fix(firewall): enforce system rules independently of tenant context

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
This commit is contained in:
2026-07-30 22:41:27 -04:00
parent da81f1ddf1
commit abc5bfcccc
6 changed files with 119 additions and 81 deletions
@@ -45,7 +45,7 @@ class FirewallStoreTest extends TestCase
}
}
#[TestDox('Applicable rules contain system rules and only the requested tenant rules')]
#[TestDox('System and tenant rule sets remain independently scoped')]
public function testApplicableScopes(): void
{
$tenantA = $this->rule('tenant-a', FirewallRuleObject::SCOPE_TENANT, 'tenant-a');
@@ -60,7 +60,10 @@ class FirewallStoreTest extends TestCase
$this->store->depositRule($rule);
}
$rules = $this->store->listApplicableRules('tenant-a');
$rules = array_merge(
$this->store->listSystemRules(),
$this->store->listRules('tenant-a')
);
$reasons = array_map(static fn(FirewallRuleObject $rule): ?string => $rule->getReason(), $rules);
sort($reasons);