app/Filament/Resources/RestoreRunResource.php

@@ -195,21 +195,50 @@ public static function getWizardSteps(): array
 
                             if ($state === 'all') {
                                 $set('backup_item_ids', null);
+
+                                return;
                             }
+
+                            $set('backup_item_ids', []);
                         })
                         ->required(),
-                    Forms\Components\CheckboxList::make('backup_item_ids')
+                    Forms\Components\Select::make('backup_item_ids')
                         ->label('Items to restore')
-                        ->options(fn (Get $get) => static::restoreItemOptionData($get('backup_set_id'))['options'])
-                        ->descriptions(fn (Get $get) => static::restoreItemOptionData($get('backup_set_id'))['descriptions'])
-                        ->columns(1)
+                        ->multiple()
                         ->searchable()
-                        ->bulkToggleable()
+                        ->searchValues()
+                        ->searchDebounce(400)
+                        ->optionsLimit(300)
+                        ->options(fn (Get $get) => static::restoreItemGroupedOptions($get('backup_set_id')))
                         ->reactive()
                         ->afterStateUpdated(fn (Set $set) => $set('group_mapping', []))
                         ->visible(fn (Get $get): bool => $get('scope_mode') === 'selected')
                         ->required(fn (Get $get): bool => $get('scope_mode') === 'selected')
-                        ->helperText('Search by name, type, or ID. Include foundations (scope tags, assignment filters) with policies to re-map IDs.'),
+                        ->hintActions([
+                            Actions\Action::make('select_all_backup_items')
+                                ->label('Select all')
+                                ->icon('heroicon-o-check')
+                                ->color('gray')
+                                ->visible(fn (Get $get): bool => filled($get('backup_set_id')) && $get('scope_mode') === 'selected')
+                                ->action(function (Get $get, Set $set): void {
+                                    $groupedOptions = static::restoreItemGroupedOptions($get('backup_set_id'));
+
+                                    $allItemIds = [];
+
+                                    foreach ($groupedOptions as $options) {
+                                        $allItemIds = array_merge($allItemIds, array_keys($options));
+                                    }
+
+                                    $set('backup_item_ids', array_values($allItemIds), shouldCallUpdatedHooks: true);
+                                }),
+                            Actions\Action::make('clear_backup_items')
+                                ->label('Clear')
+                                ->icon('heroicon-o-x-mark')
+                                ->color('gray')
+                                ->visible(fn (Get $get): bool => $get('scope_mode') === 'selected')
+                                ->action(fn (Set $set) => $set('backup_item_ids', [], shouldCallUpdatedHooks: true)),
+                        ])
+                        ->helperText('Search by name or ID. Include foundations (scope tags, assignment filters) with policies to re-map IDs. Options are grouped by category, type, and platform.'),
                     Section::make('Group mapping')
                         ->description('Some source groups do not exist in the target tenant. Map them or choose Skip.')
                         ->schema(function (Get $get): array {
@@ -754,6 +783,61 @@ private static function restoreItemOptionData(?int $backupSetId): array
         });
     }
 
+    /**
+     * @return array<string, array<int|string, string>>
+     */
+    private static function restoreItemGroupedOptions(?int $backupSetId): array
+    {
+        $tenant = Tenant::current();
+
+        if (! $tenant || ! $backupSetId) {
+            return [];
+        }
+
+        $items = BackupItem::query()
+            ->where('backup_set_id', $backupSetId)
+            ->whereHas('backupSet', fn ($query) => $query->where('tenant_id', $tenant->getKey()))
+            ->where(function ($query) {
+                $query->whereNull('policy_id')
+                    ->orWhereDoesntHave('policy')
+                    ->orWhereHas('policy', fn ($policyQuery) => $policyQuery->whereNull('ignored_at'));
+            })
+            ->with(['policy:id,display_name'])
+            ->get()
+            ->sortBy(function (BackupItem $item) {
+                $meta = static::typeMeta($item->policy_type);
+                $category = $meta['category'] ?? 'Policies';
+                $categoryKey = $category === 'Foundations' ? 'zz-'.$category : $category;
+                $typeLabel = $meta['label'] ?? $item->policy_type;
+                $platform = $item->platform ?? $meta['platform'] ?? null;
+                $name = strtolower($item->resolvedDisplayName());
+
+                return strtolower($categoryKey.'-'.$typeLabel.'-'.$platform.'-'.$name);
+            });
+
+        $groups = [];
+
+        foreach ($items as $item) {
+            $meta = static::typeMeta($item->policy_type);
+            $typeLabel = $meta['label'] ?? $item->policy_type;
+            $category = $meta['category'] ?? 'Policies';
+            $platform = $item->platform ?? $meta['platform'] ?? 'all';
+            $restoreMode = $meta['restore'] ?? 'enabled';
+
+            $groupLabel = implode(' • ', array_filter([
+                $category,
+                $typeLabel,
+                $platform,
+                $restoreMode === 'preview-only' ? 'preview-only' : null,
+            ]));
+
+            $groups[$groupLabel] ??= [];
+            $groups[$groupLabel][$item->id] = $item->resolvedDisplayName();
+        }
+
+        return $groups;
+    }
+
     public static function createRestoreRun(array $data): RestoreRun
     {
         /** @var Tenant $tenant */

specs/011-restore-run-wizard/tasks.md

@@ -17,9 +17,9 @@ ## Phase 2 — Filament Wizard (Create Restore Run)
 - [x] T007 Enforce “dry-run default ON” and keep execute disabled until all gates satisfied.
 
 ## Phase 3 — Restore Scope UX
-- [ ] T008 Implement scoped selection UI grouped by policy type + platform with search and bulk toggle.
-- [ ] T009 Mark preview-only types clearly and ensure they never execute.
-- [ ] T010 Ensure foundations are discoverable (assignment filters, scope tags, notification templates).
+- [x] T008 Implement scoped selection UI grouped by policy type + platform with search and bulk toggle.
+- [x] T009 Mark preview-only types clearly and ensure they never execute.
+- [x] T010 Ensure foundations are discoverable (assignment filters, scope tags, notification templates).
 
 ## Phase 4 — Safety & Conflict Checks
 - [ ] T011 Implement `RestoreRiskChecker` (server-side) and persist `check_summary` + `check_results`.
@@ -38,8 +38,8 @@ ## Phase 7 — Tests + Formatting
 - [ ] T018 Add Pest tests for wizard gating rules and status transitions.
 - [ ] T019 Add Pest tests for safety checks persistence and blocking behavior.
 - [ ] T020 Add Pest tests for preview summary generation.
-- [ ] T021 Run `./vendor/bin/pint --dirty`.
-- [ ] T022 Run targeted tests (e.g. `./vendor/bin/sail artisan test --filter=RestoreRunWizard` once tests exist).
+- [x] T021 Run `./vendor/bin/pint --dirty`.
+- [x] T022 Run targeted tests (e.g. `./vendor/bin/sail artisan test --filter=RestoreRunWizard` once tests exist).
 
 ## Phase 8 — Policy Version Entry Point (later)
 - [ ] T023 Add a “Restore via Wizard” action on `PolicyVersion` that creates a 1-item Backup Set (source = policy_version) and opens the Restore Run wizard prefilled/scoped to that item.

tests/Feature/Filament/RestoreItemSelectionTest.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Filament\Resources\RestoreRunResource;
 use App\Filament\Resources\RestoreRunResource\Pages\CreateRestoreRun;
 use App\Models\BackupItem;
 use App\Models\BackupSet;
@@ -11,7 +12,7 @@
 
 uses(RefreshDatabase::class);
 
-test('restore selection shows readable labels and descriptions', function () {
+test('restore selection options are grouped and filter ignored policies', function () {
     $tenant = Tenant::factory()->create(['status' => 'active']);
     $tenant->makeCurrent();
 
@@ -22,6 +23,13 @@
         'display_name' => 'Policy Display',
         'platform' => 'windows',
     ]);
+    $previewOnlyPolicy = Policy::factory()->create([
+        'tenant_id' => $tenant->id,
+        'external_id' => 'policy-preview-only',
+        'policy_type' => 'conditionalAccessPolicy',
+        'display_name' => 'Conditional Access Policy',
+        'platform' => 'all',
+    ]);
     $ignoredPolicy = Policy::factory()->create([
         'tenant_id' => $tenant->id,
         'external_id' => 'policy-ignored',
@@ -32,10 +40,10 @@
     ]);
 
     $backupSet = BackupSet::factory()->for($tenant)->create([
-        'item_count' => 2,
+        'item_count' => 4,
     ]);
 
-    BackupItem::factory()
+    $policyItem = BackupItem::factory()
         ->for($tenant)
         ->for($backupSet)
         ->state([
@@ -47,7 +55,7 @@
         ])
         ->create();
 
-    BackupItem::factory()
+    $ignoredPolicyItem = BackupItem::factory()
         ->for($tenant)
         ->for($backupSet)
         ->state([
@@ -59,7 +67,7 @@
         ])
         ->create();
 
-    BackupItem::factory()
+    $scopeTagItem = BackupItem::factory()
         ->for($tenant)
         ->for($backupSet)
         ->state([
@@ -77,6 +85,18 @@
         ])
         ->create();
 
+    $previewOnlyItem = BackupItem::factory()
+        ->for($tenant)
+        ->for($backupSet)
+        ->state([
+            'policy_id' => $previewOnlyPolicy->id,
+            'policy_identifier' => $previewOnlyPolicy->external_id,
+            'policy_type' => $previewOnlyPolicy->policy_type,
+            'platform' => $previewOnlyPolicy->platform,
+            'payload' => ['id' => $previewOnlyPolicy->external_id],
+        ])
+        ->create();
+
     $user = User::factory()->create();
     $this->actingAs($user);
 
@@ -88,13 +108,29 @@
         ->fillForm([
             'scope_mode' => 'selected',
         ])
-        ->assertSee('Policy Display')
-        ->assertDontSee('Ignored Policy')
-        ->assertSee('Scope Tag Alpha')
-        ->assertSee('Settings Catalog Policy')
-        ->assertSee('Scope Tag')
-        ->assertSee('restore: enabled')
-        ->assertSee('id: policy-1')
-        ->assertSee('id: tag-1')
+        ->assertFormFieldVisible('backup_item_ids')
         ->assertSee('Include foundations');
+
+    $method = new ReflectionMethod(RestoreRunResource::class, 'restoreItemGroupedOptions');
+    $method->setAccessible(true);
+
+    $groupedOptions = $method->invoke(null, $backupSet->id);
+
+    expect($groupedOptions)->toHaveKey('Configuration • Settings Catalog Policy • windows');
+    expect($groupedOptions)->toHaveKey('Foundations • Scope Tag • all');
+    expect($groupedOptions)->toHaveKey('Conditional Access • Conditional Access • all • preview-only');
+
+    $flattenedOptions = collect($groupedOptions)
+        ->reduce(fn (array $carry, array $options): array => $carry + $options, []);
+
+    expect($flattenedOptions)->toHaveKey($policyItem->id);
+    expect($flattenedOptions[$policyItem->id])->toBe('Policy Display');
+
+    expect($flattenedOptions)->not->toHaveKey($ignoredPolicyItem->id);
+
+    expect($flattenedOptions)->toHaveKey($scopeTagItem->id);
+    expect($flattenedOptions[$scopeTagItem->id])->toBe('Scope Tag Alpha');
+
+    expect($flattenedOptions)->toHaveKey($previewOnlyItem->id);
+    expect($flattenedOptions[$previewOnlyItem->id])->toBe('Conditional Access Policy');
 });