Refactors OrganisationScope to support a declarative, recursive FK-chain
resolver and registers the scope on 14 models that previously relied on
caller-discipline for tenant isolation.
Scope resolver (app/Models/Scopes/OrganisationScope.php):
Models now declare their strategy via:
public static function tenantScopeStrategy(): array
{
return ['column' => 'organisation_id']; // terminal
// OR
return ['via' => FormSchema::class, 'fk' => 'form_schema_id'];
}
The apply() path walks the chain recursively, building whereIn subqueries
against parent models until it hits a column-based strategy. Max 3 hops;
deeper chains raise App\Exceptions\TenantScopeResolutionException. The
walker accepts BOTH the new tenantScopeStrategy() and the legacy
$organisationScopeColumn property at every hop — so PersonIdentityMatch
can chain via Person, which still uses the legacy event_id bridge, without
requiring Person/Event/Shift/FestivalSection/TimeSlot to migrate to the
new convention in this work package. That migration is a separate
backlog ticket — explicitly scope-controlled per the addendum.
Fourteen newly-scoped models:
Form-builder child models (D-03):
FormSchemaSection via FormSchema (1 hop)
FormField via FormSchema (1 hop)
FormSubmission column organisation_id (Commit 2)
FormValue via FormSubmission (1 hop)
FormValueOption via FormValue -> FormSubmission (2 hops)
FormSubmissionSectionStatus via FormSubmission (1 hop)
FormSubmissionDelegation via FormSubmission (1 hop)
FormSchemaWebhook via FormSchema (1 hop)
FormWebhookDelivery via FormSubmission (1 hop)
Event-data models (D-04 event-data subset):
ShiftAssignment via Shift (legacy festival_section_id)
ShiftWaitlist via Shift
VolunteerAvailability via TimeSlot (legacy event_id)
PersonSectionPreference via FestivalSection (legacy event_id)
PersonIdentityMatch via Person (legacy event_id)
Note — task directive specified VolunteerAvailability "via: Event, fk: event_id",
but the table has no event_id column (only person_id + time_slot_id).
Rerouted via TimeSlot, which carries the legacy event_id bridge; same
end result, correct FK.
Security-relevant callers made explicit:
PublicFormSchemaResource::toArray() now eagerly loads fields + sections
with withoutGlobalScope(OrganisationScope::class). Prior to this commit
the public form endpoint silently relied on those relations being
unscoped. The PublicFormCrossOrgScopeTest pre-existing assertions still
pass — behaviour unchanged, intent now explicit.
Test fix: FormSchemaApiTest::test_publish_sets_is_published_true was
flaky (factory randomly picked EVENT_REGISTRATION which requires
bindings). Pinned to USER_PROFILE for determinism; PurposeSchemaLifecycleTest
covers the binding-enforcement path.
Test flip: MultiTenancyTest::test_form_schema_webhook_is_not_globally_scoped
renamed to is_scoped_via_fk_chain and asserts the new behaviour: scope
filters by route org, withoutGlobalScope() still exposes cross-org rows.
The test's original purpose ("pin current behaviour so a future refactor
is intentional") is now satisfied by Commit 3 being that intentional
refactor.
Docs:
SCHEMA.md §3.5.11 Rule 5 — tenantScopeStrategy() convention documented;
the 14 newly-scoped models enumerated; link to addendum Q2.
ARCH-FORM-BUILDER.md §4.14 — new section "Multi-tenancy scope chain"
with the hop-count table for all 14 chains and the withoutGlobalScope
pattern for cross-org callers.
Tests: tests/Feature/MultiTenancy/ScopeLeakageTest.php — two orgs with
fully-populated record chains down to each of the 14 leaf models; asserts
scoped queries never cross, withoutGlobalScope still does. Plus: three-
hop chain (FormValueOption) explicitly exercised, legacy-column bridge
verified, over-deep chain raises TenantScopeResolutionException. 16 tests /
31 new assertions. Full suite: 1000 passed (2706 assertions).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
133 lines
4.0 KiB
PHP
133 lines
4.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Models\FormBuilder;
|
|
|
|
use App\Enums\FormBuilder\FormFieldDisplayWidth;
|
|
use App\Enums\FormBuilder\FormValueStorageHint;
|
|
use App\Models\Scopes\OrganisationScope;
|
|
use Illuminate\Database\Eloquent\Concerns\HasUlids;
|
|
use Illuminate\Database\Eloquent\Factories\HasFactory;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Database\Eloquent\Relations\BelongsTo;
|
|
use Illuminate\Database\Eloquent\Relations\HasMany;
|
|
use Illuminate\Database\Eloquent\SoftDeletes;
|
|
|
|
/**
|
|
* Activity log strategy: explicit calls via logFieldChange() — no LogsActivity
|
|
* trait. Logged events: create/delete/restore, field_type change, binding
|
|
* change, is_pii/is_filterable toggle, structural options change.
|
|
* See ARCH-FORM-BUILDER.md §17.1 and S1 Phase 4b.
|
|
*
|
|
* field_type is stored as string (not DB enum) so CustomFieldTypeRegistry
|
|
* (ARCH §17.2) can extend it at runtime.
|
|
*/
|
|
final class FormField extends Model
|
|
{
|
|
use HasFactory;
|
|
use HasUlids;
|
|
use SoftDeletes;
|
|
|
|
protected static function booted(): void
|
|
{
|
|
static::addGlobalScope(new OrganisationScope());
|
|
}
|
|
|
|
/** @return array{via: class-string, fk: string} */
|
|
public static function tenantScopeStrategy(): array
|
|
{
|
|
return ['via' => FormSchema::class, 'fk' => 'form_schema_id'];
|
|
}
|
|
|
|
protected $fillable = [
|
|
'form_schema_id',
|
|
'form_schema_section_id',
|
|
'library_field_id',
|
|
'field_type',
|
|
'slug',
|
|
'label',
|
|
'help_text',
|
|
'section',
|
|
'options',
|
|
'validation_rules',
|
|
'is_required',
|
|
'is_filterable',
|
|
'is_portal_visible',
|
|
'is_admin_only',
|
|
'is_unique',
|
|
'is_pii',
|
|
'display_width',
|
|
'binding',
|
|
'conditional_logic',
|
|
'role_restrictions',
|
|
'translations',
|
|
'value_storage_hint',
|
|
'review_required',
|
|
'sort_order',
|
|
];
|
|
|
|
/** @var array<string, string> */
|
|
protected $casts = [
|
|
'options' => 'array',
|
|
'validation_rules' => 'array',
|
|
'binding' => 'array',
|
|
'conditional_logic' => 'array',
|
|
'role_restrictions' => 'array',
|
|
'translations' => 'array',
|
|
'is_required' => 'bool',
|
|
'is_filterable' => 'bool',
|
|
'is_portal_visible' => 'bool',
|
|
'is_admin_only' => 'bool',
|
|
'is_unique' => 'bool',
|
|
'is_pii' => 'bool',
|
|
'review_required' => 'bool',
|
|
'display_width' => FormFieldDisplayWidth::class,
|
|
'value_storage_hint' => FormValueStorageHint::class,
|
|
'sort_order' => 'int',
|
|
];
|
|
|
|
public function schema(): BelongsTo
|
|
{
|
|
return $this->belongsTo(FormSchema::class, 'form_schema_id');
|
|
}
|
|
|
|
public function section(): BelongsTo
|
|
{
|
|
return $this->belongsTo(FormSchemaSection::class, 'form_schema_section_id');
|
|
}
|
|
|
|
public function libraryField(): BelongsTo
|
|
{
|
|
return $this->belongsTo(FormFieldLibrary::class, 'library_field_id');
|
|
}
|
|
|
|
public function values(): HasMany
|
|
{
|
|
return $this->hasMany(FormValue::class);
|
|
}
|
|
|
|
/**
|
|
* Nuanced activity log (ARCH §17.1; S1 Phase 4b). Callers choose which
|
|
* events are worth logging — e.g. created/deleted/restored, field_type
|
|
* changed (value storage changes), binding changed, is_pii toggled,
|
|
* is_filterable toggled (triggers backfill), structural options changes.
|
|
* NOT logged (noise): label/help_text/sort_order/conditional_logic/
|
|
* translations.
|
|
*
|
|
* Bulk-fixture suppression: the activitylog.enabled config key is the
|
|
* kill-switch. Seeders and one-shot commands wrap themselves in
|
|
* App\Support\ActivityLog::suppressed(...). activity()->log() becomes
|
|
* a silent no-op while disabled, so no guard is needed here.
|
|
*
|
|
* @param array<string, mixed> $properties
|
|
*/
|
|
public function logFieldChange(string $event, array $properties = []): void
|
|
{
|
|
activity()
|
|
->performedOn($this)
|
|
->withProperties($properties)
|
|
->log($event);
|
|
}
|
|
}
|