bert.hausmans
b688ec26f0
Refactors OrganisationScope to support a declarative, recursive FK-chain
resolver and registers the scope on 14 models that previously relied on
caller-discipline for tenant isolation.
Scope resolver (app/Models/Scopes/OrganisationScope.php):
Models now declare their strategy via:
public static function tenantScopeStrategy(): array
{
return ['column' => 'organisation_id']; // terminal
// OR
return ['via' => FormSchema::class, 'fk' => 'form_schema_id'];
}
The apply() path walks the chain recursively, building whereIn subqueries
against parent models until it hits a column-based strategy. Max 3 hops;
deeper chains raise App\Exceptions\TenantScopeResolutionException. The
walker accepts BOTH the new tenantScopeStrategy() and the legacy
$organisationScopeColumn property at every hop — so PersonIdentityMatch
can chain via Person, which still uses the legacy event_id bridge, without
requiring Person/Event/Shift/FestivalSection/TimeSlot to migrate to the
new convention in this work package. That migration is a separate
backlog ticket — explicitly scope-controlled per the addendum.
Fourteen newly-scoped models:
Form-builder child models (D-03):
FormSchemaSection via FormSchema (1 hop)
FormField via FormSchema (1 hop)
FormSubmission column organisation_id (Commit 2)
FormValue via FormSubmission (1 hop)
FormValueOption via FormValue -> FormSubmission (2 hops)
FormSubmissionSectionStatus via FormSubmission (1 hop)
FormSubmissionDelegation via FormSubmission (1 hop)
FormSchemaWebhook via FormSchema (1 hop)
FormWebhookDelivery via FormSubmission (1 hop)
Event-data models (D-04 event-data subset):
ShiftAssignment via Shift (legacy festival_section_id)
ShiftWaitlist via Shift
VolunteerAvailability via TimeSlot (legacy event_id)
PersonSectionPreference via FestivalSection (legacy event_id)
PersonIdentityMatch via Person (legacy event_id)
Note — task directive specified VolunteerAvailability "via: Event, fk: event_id",
but the table has no event_id column (only person_id + time_slot_id).
Rerouted via TimeSlot, which carries the legacy event_id bridge; same
end result, correct FK.
Security-relevant callers made explicit:
PublicFormSchemaResource::toArray() now eagerly loads fields + sections
with withoutGlobalScope(OrganisationScope::class). Prior to this commit
the public form endpoint silently relied on those relations being
unscoped. The PublicFormCrossOrgScopeTest pre-existing assertions still
pass — behaviour unchanged, intent now explicit.
Test fix: FormSchemaApiTest::test_publish_sets_is_published_true was
flaky (factory randomly picked EVENT_REGISTRATION which requires
bindings). Pinned to USER_PROFILE for determinism; PurposeSchemaLifecycleTest
covers the binding-enforcement path.
Test flip: MultiTenancyTest::test_form_schema_webhook_is_not_globally_scoped
renamed to is_scoped_via_fk_chain and asserts the new behaviour: scope
filters by route org, withoutGlobalScope() still exposes cross-org rows.
The test's original purpose ("pin current behaviour so a future refactor
is intentional") is now satisfied by Commit 3 being that intentional
refactor.
Docs:
SCHEMA.md §3.5.11 Rule 5 — tenantScopeStrategy() convention documented;
the 14 newly-scoped models enumerated; link to addendum Q2.
ARCH-FORM-BUILDER.md §4.14 — new section "Multi-tenancy scope chain"
with the hop-count table for all 14 chains and the withoutGlobalScope
pattern for cross-org callers.
Tests: tests/Feature/MultiTenancy/ScopeLeakageTest.php — two orgs with
fully-populated record chains down to each of the 14 leaf models; asserts
scoped queries never cross, withoutGlobalScope still does. Plus: three-
hop chain (FormValueOption) explicitly exercised, legacy-column bridge
verified, over-deep chain raises TenantScopeResolutionException. 16 tests /
31 new assertions. Full suite: 1000 passed (2706 assertions).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
114 lines
4.2 KiB
PHP
114 lines
4.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature\FormBuilder;
|
|
|
|
use App\Models\FormBuilder\FormSchema;
|
|
use App\Models\FormBuilder\FormSchemaWebhook;
|
|
use App\Models\FormBuilder\FormTemplate;
|
|
use App\Models\FormBuilder\FormFieldLibrary;
|
|
use App\Models\Organisation;
|
|
use App\Models\Scopes\OrganisationScope;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Routing\Route;
|
|
use Tests\TestCase;
|
|
|
|
/**
|
|
* Verifies OrganisationScope discipline:
|
|
* - FormSchema, FormTemplate, FormFieldLibrary apply OrganisationScope and
|
|
* are filtered when an organisation route parameter is in scope.
|
|
* - FormSchemaWebhook now applies OrganisationScope via the FK-chain
|
|
* strategy (addendum Q2 / WS-4 Commit 3). Direct queries are tenant-
|
|
* safe by default; withoutGlobalScope() is required for admin-wide
|
|
* queries.
|
|
*/
|
|
final class MultiTenancyTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
private Organisation $orgA;
|
|
|
|
private Organisation $orgB;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
$this->orgA = Organisation::factory()->create();
|
|
$this->orgB = Organisation::factory()->create();
|
|
}
|
|
|
|
public function test_form_schema_filters_by_organisation_route_parameter(): void
|
|
{
|
|
FormSchema::factory()->count(3)->create(['organisation_id' => $this->orgA->id]);
|
|
FormSchema::factory()->count(2)->create(['organisation_id' => $this->orgB->id]);
|
|
|
|
$this->actingAsOrgUser($this->orgA);
|
|
$this->withRouteParameter('organisation', $this->orgA);
|
|
|
|
$this->assertSame(3, FormSchema::query()->count());
|
|
|
|
$this->withRouteParameter('organisation', $this->orgB);
|
|
$this->assertSame(2, FormSchema::query()->count());
|
|
}
|
|
|
|
public function test_form_template_filters_by_organisation_route_parameter(): void
|
|
{
|
|
FormTemplate::factory()->count(2)->create(['organisation_id' => $this->orgA->id]);
|
|
FormTemplate::factory()->count(4)->create(['organisation_id' => $this->orgB->id]);
|
|
|
|
$this->withRouteParameter('organisation', $this->orgA);
|
|
$this->assertSame(2, FormTemplate::query()->count());
|
|
|
|
$this->withRouteParameter('organisation', $this->orgB);
|
|
$this->assertSame(4, FormTemplate::query()->count());
|
|
}
|
|
|
|
public function test_form_field_library_filters_by_organisation_route_parameter(): void
|
|
{
|
|
FormFieldLibrary::factory()->count(1)->create(['organisation_id' => $this->orgA->id]);
|
|
FormFieldLibrary::factory()->count(3)->create(['organisation_id' => $this->orgB->id]);
|
|
|
|
$this->withRouteParameter('organisation', $this->orgA);
|
|
$this->assertSame(1, FormFieldLibrary::query()->count());
|
|
}
|
|
|
|
public function test_form_schema_webhook_is_scoped_via_fk_chain(): void
|
|
{
|
|
$schemaA = FormSchema::factory()->create(['organisation_id' => $this->orgA->id]);
|
|
$schemaB = FormSchema::factory()->create(['organisation_id' => $this->orgB->id]);
|
|
FormSchemaWebhook::factory()->count(2)->create(['form_schema_id' => $schemaA->id]);
|
|
FormSchemaWebhook::factory()->count(3)->create(['form_schema_id' => $schemaB->id]);
|
|
|
|
$this->withRouteParameter('organisation', $this->orgA);
|
|
// Addendum Q2 / WS-4 Commit 3: FK-chain scope now filters direct
|
|
// queries by the route's organisation via form_schemas.
|
|
$this->assertSame(2, FormSchemaWebhook::query()->count());
|
|
|
|
$this->withRouteParameter('organisation', $this->orgB);
|
|
$this->assertSame(3, FormSchemaWebhook::query()->count());
|
|
|
|
// Admin-wide lookups still work via withoutGlobalScope().
|
|
$this->assertSame(
|
|
5,
|
|
FormSchemaWebhook::withoutGlobalScope(OrganisationScope::class)->count()
|
|
);
|
|
}
|
|
|
|
private function actingAsOrgUser(Organisation $org): void
|
|
{
|
|
$user = User::factory()->create();
|
|
$org->users()->attach($user, ['role' => 'org_member']);
|
|
$this->actingAs($user);
|
|
}
|
|
|
|
private function withRouteParameter(string $name, mixed $value): void
|
|
{
|
|
$route = new Route(['GET'], '/_test', static fn () => null);
|
|
$route->bind(request());
|
|
$route->setParameter($name, $value);
|
|
request()->setRouteResolver(static fn () => $route);
|
|
}
|
|
}
|