Skip to content

Conversation

@lukinovec
Copy link
Contributor

@lukinovec lukinovec commented Dec 29, 2025

The PreventAcessFromUnwantedDomains MW had the tenancy()->routeIsUniversal($route) check either for returning early, or it was a leftover from some older implementation, so I removed it.

The middleware aborts if the $this->accessingTenantRouteFromCentralDomain($request, $route) || $this->accessingCentralRouteFromTenantDomain($request, $route) check passes. Meaning, for the middleware to abort, the route has to be either in central or tenant mode. When the route is in universal mode, the middleware will never reach return $abortRequest(). return $next($request) will always get reached, even when the || tenancy()->routeIsUniversal($route) check is deleted from the previous condition, so that check was basically useless.

Resolves #1418

The PreventAcessFromUnwantedDomains MW had the routeIsUniversal check either for returning early, or it was a leftover from some older implementation.
@codecov
Copy link

codecov bot commented Dec 29, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.92%. Comparing base (e3701f1) to head (6133c7c).

Additional details and impacted files
@@            Coverage Diff            @@
##             master    #1427   +/-   ##
=========================================
  Coverage     85.92%   85.92%           
+ Complexity     1147     1146    -1     
=========================================
  Files           184      184           
  Lines          3360     3360           
=========================================
  Hits           2887     2887           
  Misses          473      473           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.


/**
* Prevents accessing central domains in the tenant context/tenant domains in the central context.
* The access isn't prevented if the request is trying to access a route flagged as 'universal',
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Keeping the docblock like this may be a bit confusing because now, skipping this MW for universal routes is not as explicit. Instead of the explicit condition, this is implied (if ($this->accessingTenantRouteFromCentralDomain || $this->accessingCentralRouteFromTenantDomain) $abortRequest($request, $next) -- the abort only happens for central or tenant routes, never universal).

So maybe I'd rephrase this a bit

@lukinovec lukinovec marked this pull request as draft December 29, 2025 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

is PreventAccessFromUnwantedDomains useful when InitializeTenancyByRequestData is used?

2 participants