit 2)
    FormValue                     via FormSubmission                (1 hop)
    FormValueOption               via FormValue -> FormSubmission   (2 hops)
    FormSubmissionSectionStatus   via FormSubmission                (1 hop)
    FormSubmissionDelegation      via FormSubmission                (1 hop)
    FormSchemaWebhook             via FormSchema                    (1 hop)
    FormWebhookDelivery           via FormSubmission                (1 hop)

  Event-data models (D-04 event-data subset):
    ShiftAssignment               via Shift (legacy festival_section_id)
    ShiftWaitlist                 via Shift
    VolunteerAvailability         via TimeSlot (legacy event_id)
    PersonSectionPreference       via FestivalSection (legacy event_id)
    PersonIdentityMatch           via Person (legacy event_id)

Note — task directive specified VolunteerAvailability "via: Event, fk: event_id",
but the table has no event_id column (only person_id + time_slot_id).
Rerouted via TimeSlot, which carries the legacy event_id bridge; same
end result, correct FK.

Security-relevant callers made explicit:
  PublicFormSchemaResource::toArray() now eagerly loads fields + sections
  with withoutGlobalScope(OrganisationScope::class). Prior to this commit
  the public form endpoint silently relied on those relations being
  unscoped. The PublicFormCrossOrgScopeTest pre-existing assertions still
  pass — behaviour unchanged, intent now explicit.

Test fix: FormSchemaApiTest::test_publish_sets_is_published_true was
flaky (factory randomly picked EVENT_REGISTRATION which requires
bindings). Pinned to USER_PROFILE for determinism; PurposeSchemaLifecycleTest
covers the binding-enforcement path.

Test flip: MultiTenancyTest::test_form_schema_webhook_is_not_globally_scoped
renamed to is_scoped_via_fk_chain and asserts the new behaviour: scope
filters by route org, withoutGlobalScope() still exposes cross-org rows.
The test's original purpose ("pin current behaviour so a future refactor
is intentional") is now satisfied by Commit 3 being that intentional
refactor.

Docs:
  SCHEMA.md §3.5.11 Rule 5 — tenantScopeStrategy() convention documented;
    the 14 newly-scoped models enumerated; link to addendum Q2.
  ARCH-FORM-BUILDER.md §4.14 — new section "Multi-tenancy scope chain"
    with the hop-count table for all 14 chains and the withoutGlobalScope
    pattern for cross-org callers.

Tests: tests/Feature/MultiTenancy/ScopeLeakageTest.php — two orgs with
fully-populated record chains down to each of the 14 leaf models; asserts
scoped queries never cross, withoutGlobalScope still does. Plus: three-
hop chain (FormValueOption) explicitly exercised, legacy-column bridge
verified, over-deep chain raises TenantScopeResolutionException. 16 tests /
31 new assertions. Full suite: 1000 passed (2706 assertions).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
bert.hausmans
2026-04-24 17:08:33 +02:00
parent ae8e2fdb4e
commit b688ec26f0
22 changed files with 942 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
api/app/Models/FormBuilder/FormField.php
View File

@@ -6,6 +6,7 @@ namespace App\Models\FormBuilder;
use App\Enums\FormBuilder\FormFieldDisplayWidth;
use App\Enums\FormBuilder\FormValueStorageHint;
use App\Models\Scopes\OrganisationScope;
use Illuminate\Database\Eloquent\Concerns\HasUlids;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
@@ -28,6 +29,17 @@ final class FormField extends Model
use HasUlids;
use SoftDeletes;
protected static function booted(): void
{
static::addGlobalScope(new OrganisationScope());
}
/** @return array{via: class-string, fk: string} */
public static function tenantScopeStrategy(): array
{
return ['via' => FormSchema::class, 'fk' => 'form_schema_id'];
}
protected $fillable = [
'form_schema_id',
'form_schema_section_id',

12
api/app/Models/FormBuilder/FormSchemaSection.php
View File

@@ -4,6 +4,7 @@ declare(strict_types=1);
namespace App\Models\FormBuilder;
use App\Models\Scopes\OrganisationScope;
use Illuminate\Database\Eloquent\Concerns\HasUlids;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
@@ -20,6 +21,17 @@ final class FormSchemaSection extends Model
use HasUlids;
use SoftDeletes;
protected static function booted(): void
{
static::addGlobalScope(new OrganisationScope());
}
/** @return array{via: class-string, fk: string} */
public static function tenantScopeStrategy(): array
{
return ['via' => FormSchema::class, 'fk' => 'form_schema_id'];
}
protected $fillable = [
'form_schema_id',
'slug',

24
api/app/Models/FormBuilder/FormSchemaWebhook.php
View File

@@ -4,6 +4,7 @@ declare(strict_types=1);
namespace App\Models\FormBuilder;
use App\Models\Scopes\OrganisationScope;
use Illuminate\Database\Eloquent\Concerns\HasUlids;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
@@ -11,21 +12,26 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
use Illuminate\Database\Eloquent\Relations\HasMany;
/**
* Scope discipline: organisation isolation is enforced via the parent
* FormSchema. This model does NOT carry a direct organisation_id column,
* and OrganisationScope's column strategies (organisation_id / event_id /
* festival_section_id) do not cover form_schema_id — extending the scope
* to a new strategy is out of scope for S1.
*
* NEVER query FormSchemaWebhook::query() without an eager constraint:
* always go through $schema->webhooks() or join on form_schema_id. Direct
* queries will leak across organisations.
* Scope: organisation isolation enforced via the FormSchema parent.
* See OrganisationScope's FK-chain resolver — declared via
* tenantScopeStrategy() below (addendum Q2).
*/
final class FormSchemaWebhook extends Model
{
use HasFactory;
use HasUlids;
protected static function booted(): void
{
static::addGlobalScope(new OrganisationScope());
}
/** @return array{via: class-string, fk: string} */
public static function tenantScopeStrategy(): array
{
return ['via' => FormSchema::class, 'fk' => 'form_schema_id'];
}
protected $fillable = [
'form_schema_id',
'name',

14
api/app/Models/FormBuilder/FormSubmission.php
View File

@@ -8,6 +8,7 @@ use App\Enums\FormBuilder\FormSubmissionReviewStatus;
use App\Enums\FormBuilder\FormSubmissionStatus;
use App\Models\Event;
use App\Models\Organisation;
use App\Models\Scopes\OrganisationScope;
use App\Models\User;
use Illuminate\Database\Eloquent\Concerns\HasUlids;
use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -27,6 +28,19 @@ final class FormSubmission extends Model
use HasUlids;
use SoftDeletes;
protected static function booted(): void
{
static::addGlobalScope(new OrganisationScope());
}
/** @return array{column: string} */
public static function tenantScopeStrategy(): array
{
// Commit 2 added the denormalized organisation_id column
// (addendum Q2 — rapportage-hot exception).
return ['column' => 'organisation_id'];
}
protected $fillable = [
'form_schema_id',
'organisation_id',

12
api/app/Models/FormBuilder/FormSubmissionDelegation.php
View File

@@ -4,6 +4,7 @@ declare(strict_types=1);
namespace App\Models\FormBuilder;
use App\Models\Scopes\OrganisationScope;
use App\Models\User;
use Illuminate\Database\Eloquent\Concerns\HasUlids;
use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -15,6 +16,17 @@ final class FormSubmissionDelegation extends Model
use HasFactory;
use HasUlids;
protected static function booted(): void
{
static::addGlobalScope(new OrganisationScope());
}
/** @return array{via: class-string, fk: string} */
public static function tenantScopeStrategy(): array
{
return ['via' => FormSubmission::class, 'fk' => 'form_submission_id'];
}
protected $fillable = [
'form_submission_id',
'delegated_to_user_id',

12
api/app/Models/FormBuilder/FormSubmissionSectionStatus.php
View File

@@ -4,6 +4,7 @@ declare(strict_types=1);
namespace App\Models\FormBuilder;
use App\Models\Scopes\OrganisationScope;
use App\Models\User;
use Illuminate\Database\Eloquent\Concerns\HasUlids;
use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -15,6 +16,17 @@ final class FormSubmissionSectionStatus extends Model
use HasFactory;
use HasUlids;
protected static function booted(): void
{
static::addGlobalScope(new OrganisationScope());
}
/** @return array{via: class-string, fk: string} */
public static function tenantScopeStrategy(): array
{
return ['via' => FormSubmission::class, 'fk' => 'form_submission_id'];
}
protected $fillable = [
'form_submission_id',
'form_schema_section_id',

12
api/app/Models/FormBuilder/FormValue.php
View File

@@ -4,6 +4,7 @@ declare(strict_types=1);
namespace App\Models\FormBuilder;
use App\Models\Scopes\OrganisationScope;
use Illuminate\Database\Eloquent\Concerns\HasUlids;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
@@ -19,6 +20,17 @@ final class FormValue extends Model
use HasFactory;
use HasUlids;
protected static function booted(): void
{
static::addGlobalScope(new OrganisationScope());
}
/** @return array{via: class-string, fk: string} */
public static function tenantScopeStrategy(): array
{
return ['via' => FormSubmission::class, 'fk' => 'form_submission_id'];
}
protected $fillable = [
'form_submission_id',
'form_field_id',

13
api/app/Models/FormBuilder/FormValueOption.php
View File

@@ -4,6 +4,7 @@ declare(strict_types=1);
namespace App\Models\FormBuilder;
use App\Models\Scopes\OrganisationScope;
use Illuminate\Database\Eloquent\Concerns\HasUlids;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
@@ -19,6 +20,18 @@ final class FormValueOption extends Model
use HasFactory;
use HasUlids;
protected static function booted(): void
{
static::addGlobalScope(new OrganisationScope());
}
/** @return array{via: class-string, fk: string} */
public static function tenantScopeStrategy(): array
{
// 2 hops: FormValue → FormSubmission → organisation_id
return ['via' => FormValue::class, 'fk' => 'form_value_id'];
}
public $timestamps = false;
protected $fillable = [

12
api/app/Models/FormBuilder/FormWebhookDelivery.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Models\FormBuilder;
use App\Enums\FormBuilder\FormWebhookDeliveryStatus;
use App\Models\Scopes\OrganisationScope;
use Illuminate\Database\Eloquent\Concerns\HasUlids;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
@@ -19,6 +20,17 @@ final class FormWebhookDelivery extends Model
use HasFactory;
use HasUlids;
protected static function booted(): void
{
static::addGlobalScope(new OrganisationScope());
}
/** @return array{via: class-string, fk: string} */
public static function tenantScopeStrategy(): array
{
return ['via' => FormSubmission::class, 'fk' => 'form_submission_id'];
}
public $timestamps = false;
protected $fillable = [