feat: PR-3 - Tenant Middleware & RBAC Wiring

[kevalyq]

PR-3: Tenant Middleware & RBAC Wiring

Resolves #50 (PR-3)

Summary

Implements tenant context extraction middleware and wires up Spatie Permission package for multi-tenant RBAC isolation.

Changes

• ✅ Published and configured spatie/laravel-permission with multi-tenancy support

  • Enabled teams feature with tenant_id as team_foreign_key
  • Published config: config/permission.php (208 lines)
  • Ran migration: database/migrations/2025_11_01_185152_create_permission_tables.php (140 lines)

• ✅ Implemented SetTenant middleware (app/Http/Middleware/SetTenant.php, 79 lines)

  • Extracts tenant_id from route parameter (priority) or X-Tenant header (fallback)
  • Validates tenant existence (returns 404 if not found)
  • Sets PermissionRegistrar::setPermissionsTeamId() for RBAC isolation
  • Stores tenant_id in request attributes for controller access
  • Returns structured JSON errors (400 for missing, 404 for not found)

• ✅ Registered middleware alias in bootstrap/app.php

• ✅ Comprehensive PEST test coverage (tests/Feature/SetTenantMiddlewareTest.php, 148 lines)

  • 9 tests covering: missing tenant (400), non-existent (404), path extraction, header extraction, priority logic, team ID setting, cross-tenant isolation, invalid IDs, request storage

• ✅ PHPStan configuration for vendor code (phpstan.neon, 15 lines added)

Quality Checks

• ✅ PSR-12 compliant: Pint passed (38 files)
• ✅ PHPStan level max: 0 errors
• ✅ Tests passing: 39 tests, 89 assertions (via ddev exec ./vendor/bin/pest)
• ✅ LOC count: 593 lines (under 600 limit)

Notes

• Membership validation (403 errors) deferred to future PR per issue SecPal API: Multi-tenant security, field encryption & blind indexes, Sanctum & Spatie Teams — TDD/PEST, DRY, best practices #50 checklist
• Requires Sanctum authentication middleware (not yet implemented)
• Tests must be run via DDEV for PostgreSQL access: ddev exec ./vendor/bin/pest

Testing

# Run all tests
ddev exec ./vendor/bin/pest

# Run middleware tests specifically
ddev exec ./vendor/bin/pest tests/Feature/SetTenantMiddlewareTest.php

# Run quality checks
ddev exec ./vendor/bin/pint
ddev exec ./vendor/bin/phpstan analyse

[Copilot]

Pull Request Overview

This PR implements multi-tenancy support using the Spatie Permission package's team feature. The changes introduce tenant-based permission isolation through middleware that validates and sets the tenant context for each request.

Key changes:

• Added SetTenant middleware to extract and validate tenant IDs from request paths or headers
• Configured Spatie Permission with team-based permissions using tenant_id as the team foreign key
• Added comprehensive test coverage for the middleware functionality including edge cases

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
app/Http/Middleware/SetTenant.php	New middleware that extracts tenant ID from path/header, validates tenant existence, and sets Spatie Permission team context
bootstrap/app.php	Registers the 'tenant' middleware alias
config/permission.php	Spatie Permission configuration with teams enabled and tenant_id as team foreign key
database/migrations/2025_11_01_185152_create_permission_tables.php	Spatie Permission migration with tenant support (vendor-generated file)
phpstan.neon	Added error suppressions for vendor migration and Pest test methods
tests/Feature/SetTenantMiddlewareTest.php	Comprehensive test suite for SetTenant middleware behavior