bert.hausmans
af8a9da038
WS-5a commit 1 of 4 per ARCH-CONSOLIDATION-ADDENDUM-2026-04-24 Q3. Creates the relational home for what was form_fields.binding JSON and form_field_library.default_binding JSON. Owner discriminator is polymorphic morph (owner_type/owner_id) — the pattern the rest of WS-5 (5b validation_rules, 5d options) will reuse. Migration backfills rows from both JSON sources in a single transaction and is genuinely reversible (rollback reconstructs the JSON). Old columns remain in place until commit 3 has switched all readers. Pattern B (binding=null) is represented by absence of row. mode enum covers entity_owned / mirrored only. Cascade on owner delete via observer — bindings are physical state, not historical audit. FormFieldBindingScope enforces multi-tenancy via UNION over both owner chains (form_field → schema → org OR form_field_library → org) — Q2's declarative tenantScopeStrategy() can't walk morph parents. Tests: migration forward/back, morph relation, cascade observer, scope isolation, enum coverage. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
107 lines
3.3 KiB
PHP
107 lines
3.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Models\Scopes;
|
|
|
|
use App\Models\FormBuilder\FormField;
|
|
use App\Models\FormBuilder\FormFieldLibrary;
|
|
use App\Models\FormBuilder\FormSchema;
|
|
use Illuminate\Database\Eloquent\Builder;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Database\Eloquent\Scope;
|
|
|
|
/**
|
|
* Multi-tenant isolation for `form_field_bindings`. The table has a
|
|
* polymorphic owner that points at either `form_field` or
|
|
* `form_field_library`; `OrganisationScope` (Q2 FK-chain resolver) can't
|
|
* walk a morph parent, so this scope does the equivalent UNION walk:
|
|
*
|
|
* owner_id ∈ (
|
|
* SELECT id FROM form_fields
|
|
* WHERE form_schema_id ∈ (SELECT id FROM form_schemas WHERE organisation_id = ?)
|
|
* UNION
|
|
* SELECT id FROM form_field_library
|
|
* WHERE organisation_id = ?
|
|
* )
|
|
*
|
|
* Organisation context resolution mirrors `OrganisationScope` — explicit
|
|
* override via constructor, then the `organisation` / `event` route
|
|
* parameter fallbacks. CLI, queues, and unauthenticated flows skip the
|
|
* scope (consistent with OrganisationScope).
|
|
*
|
|
* Escape hatch: callers that need cross-tenant reads use
|
|
* `FormFieldBinding::withoutGlobalScope(FormFieldBindingScope::class)`.
|
|
*/
|
|
final class FormFieldBindingScope implements Scope
|
|
{
|
|
public function __construct(
|
|
private readonly ?string $organisationId = null,
|
|
) {}
|
|
|
|
public function apply(Builder $builder, Model $model): void
|
|
{
|
|
$orgId = $this->resolveOrganisationId();
|
|
if ($orgId === null) {
|
|
return;
|
|
}
|
|
|
|
$fieldIds = FormField::query()
|
|
->withoutGlobalScope(OrganisationScope::class)
|
|
->whereIn(
|
|
'form_schema_id',
|
|
FormSchema::query()
|
|
->withoutGlobalScope(OrganisationScope::class)
|
|
->where('organisation_id', $orgId)
|
|
->select('id'),
|
|
)
|
|
->select('id');
|
|
|
|
$libraryIds = FormFieldLibrary::query()
|
|
->withoutGlobalScope(OrganisationScope::class)
|
|
->where('organisation_id', $orgId)
|
|
->select('id');
|
|
|
|
$table = $model->getTable();
|
|
|
|
$builder->where(function (Builder $outer) use ($table, $fieldIds, $libraryIds): void {
|
|
$outer->where(function (Builder $q) use ($table, $fieldIds): void {
|
|
$q->where("$table.owner_type", 'form_field')
|
|
->whereIn("$table.owner_id", $fieldIds);
|
|
})->orWhere(function (Builder $q) use ($table, $libraryIds): void {
|
|
$q->where("$table.owner_type", 'form_field_library')
|
|
->whereIn("$table.owner_id", $libraryIds);
|
|
});
|
|
});
|
|
}
|
|
|
|
private function resolveOrganisationId(): ?string
|
|
{
|
|
if ($this->organisationId !== null) {
|
|
return $this->organisationId;
|
|
}
|
|
|
|
$route = request()->route();
|
|
if ($route === null) {
|
|
return null;
|
|
}
|
|
|
|
$org = $route->parameter('organisation');
|
|
|
|
if ($org instanceof \App\Models\Organisation) {
|
|
return $org->id;
|
|
}
|
|
|
|
if (is_string($org) && $org !== '') {
|
|
return $org;
|
|
}
|
|
|
|
$event = $route->parameter('event');
|
|
if ($event instanceof \App\Models\Event) {
|
|
return $event->organisation_id;
|
|
}
|
|
|
|
return null;
|
|
}
|
|
}
|