feat/026-custom-compliance-scripts (#29)
tenantpilot.php/graph_contracts.php include the new policy type, Graph contract, and /assign assignment flow (deviceHealthScriptAssignments payload key). ScriptsPolicyNormalizer now supports deviceComplianceScript (more metadata + script display), and InteractsWithODataTypes knows the new type. UI diff view highlights detection-script changes (same logic as other script policies) once tenantpilot.display.show_script_content is enabled. Added regression coverage in tests/Feature/Filament/ScriptPoliciesNormalizedDisplayTest plus new feature test DeviceComplianceScriptPolicyTypeTest. Runs: ScriptPoliciesNormalizedDisplayTest.php, ./vendor/bin/pint --dirty. Co-authored-by: Ahmed Darrazi <ahmeddarrazi@adsmac.local> Reviewed-on: #29
This commit is contained in:
parent
602195324b
commit
057f2cbeb6
@ -11,6 +11,7 @@ public function __construct(private readonly DefaultPolicyNormalizer $defaultNor
|
||||
public function supports(string $policyType): bool
|
||||
{
|
||||
return in_array($policyType, [
|
||||
'deviceComplianceScript',
|
||||
'deviceManagementScript',
|
||||
'deviceShellScript',
|
||||
'deviceHealthScript',
|
||||
@ -39,6 +40,31 @@ public function normalize(?array $snapshot, string $policyType, ?string $platfor
|
||||
$entries[] = ['key' => 'Description', 'value' => $description];
|
||||
}
|
||||
|
||||
$fileName = Arr::get($snapshot, 'fileName');
|
||||
if (is_string($fileName) && $fileName !== '') {
|
||||
$entries[] = ['key' => 'File name', 'value' => $fileName];
|
||||
}
|
||||
|
||||
$publisher = Arr::get($snapshot, 'publisher');
|
||||
if (is_string($publisher) && $publisher !== '') {
|
||||
$entries[] = ['key' => 'Publisher', 'value' => $publisher];
|
||||
}
|
||||
|
||||
$runAsAccount = Arr::get($snapshot, 'runAsAccount');
|
||||
if (is_string($runAsAccount) && $runAsAccount !== '') {
|
||||
$entries[] = ['key' => 'Run as account', 'value' => $runAsAccount];
|
||||
}
|
||||
|
||||
$runAs32Bit = Arr::get($snapshot, 'runAs32Bit');
|
||||
if (is_bool($runAs32Bit)) {
|
||||
$entries[] = ['key' => 'Run as 32-bit', 'value' => $runAs32Bit ? 'Enabled' : 'Disabled'];
|
||||
}
|
||||
|
||||
$enforceSignatureCheck = Arr::get($snapshot, 'enforceSignatureCheck');
|
||||
if (is_bool($enforceSignatureCheck)) {
|
||||
$entries[] = ['key' => 'Enforce signature check', 'value' => $enforceSignatureCheck ? 'Enabled' : 'Disabled'];
|
||||
}
|
||||
|
||||
$entries = array_merge($entries, $this->contentEntries($snapshot));
|
||||
|
||||
$schedule = Arr::get($snapshot, 'runSchedule');
|
||||
|
||||
@ -62,6 +62,10 @@ protected static function odataTypeMap(): array
|
||||
'windows' => '#microsoft.graph.deviceHealthScript',
|
||||
'all' => '#microsoft.graph.deviceHealthScript',
|
||||
],
|
||||
'deviceComplianceScript' => [
|
||||
'windows' => '#microsoft.graph.deviceComplianceScript',
|
||||
'all' => '#microsoft.graph.deviceComplianceScript',
|
||||
],
|
||||
'enrollmentRestriction' => [
|
||||
'all' => '#microsoft.graph.deviceEnrollmentConfiguration',
|
||||
],
|
||||
|
||||
@ -438,6 +438,26 @@
|
||||
'id_field' => 'id',
|
||||
'hydration' => 'properties',
|
||||
],
|
||||
'deviceComplianceScript' => [
|
||||
'resource' => 'deviceManagement/deviceComplianceScripts',
|
||||
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'lastModifiedDateTime'],
|
||||
'allowed_expand' => [],
|
||||
'type_family' => [
|
||||
'#microsoft.graph.deviceComplianceScript',
|
||||
],
|
||||
'create_method' => 'POST',
|
||||
'update_method' => 'PATCH',
|
||||
'id_field' => 'id',
|
||||
'hydration' => 'properties',
|
||||
'assignments_list_path' => '/deviceManagement/deviceComplianceScripts/{id}/assignments',
|
||||
'assignments_create_path' => '/deviceManagement/deviceComplianceScripts/{id}/assign',
|
||||
'assignments_create_method' => 'POST',
|
||||
'assignments_payload_key' => 'deviceHealthScriptAssignments',
|
||||
'assignments_update_path' => '/deviceManagement/deviceComplianceScripts/{id}/assignments/{assignmentId}',
|
||||
'assignments_update_method' => 'PATCH',
|
||||
'assignments_delete_path' => '/deviceManagement/deviceComplianceScripts/{id}/assignments/{assignmentId}',
|
||||
'assignments_delete_method' => 'DELETE',
|
||||
],
|
||||
'deviceManagementScript' => [
|
||||
'resource' => 'deviceManagement/deviceManagementScripts',
|
||||
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'lastModifiedDateTime'],
|
||||
|
||||
@ -155,6 +155,16 @@
|
||||
'restore' => 'enabled',
|
||||
'risk' => 'medium',
|
||||
],
|
||||
[
|
||||
'type' => 'deviceComplianceScript',
|
||||
'label' => 'Custom Compliance Scripts',
|
||||
'category' => 'Compliance',
|
||||
'platform' => 'windows',
|
||||
'endpoint' => 'deviceManagement/deviceComplianceScripts',
|
||||
'backup' => 'full',
|
||||
'restore' => 'enabled',
|
||||
'risk' => 'medium-high',
|
||||
],
|
||||
[
|
||||
'type' => 'windowsAutopilotDeploymentProfile',
|
||||
'label' => 'Windows Autopilot Profiles',
|
||||
|
||||
@ -58,7 +58,7 @@
|
||||
|
||||
$canHighlightScripts = static function (?string $policyType): bool {
|
||||
return (bool) config('tenantpilot.display.show_script_content', false)
|
||||
&& in_array($policyType, ['deviceManagementScript', 'deviceShellScript', 'deviceHealthScript'], true);
|
||||
&& in_array($policyType, ['deviceManagementScript', 'deviceShellScript', 'deviceHealthScript', 'deviceComplianceScript'], true);
|
||||
};
|
||||
|
||||
$selectGrammar = static function (?string $policyType, string $code): string {
|
||||
|
||||
186
tests/Feature/DeviceComplianceScriptPolicyTypeTest.php
Normal file
186
tests/Feature/DeviceComplianceScriptPolicyTypeTest.php
Normal file
@ -0,0 +1,186 @@
|
||||
<?php
|
||||
|
||||
use App\Models\BackupItem;
|
||||
use App\Models\BackupSet;
|
||||
use App\Models\Policy;
|
||||
use App\Models\Tenant;
|
||||
use App\Models\User;
|
||||
use App\Services\Graph\GraphClientInterface;
|
||||
use App\Services\Graph\GraphResponse;
|
||||
use App\Services\Intune\PolicyNormalizer;
|
||||
use App\Services\Intune\RestoreService;
|
||||
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||||
|
||||
uses(RefreshDatabase::class);
|
||||
|
||||
class DeviceComplianceScriptRestoreGraphClient implements GraphClientInterface
|
||||
{
|
||||
/**
|
||||
* @var array<int, array{method:string,path:string,payload:array|null}>
|
||||
*/
|
||||
public array $requestCalls = [];
|
||||
|
||||
/**
|
||||
* @param array<int, GraphResponse> $requestResponses
|
||||
*/
|
||||
public function __construct(
|
||||
private readonly GraphResponse $applyPolicyResponse,
|
||||
private array $requestResponses = [],
|
||||
) {}
|
||||
|
||||
public function listPolicies(string $policyType, array $options = []): GraphResponse
|
||||
{
|
||||
return new GraphResponse(true, []);
|
||||
}
|
||||
|
||||
public function getPolicy(string $policyType, string $policyId, array $options = []): GraphResponse
|
||||
{
|
||||
return new GraphResponse(true, ['payload' => []]);
|
||||
}
|
||||
|
||||
public function getOrganization(array $options = []): GraphResponse
|
||||
{
|
||||
return new GraphResponse(true, []);
|
||||
}
|
||||
|
||||
public function applyPolicy(string $policyType, string $policyId, array $payload, array $options = []): GraphResponse
|
||||
{
|
||||
return $this->applyPolicyResponse;
|
||||
}
|
||||
|
||||
public function getServicePrincipalPermissions(array $options = []): GraphResponse
|
||||
{
|
||||
return new GraphResponse(true, []);
|
||||
}
|
||||
|
||||
public function request(string $method, string $path, array $options = []): GraphResponse
|
||||
{
|
||||
$this->requestCalls[] = [
|
||||
'method' => strtoupper($method),
|
||||
'path' => $path,
|
||||
'payload' => $options['json'] ?? null,
|
||||
];
|
||||
|
||||
return array_shift($this->requestResponses) ?? new GraphResponse(true, []);
|
||||
}
|
||||
}
|
||||
|
||||
it('includes device compliance scripts in supported policy types', function () {
|
||||
$supported = collect(config('tenantpilot.supported_policy_types', []))
|
||||
->keyBy('type')
|
||||
->all();
|
||||
|
||||
expect($supported)->toHaveKey('deviceComplianceScript');
|
||||
expect($supported['deviceComplianceScript']['endpoint'] ?? null)->toBe('deviceManagement/deviceComplianceScripts');
|
||||
expect($supported['deviceComplianceScript']['restore'] ?? null)->toBe('enabled');
|
||||
});
|
||||
|
||||
it('defines device compliance script graph contract with correct assignment payload key', function () {
|
||||
$contract = config('graph_contracts.types.deviceComplianceScript');
|
||||
|
||||
expect($contract)->toBeArray();
|
||||
expect($contract['resource'] ?? null)->toBe('deviceManagement/deviceComplianceScripts');
|
||||
expect($contract['assignments_create_path'] ?? null)->toBe('/deviceManagement/deviceComplianceScripts/{id}/assign');
|
||||
expect($contract['assignments_payload_key'] ?? null)->toBe('deviceHealthScriptAssignments');
|
||||
});
|
||||
|
||||
it('restores device compliance script assignments via assign action', function () {
|
||||
$client = new DeviceComplianceScriptRestoreGraphClient(
|
||||
applyPolicyResponse: new GraphResponse(true, []),
|
||||
requestResponses: [
|
||||
new GraphResponse(true, []), // assign action
|
||||
],
|
||||
);
|
||||
app()->instance(GraphClientInterface::class, $client);
|
||||
|
||||
$tenant = Tenant::factory()->create([
|
||||
'tenant_id' => 'tenant-1',
|
||||
]);
|
||||
|
||||
$policy = Policy::factory()->create([
|
||||
'tenant_id' => $tenant->id,
|
||||
'external_id' => 'dcs-1',
|
||||
'policy_type' => 'deviceComplianceScript',
|
||||
'platform' => 'windows',
|
||||
]);
|
||||
|
||||
$backupSet = BackupSet::factory()->create([
|
||||
'tenant_id' => $tenant->id,
|
||||
'status' => 'completed',
|
||||
'item_count' => 1,
|
||||
]);
|
||||
|
||||
$backupItem = BackupItem::factory()->create([
|
||||
'tenant_id' => $tenant->id,
|
||||
'backup_set_id' => $backupSet->id,
|
||||
'policy_id' => $policy->id,
|
||||
'policy_identifier' => $policy->external_id,
|
||||
'policy_type' => $policy->policy_type,
|
||||
'platform' => $policy->platform,
|
||||
'payload' => [
|
||||
'id' => $policy->external_id,
|
||||
'@odata.type' => '#microsoft.graph.deviceComplianceScript',
|
||||
],
|
||||
'assignments' => [
|
||||
[
|
||||
'id' => 'assignment-1',
|
||||
'intent' => 'apply',
|
||||
'target' => [
|
||||
'@odata.type' => '#microsoft.graph.groupAssignmentTarget',
|
||||
'groupId' => 'source-group-1',
|
||||
],
|
||||
],
|
||||
],
|
||||
]);
|
||||
|
||||
$user = User::factory()->create(['email' => 'tester@example.com']);
|
||||
$this->actingAs($user);
|
||||
|
||||
$service = app(RestoreService::class);
|
||||
$service->execute(
|
||||
tenant: $tenant,
|
||||
backupSet: $backupSet,
|
||||
selectedItemIds: [$backupItem->id],
|
||||
dryRun: false,
|
||||
actorEmail: $user->email,
|
||||
actorName: $user->name,
|
||||
groupMapping: [
|
||||
'source-group-1' => 'target-group-1',
|
||||
],
|
||||
);
|
||||
|
||||
$postCalls = collect($client->requestCalls)
|
||||
->filter(fn (array $call) => $call['method'] === 'POST')
|
||||
->values();
|
||||
|
||||
expect($postCalls)->toHaveCount(1);
|
||||
expect($postCalls[0]['path'])->toBe('/deviceManagement/deviceComplianceScripts/dcs-1/assign');
|
||||
|
||||
$payloadAssignments = $postCalls[0]['payload']['deviceHealthScriptAssignments'] ?? [];
|
||||
$groupIds = collect($payloadAssignments)->pluck('target.groupId')->all();
|
||||
|
||||
expect($groupIds)->toBe(['target-group-1']);
|
||||
expect($payloadAssignments[0])->not->toHaveKey('id');
|
||||
});
|
||||
|
||||
it('normalizes device compliance script key fields', function () {
|
||||
config([
|
||||
'tenantpilot.display.show_script_content' => false,
|
||||
]);
|
||||
|
||||
$normalized = app(PolicyNormalizer::class)->normalize([
|
||||
'@odata.type' => '#microsoft.graph.deviceComplianceScript',
|
||||
'displayName' => 'My script',
|
||||
'runAsAccount' => 'system',
|
||||
'runAs32Bit' => true,
|
||||
'enforceSignatureCheck' => false,
|
||||
'detectionScriptContent' => base64_encode("Write-Host 'hello'\n"),
|
||||
], 'deviceComplianceScript', 'windows');
|
||||
|
||||
$settings = $normalized['settings'][0]['entries'] ?? [];
|
||||
$byKey = collect($settings)->keyBy('key');
|
||||
|
||||
expect($byKey['Run as account']['value'] ?? null)->toBe('system');
|
||||
expect($byKey['Run as 32-bit']['value'] ?? null)->toBe('Enabled');
|
||||
expect($byKey['Enforce signature check']['value'] ?? null)->toBe('Disabled');
|
||||
});
|
||||
@ -35,6 +35,10 @@
|
||||
$scriptContent = "#!/bin/zsh\n".str_repeat('X', 20);
|
||||
}
|
||||
|
||||
$contentKey = in_array($policyType, ['deviceHealthScript', 'deviceComplianceScript'], true)
|
||||
? 'detectionScriptContent'
|
||||
: 'scriptContent';
|
||||
|
||||
$version = PolicyVersion::factory()->create([
|
||||
'policy_id' => $policy->id,
|
||||
'tenant_id' => $tenant->id,
|
||||
@ -43,7 +47,7 @@
|
||||
'@odata.type' => $odataType,
|
||||
'displayName' => 'Script policy',
|
||||
'description' => 'desc',
|
||||
'scriptContent' => $scriptContent,
|
||||
$contentKey => $contentKey === 'scriptContent' ? $scriptContent : base64_encode($scriptContent),
|
||||
],
|
||||
]);
|
||||
|
||||
@ -60,6 +64,7 @@
|
||||
['deviceManagementScript', '#microsoft.graph.deviceManagementScript'],
|
||||
['deviceShellScript', '#microsoft.graph.deviceShellScript'],
|
||||
['deviceHealthScript', '#microsoft.graph.deviceHealthScript'],
|
||||
['deviceComplianceScript', '#microsoft.graph.deviceComplianceScript'],
|
||||
]);
|
||||
|
||||
it('renders diff tab with highlighted script content for script policies', function () {
|
||||
@ -126,3 +131,68 @@
|
||||
? putenv("INTUNE_TENANT_ID={$originalEnv}")
|
||||
: putenv('INTUNE_TENANT_ID');
|
||||
});
|
||||
|
||||
it('renders diff tab with highlighted script content for device compliance scripts', function () {
|
||||
$originalEnv = getenv('INTUNE_TENANT_ID');
|
||||
putenv('INTUNE_TENANT_ID=');
|
||||
|
||||
$this->actingAs(User::factory()->create());
|
||||
|
||||
config([
|
||||
'tenantpilot.display.show_script_content' => true,
|
||||
'tenantpilot.display.max_script_content_chars' => 5000,
|
||||
]);
|
||||
|
||||
$tenant = Tenant::factory()->create();
|
||||
putenv('INTUNE_TENANT_ID='.$tenant->tenant_id);
|
||||
$tenant->makeCurrent();
|
||||
|
||||
$policy = Policy::factory()->create([
|
||||
'tenant_id' => $tenant->getKey(),
|
||||
'policy_type' => 'deviceComplianceScript',
|
||||
'platform' => 'windows',
|
||||
]);
|
||||
|
||||
$scriptOne = "# test\n".str_repeat("Write-Host 'one'\n", 40);
|
||||
$scriptTwo = "# test\n".str_repeat("Write-Host 'two'\n", 40);
|
||||
|
||||
$v1 = PolicyVersion::factory()->create([
|
||||
'policy_id' => $policy->getKey(),
|
||||
'tenant_id' => $tenant->getKey(),
|
||||
'version_number' => 1,
|
||||
'policy_type' => 'deviceComplianceScript',
|
||||
'platform' => 'windows',
|
||||
'snapshot' => [
|
||||
'@odata.type' => '#microsoft.graph.deviceComplianceScript',
|
||||
'displayName' => 'My compliance script',
|
||||
'detectionScriptContent' => base64_encode($scriptOne),
|
||||
],
|
||||
]);
|
||||
|
||||
$v2 = PolicyVersion::factory()->create([
|
||||
'policy_id' => $policy->getKey(),
|
||||
'tenant_id' => $tenant->getKey(),
|
||||
'version_number' => 2,
|
||||
'policy_type' => 'deviceComplianceScript',
|
||||
'platform' => 'windows',
|
||||
'snapshot' => [
|
||||
'@odata.type' => '#microsoft.graph.deviceComplianceScript',
|
||||
'displayName' => 'My compliance script',
|
||||
'detectionScriptContent' => base64_encode($scriptTwo),
|
||||
],
|
||||
]);
|
||||
|
||||
$url = \App\Filament\Resources\PolicyVersionResource::getUrl('view', ['record' => $v2]);
|
||||
|
||||
$this->get($url.'?tab=diff')
|
||||
->assertSuccessful()
|
||||
->assertSeeText('Fullscreen')
|
||||
->assertSeeText("- Write-Host 'one'")
|
||||
->assertSeeText("+ Write-Host 'two'")
|
||||
->assertSee('bg-danger-50', false)
|
||||
->assertSee('bg-success-50', false);
|
||||
|
||||
$originalEnv !== false
|
||||
? putenv("INTUNE_TENANT_ID={$originalEnv}")
|
||||
: putenv('INTUNE_TENANT_ID');
|
||||
});
|
||||
|
||||
Loading…
Reference in New Issue
Block a user