merge: agent session work

config/graph_contracts.php

@@ -19,6 +19,8 @@
             'type_family' => [
                 '#microsoft.graph.deviceConfiguration',
                 '#microsoft.graph.windows10CustomConfiguration',
+                '#microsoft.graph.windows10GeneralConfiguration',
+                '#microsoft.graph.windowsHealthMonitoringConfiguration',
                 '#microsoft.graph.iosGeneralDeviceConfiguration',
                 '#microsoft.graph.androidGeneralDeviceConfiguration',
                 '#microsoft.graph.macOSGeneralDeviceConfiguration',
@@ -165,6 +167,8 @@
                 '#microsoft.graph.windows10CompliancePolicy',
                 '#microsoft.graph.iosCompliancePolicy',
                 '#microsoft.graph.androidCompliancePolicy',
+                '#microsoft.graph.androidDeviceOwnerCompliancePolicy',
+                '#microsoft.graph.androidWorkProfileCompliancePolicy',
                 '#microsoft.graph.macOSCompliancePolicy',
             ],
             'create_method' => 'POST',
@@ -190,6 +194,7 @@
                 '#microsoft.graph.targetedManagedAppProtection',
                 '#microsoft.graph.iosManagedAppProtection',
                 '#microsoft.graph.androidManagedAppProtection',
+                '#microsoft.graph.windowsManagedAppProtection',
                 '#microsoft.graph.windowsInformationProtectionPolicy',
                 '#microsoft.graph.mdmWindowsInformationProtectionPolicy',
             ],
@@ -289,6 +294,8 @@
             'type_family' => [
                 '#microsoft.graph.deviceEnrollmentConfiguration',
                 '#microsoft.graph.windows10EnrollmentCompletionPageConfiguration',
+                '#microsoft.graph.deviceEnrollmentWindowsHelloForBusinessConfiguration',
+                '#microsoft.graph.windowsRestoreDeviceEnrollmentConfiguration',
             ],
             'create_method' => 'POST',
             'update_method' => 'PATCH',

specs/011-restore-run-wizard/tasks.md

@@ -38,6 +38,7 @@ ## Phase 7 — Tests + Formatting
 - [x] T018 Add Pest tests for wizard gating rules and status transitions.
 - [x] T019 Add Pest tests for safety checks persistence and blocking behavior.
 - [x] T020 Add Pest tests for preview summary generation.
+- [x] T024 Fix Graph contract type families to accept valid derived @odata.type values during restore.
 - [x] T021 Run `./vendor/bin/pint --dirty`.
 - [x] T022 Run targeted tests (e.g. `./vendor/bin/sail artisan test --filter=RestoreRunWizard` once tests exist).
 

specs/012-windows-update-rings/plan.md

@@ -0,0 +1,15 @@
+# Implementation Plan: Windows Update Rings (012)
+
+**Branch**: `feat/012-windows-update-rings`  
+**Date**: 2025-12-31  
+**Spec Source**: [spec.md](./spec.md)
+
+## Summary
+Make `windowsUpdateRing` snapshots/restores accurate by correctly capturing and applying its settings, and present a readable normalized view in Filament.
+
+## Execution Steps
+1.  **Graph contract verification**: Ensure `config/graph_contracts.php` entry for `windowsUpdateRing` is correct and complete.
+2.  **Snapshot capture hydration**: Extend `PolicySnapshotService` to correctly hydrate `windowsUpdateForBusinessConfiguration` settings into the policy payload.
+3.  **Restore**: Extend `RestoreService` to apply `windowsUpdateRing` settings from a snapshot to the target policy in Intune.
+4.  **UI normalization**: Add a dedicated normalizer for `windowsUpdateRing` that renders configured settings as readable rows in the Filament UI.
+5.  **Tests + formatting**: Add targeted Pest tests for snapshot hydration, normalized display, and restore functionality. Run `./vendor/bin/pint --dirty` and the affected tests.

specs/012-windows-update-rings/spec.md

@@ -0,0 +1,45 @@
+# Feature Specification: Windows Update Rings (012)
+
+**Feature Branch**: `feat/012-windows-update-rings`  
+**Created**: 2025-12-31  
+**Status**: Draft  
+**Input**: `config/graph_contracts.php` (windowsUpdateRing scope)
+
+## Overview
+Add reliable coverage for **Windows Update Rings** (`windowsUpdateRing`) in the existing inventory/backup/version/restore flows.
+
+This policy type is defined in `graph_contracts.php` and uses the `deviceManagement/deviceConfigurations` endpoint, identified by the `@odata.type` `#microsoft.graph.windowsUpdateForBusinessConfiguration`. This feature will focus on implementing the necessary UI normalization and ensuring the sync, backup, versioning, and restore flows function correctly for this policy type.
+
+## In Scope
+- Policy type: `windowsUpdateRing`
+- Sync: Policies with `@odata.type` of `#microsoft.graph.windowsUpdateForBusinessConfiguration` should be correctly identified and synced as `windowsUpdateRing` policies.
+- Snapshot capture: Full snapshot of all settings within a Windows Update Ring policy.
+- Restore: Restore a Windows Update Ring policy from a snapshot.
+- UI: Display the settings of a Windows Update Ring policy in a readable, normalized format.
+
+## Out of Scope (v1)
+- Advanced analytics or reporting on update compliance.
+- Per-setting partial restore.
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 — Inventory + readable view
+As an admin, I can see my Windows Update Ring policies in the policy list and view their configured settings in a clear, understandable format.
+
+**Acceptance**
+1. Windows Update Ring policies are listed in the main policy table with the correct type name.
+2. The policy detail view shows a structured list/table of configured settings (e.g., "Quality update deferral period", "Automatic update behavior").
+3. Policy Versions store the snapshot and render the settings in the “Normalized settings” view.
+
+### User Story 2 — Backup/Version capture
+As an admin, when I back up or create a new version of a Windows Update Ring policy, the snapshot contains all its settings.
+
+**Acceptance**
+1. The backup/version payload in the `snapshot` column contains all the properties of the `windowsUpdateForBusinessConfiguration` object.
+
+### User Story 3 — Restore settings
+As an admin, I can restore a Windows Update Ring policy from a backup or a previous version.
+
+**Acceptance**
+1. The restore operation correctly applies the settings from the snapshot to the target policy in Intune.
+2. The restore process is audited.

specs/012-windows-update-rings/tasks.md

@@ -0,0 +1,23 @@
+# Tasks: Windows Update Rings (012)
+
+**Branch**: `feat/012-windows-update-rings` | **Date**: 2025-12-31  
+**Input**: [spec.md](./spec.md), [plan.md](./plan.md)
+
+## Phase 1: Contracts + Snapshot Hydration
+- [ ] T001 Verify `config/graph_contracts.php` for `windowsUpdateRing` (resource, allowed_select, type_family, etc.).
+- [ ] T002 Extend `PolicySnapshotService` to hydrate `windowsUpdateForBusinessConfiguration` settings.
+
+## Phase 2: Restore
+- [ ] T003 Implement restore apply for `windowsUpdateRing` settings in `RestoreService.php`.
+
+## Phase 3: UI Normalization
+- [ ] T004 Add `WindowsUpdateRingNormalizer` and register it (Policy “Normalized settings” is readable).
+
+## Phase 4: Tests + Verification
+- [ ] T005 Add tests for hydration + UI display.
+- [ ] T006 Add tests for restore apply.
+- [ ] T007 Run tests (targeted).
+- [ ] T008 Run Pint (`./vendor/bin/pint --dirty`).
+
+## Open TODOs (Follow-up)
+- None yet.

tests/Pest.php

@@ -17,6 +17,9 @@
     ->use(RefreshDatabase::class)
     ->in('Feature');
 
+pest()->extend(Tests\TestCase::class)
+    ->in('Unit');
+
 beforeEach(function () {
     putenv('INTUNE_TENANT_ID');
     unset($_ENV['INTUNE_TENANT_ID'], $_SERVER['INTUNE_TENANT_ID']);

tests/Unit/ODataTypeValidationTest.php

@@ -0,0 +1,38 @@
+<?php
+
+use App\Models\BackupItem;
+
+it('accepts derived deviceConfiguration odata types', function (string $odataType) {
+    $result = BackupItem::validateODataType(['@odata.type' => $odataType], 'deviceConfiguration', 'all');
+
+    expect($result['matches'])->toBeTrue();
+})->with([
+    '#microsoft.graph.windows10GeneralConfiguration',
+    '#microsoft.graph.windowsHealthMonitoringConfiguration',
+]);
+
+it('accepts derived deviceCompliancePolicy odata types', function (string $odataType) {
+    $result = BackupItem::validateODataType(['@odata.type' => $odataType], 'deviceCompliancePolicy', 'all');
+
+    expect($result['matches'])->toBeTrue();
+})->with([
+    '#microsoft.graph.androidDeviceOwnerCompliancePolicy',
+    '#microsoft.graph.androidWorkProfileCompliancePolicy',
+]);
+
+it('accepts derived appProtectionPolicy odata types', function (string $odataType) {
+    $result = BackupItem::validateODataType(['@odata.type' => $odataType], 'appProtectionPolicy', 'mobile');
+
+    expect($result['matches'])->toBeTrue();
+})->with([
+    '#microsoft.graph.windowsManagedAppProtection',
+]);
+
+it('accepts derived enrollmentRestriction odata types', function (string $odataType) {
+    $result = BackupItem::validateODataType(['@odata.type' => $odataType], 'enrollmentRestriction', 'all');
+
+    expect($result['matches'])->toBeTrue();
+})->with([
+    '#microsoft.graph.deviceEnrollmentWindowsHelloForBusinessConfiguration',
+    '#microsoft.graph.windowsRestoreDeviceEnrollmentConfiguration',
+]);