epic: php-tenant production readiness

Clotho's PHP tenant package assessment — fixes, tests, refactoring, and features for production readiness. ## Tasks - [ ] #5 refactor: clarify WorkspaceScope vs BelongsToWorkspace architecture - [ ] #6 refactor: consolidate User model external relationships - [ ] #7 fix: remove hardcoded domain hub.host.uk.com from EntitlementApiController - [ ] #8 fix: remove hardcoded domain hub.host.uk.com from WorkspaceController - [ ] #9 security: WorkspaceInvitation::findByToken has O(n) timing attack surface - [ ] #10 fix: namespaces.workspace_id should cascade on workspace delete - [ ] #11 perf: add composite index on user_workspace(workspace_id, role) - [ ] #12 fix: feature_code in usage_alert_history not constrained to entitlements - [ ] #13 fix: complete stub implementations in UserStatsService - [ ] #14 perf: fix N+1 query in NamespaceService::groupedForUser - [ ] #15 test: add tests for WorkspaceTeamService - [ ] #16 test: add tests for EntitlementWebhookService - [ ] #17 test: add edge case tests for TotpService - [ ] #18 refactor: add return type hints to all Workspace model relationships - [ ] #19 refactor: create EntitlementException hierarchy with subtypes - [ ] #20 refactor: standardise error response format across API controllers - [ ] #21 perf: lazy-load Workspace model relationships to reduce N+1 queries - [ ] #22 feat: add soft deletes to WorkspaceInvitation model - [ ] #23 feat: add workspace invitation resend functionality - [ ] #24 refactor: create WorkspaceMemberRole enum for type safety - [ ] #25 feat: make workspace invitation expiry configurable - [ ] #26 chore: add PHPStan/Larastan to dev dependencies - [ ] #27 chore: pin host-uk/core dependency to stable version - [ ] #28 docs: fix incorrect namespace in README.md usage examples - [ ] #29 test: add tests for WorkspaceController API endpoints - [ ] #30 test: add tests for NamespaceService - [ ] #31 chore: add IDE helper annotations to Eloquent models - [ ] #32 chore: create artisan command for manual package provisioning - [ ] #33 docs: add OpenAPI/Swagger documentation for all API endpoints - [ ] #34 test: add mutation testing with Infection PHP - [ ] #35 feat: add workspace ownership transfer - [ ] #36 feat: add bulk workspace invitation support - [ ] #37 feat: add workspace activity audit log - [ ] #38 roadmap: php-tenant production readiness - [ ] #40 fix: entitlement_features.parent_feature_id nullOnDelete orphans children - [ ] #41 perf: add missing indexes to entitlement_webhook_deliveries table - [ ] #42 security: EntitlementService usage recording has race condition - [ ] #43 fix: validate invitation token format before database lookup

Charon commented

2026-02-20 23:57:34 +00:00

Member

Clotho's PHP tenant package assessment — fixes, tests, refactoring, and features for production readiness.

Tasks

#5 refactor: clarify WorkspaceScope vs BelongsToWorkspace architecture
#6 refactor: consolidate User model external relationships
#7 fix: remove hardcoded domain hub.host.uk.com from EntitlementApiController
#8 fix: remove hardcoded domain hub.host.uk.com from WorkspaceController
#9 security: WorkspaceInvitation::findByToken has O(n) timing attack surface
#10 fix: namespaces.workspace_id should cascade on workspace delete
#11 perf: add composite index on user_workspace(workspace_id, role)
#12 fix: feature_code in usage_alert_history not constrained to entitlements
#13 fix: complete stub implementations in UserStatsService
#14 perf: fix N+1 query in NamespaceService::groupedForUser
#15 test: add tests for WorkspaceTeamService
#16 test: add tests for EntitlementWebhookService
#17 test: add edge case tests for TotpService
#18 refactor: add return type hints to all Workspace model relationships
#19 refactor: create EntitlementException hierarchy with subtypes
#20 refactor: standardise error response format across API controllers
#21 perf: lazy-load Workspace model relationships to reduce N+1 queries
#22 feat: add soft deletes to WorkspaceInvitation model
#23 feat: add workspace invitation resend functionality
#24 refactor: create WorkspaceMemberRole enum for type safety
#25 feat: make workspace invitation expiry configurable
#26 chore: add PHPStan/Larastan to dev dependencies
#27 chore: pin host-uk/core dependency to stable version
#28 docs: fix incorrect namespace in README.md usage examples
#29 test: add tests for WorkspaceController API endpoints
#30 test: add tests for NamespaceService
#31 chore: add IDE helper annotations to Eloquent models
#32 chore: create artisan command for manual package provisioning
#33 docs: add OpenAPI/Swagger documentation for all API endpoints
#34 test: add mutation testing with Infection PHP
#35 feat: add workspace ownership transfer
#36 feat: add bulk workspace invitation support
#37 feat: add workspace activity audit log
#38 roadmap: php-tenant production readiness
#40 fix: entitlement_features.parent_feature_id nullOnDelete orphans children
#41 perf: add missing indexes to entitlement_webhook_deliveries table
#42 security: EntitlementService usage recording has race condition
#43 fix: validate invitation token format before database lookup

Charon added the

epic

label 2026-02-20 23:57:47 +00:00

Rows
Columns

epic: php-tenant production readiness #44

Tasks