Exclude some pages/routes from multi-tenant scoping

[cweagans]

I have an "Invitations" page that needs to live outside of the tenant routes. The idea is that a Workspace (tenant) admin can invite another user to their workspace with an email address. When the user with that email address goes to /invitations, they should see their invitations. I have this working, but I can't seem to register /invitations outside of the tenant scoping (it's always at /{tenant}/invitations instead of /invitations).

It might make sense to add specific functionality for defining supplementary pages like this outside of the tenant scoping. This would be useful for e.g. user profile pages and the like too (not sure if/how that's handled by default in Filament -- I'm using Breezy).

This might mean having a stripped down version of the panel too, since none of the tenant navigation could/should be exposed outside of a tenant context. Not sure how that would look.

[juliangums]

Duplicate of #10491

I am also wondering how I could do that for the profile as I am running into similar issues. If there is no tenant assigned to a user, all they can see is the page to register a new tenant. But this is often not the only thing we want to show the user. They should have access to their profile and some other content, as some users might not even be allowed to create a new tenant but rather request access or simply wait and scroll through some custom pages.

I tried to look into this, and I came up with a solution that would work:

• I think we could add a default parameter $useTentantRoute = true; and then setter and getter for that on the Page class https://github.com/filamentphp/filament/blob/3.x/packages/panels/src/Pages/Page.php (or BasePage class?)
• and then instead of just adding all pages here https://github.com/filamentphp/filament/blob/3.x/packages/panels/routes/web.php#L129 we could check whether it uses a tenant route or not and add the pages that don't somewhere outside the tenant scope further up.
• We could then add a check here to not show the tenant menu for those pages:
  https://github.com/filamentphp/filament/blob/3.x/packages/panels/resources/views/components/sidebar/index.blade.php#L105
  https://github.com/filamentphp/filament/blob/3.x/packages/panels/resources/views/components/topbar/index.blade.php#L60

Thoughts @leandrocfe @danharrin?

I'd be happy to work on this and create a PR. Seems like a non-breaking approach that some people including myself would benefit from, but I want to make sure my approach is sound and this is wanted.

[danharrin]

how do we know what the active tenant is if its not in the URL? in which case how do we use the active tenant to generate URLs for tenanted items in the sidebar

[juliangums]

My solution was not to render them. Technically, that worked with the proposed solution. If a user isn't a member of any tenant, they won't have tenant-dependent menu items, which is the expected behaviour. On a second panel, they would also not be able to see tenant-dependent routes.

I guess for the profile, I would like it to be a hybrid like use the tenant route if the user is a member of a tenant so the tenant-dependent links stay in the sidebar, but if not, make it possible to edit the profile via a tenant-independent route. But you could also just save the tenant in the session and just use independent routes for that (not sure if I like that though).

But for some other resources like a page that should only be seen when a user is not a member of any tenant, that needs to be independent like one saying "You are not part of any team." and some instructions on how to get an admin to assign you or how to create one etc.

I have a use case where users get automatically registered through a SAML integration, and they need permissions to create a new tenant, so they are basically just stuck on a 404 when logging in. Not great UX. I'll try getting this done with a second panel and lots of access logic but so far it isn't straightforward and different paths etc are an issue.

[juliangums]

After testing the second panel approach a bit and apart from having to add the path that doesn't look pretty, I indeed run into authentication issues:
I need to only have ->login() activated on one panel as having two separate logins on two different panels and therefore two logins for the same app, seems silly. But then when logging out or when trying to access any route on the second panel that does not have a login in logged out state, it tries to redirect me to the login route of that panel, which does not exist and I can't easily change that route.

[danharrin]

If you want to open an issue about that we can investigate a fix / new feature to customize the redirect

[juliangums]

Done: #13454

[cweagans]

I'm not sure why I didn't just go with a separate panel that didn't have tenancy enabled when I asked this. That seems like a much more straightforward path.

[juliangums]

@cweagans how would you get this to work though? Are you not experiencing the same issues I run into?

[juliangums]

For anyone wanting to do this, and where a second panel isn't a feasible solution due to path or auth issues, I posted a working solution here: #13431 (comment)

[deepeshmadkar]

is this issue resolved , currently i did this:

->userMenuItems([
                MenuItem::make()
                    ->label('Profile')
                    ->url(fn (): string => \Route::currentRouteName() == 'filament.customer.tenant.registration'  ? '' : Profile::getUrl() )
                    ->visible(fn (): string => !(\Route::currentRouteName() == 'filament.customer.tenant.registration'))
                    ->icon('heroicon-o-cog-6-tooth'),

            ])

[juliangums]

I don't know if this is actually relevant to your use case but I posted a working solution above. It's also not an issue that will ever be fixed due to design choice, as you can see in the conversation above.