TenantAtlas/tests/Feature/Filament/SettingsCatalogRestoreTest.php

<?php

use App\Models\BackupItem;
use App\Models\BackupSet;
use App\Models\Policy;
use App\Models\Tenant;
use App\Models\User;
use App\Services\Graph\GraphClientInterface;
use App\Services\Graph\GraphResponse;
use App\Services\Intune\RestoreService;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

class SettingsCatalogRestoreGraphClient implements GraphClientInterface
{
    /**
     * @var array<int, array{policy_type:string,policy_id:string,payload:array}>
     */
    public array $applyPolicyCalls = [];

    /**
     * @var array<int, array{method:string,path:string,payload:array|null}>
     */
    public array $requestCalls = [];

    /**
     * @param  array<int, GraphResponse>  $requestResponses
     */
    public function __construct(
        private readonly GraphResponse $applyPolicyResponse,
        private array $requestResponses = [],
    ) {}

    public function listPolicies(string $policyType, array $options = []): GraphResponse
    {
        return new GraphResponse(true, []);
    }

    public function getPolicy(string $policyType, string $policyId, array $options = []): GraphResponse
    {
        return new GraphResponse(true, ['payload' => []]);
    }

    public function getOrganization(array $options = []): GraphResponse
    {
        return new GraphResponse(true, []);
    }

    public function applyPolicy(string $policyType, string $policyId, array $payload, array $options = []): GraphResponse
    {
        $this->applyPolicyCalls[] = [
            'policy_type' => $policyType,
            'policy_id' => $policyId,
            'payload' => $payload,
        ];

        return $this->applyPolicyResponse;
    }

    public function getServicePrincipalPermissions(array $options = []): GraphResponse
    {
        return new GraphResponse(true, []);
    }

    public function request(string $method, string $path, array $options = []): GraphResponse
    {
        $this->requestCalls[] = [
            'method' => strtoupper($method),
            'path' => $path,
            'payload' => $options['json'] ?? null,
        ];

        $response = array_shift($this->requestResponses);

        return $response ?? new GraphResponse(true, []);
    }
}

test('restore marks settings catalog policy as manual_required when bulk settings apply fails', function () {
    $policyResponse = new GraphResponse(
        success: true,
        data: [],
        status: 200,
        errors: [],
        warnings: [],
        meta: ['request_id' => 'req-policy', 'client_request_id' => 'client-policy'],
    );

    $graphResponse = new GraphResponse(
        success: false,
        data: ['error' => ['code' => 'BadRequest', 'message' => 'settings are read-only']],
        status: 400,
        errors: [['code' => 'BadRequest', 'message' => 'settings are read-only']],
        warnings: [],
        meta: [
            'error_code' => 'BadRequest',
            'error_message' => 'settings are read-only',
            'request_id' => 'req-123',
            'client_request_id' => 'client-abc',
        ],
    );

    $client = new SettingsCatalogRestoreGraphClient($policyResponse, [$graphResponse]);

    app()->instance(GraphClientInterface::class, $client);

    $tenant = Tenant::create([
        'tenant_id' => 'tenant-1',
        'name' => 'Tenant One',
        'metadata' => [],
    ]);

    $policy = Policy::create([
        'tenant_id' => $tenant->id,
        'external_id' => 'scp-1',
        'policy_type' => 'settingsCatalogPolicy',
        'display_name' => 'Settings Catalog Alpha',
        'platform' => 'windows',
    ]);

    $backupSet = BackupSet::create([
        'tenant_id' => $tenant->id,
        'name' => 'Backup',
        'status' => 'completed',
        'item_count' => 1,
    ]);

    $payload = [
        'id' => 'scp-1',
        'displayName' => 'Settings Catalog Alpha',
        'version' => 3,
        '@odata.type' => '#microsoft.graph.deviceManagementConfigurationPolicy',
        'createdDateTime' => '2024-01-01T00:00:00Z',
        'Settings' => [
            [
                'id' => 'setting-1',
                'settingInstance' => [
                    '@odata.type' => '#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance',
                    'settingDefinitionId' => 'setting_definition',
                    'simpleSettingValue' => [
                        '@odata.type' => '#microsoft.graph.deviceManagementConfigurationStringSettingValue',
                        'value' => 'test-value',
                    ],
                ],
            ],
        ],
        'assignments' => [
            ['id' => 'assignment-1'],
        ],
        'Platforms' => ['windows'],
    ];

    $backupItem = BackupItem::create([
        'tenant_id' => $tenant->id,
        'backup_set_id' => $backupSet->id,
        'policy_id' => $policy->id,
        'policy_identifier' => $policy->external_id,
        'policy_type' => $policy->policy_type,
        'platform' => $policy->platform,
        'payload' => $payload,
    ]);

    $user = User::factory()->create();
    $user->tenants()->syncWithoutDetaching([
        $tenant->getKey() => ['role' => 'owner'],
    ]);
    $this->actingAs($user);

    $service = app(RestoreService::class);
    $run = $service->execute(
        tenant: $tenant,
        backupSet: $backupSet,
        selectedItemIds: [$backupItem->id],
        dryRun: false,
        actorEmail: $user->email,
        actorName: $user->name,
    )->refresh();

    $result = $run->results['items'][$backupItem->id] ?? null;
    expect($result)->not->toBeNull();

    expect($run->status)->toBe('partial');
    expect($result['status'] ?? null)->toBe('manual_required');
    expect($result['settings_apply']['manual_required'] ?? null)->toBe(1);
    expect($result['settings_apply']['failed'] ?? null)->toBe(0);
    expect($result['settings_apply']['issues'][0]['graph_error_message'] ?? null)->toContain('settings are read-only');
    expect($result['settings_apply']['issues'][0]['graph_request_id'] ?? null)->toBe('req-123');
    expect($result['settings_apply']['issues'][0]['graph_client_request_id'] ?? null)->toBe('client-abc');

    expect($client->applyPolicyCalls)->toHaveCount(1);
    expect($client->applyPolicyCalls[0]['payload'])->toHaveKey('name');
    expect($client->applyPolicyCalls[0]['payload'])->not->toHaveKey('id');
    expect($client->applyPolicyCalls[0]['payload'])->not->toHaveKey('@odata.type');
    expect($client->applyPolicyCalls[0]['payload'])->not->toHaveKey('version');
    expect($client->applyPolicyCalls[0]['payload'])->not->toHaveKey('assignments');
    expect($client->applyPolicyCalls[0]['payload'])->not->toHaveKey('platforms');
    expect($client->applyPolicyCalls[0]['payload'])->not->toHaveKey('settings');

    expect($client->requestCalls)->toHaveCount(1);
    expect($client->requestCalls[0]['method'])->toBe('POST');
    expect($client->requestCalls[0]['path'])->toBe('deviceManagement/configurationPolicies/scp-1/settings');
    expect($client->requestCalls[0]['payload'])->toBeArray();
    expect($client->requestCalls[0]['payload'][0])->toHaveKey('@odata.type');
    expect($client->requestCalls[0]['payload'][0])->not->toHaveKey('id');
    expect($client->requestCalls[0]['payload'][0]['settingInstance']['@odata.type'])
        ->toBe('#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance');

    $response = $this
        ->get(route('filament.admin.resources.restore-runs.view', array_merge(filamentTenantRouteParams($tenant), ['record' => $run])));

    $response->assertOk();
    $response->assertSee('settings are read-only');
    $response->assertSee('req-123');
});

test('restore success for settings catalog uses strict payload', function () {
    $graphResponse = new GraphResponse(
        success: true,
        data: [],
        status: 200,
        errors: [],
        warnings: [],
        meta: ['request_id' => 'req-success', 'client_request_id' => 'client-success'],
    );

    $client = new SettingsCatalogRestoreGraphClient($graphResponse);

    app()->instance(GraphClientInterface::class, $client);

    $tenant = Tenant::create([
        'tenant_id' => 'tenant-2',
        'name' => 'Tenant Two',
        'metadata' => [],
    ]);

    $policy = Policy::create([
        'tenant_id' => $tenant->id,
        'external_id' => 'scp-2',
        'policy_type' => 'settingsCatalogPolicy',
        'display_name' => 'Settings Catalog Beta',
        'platform' => 'windows',
    ]);

    $backupSet = BackupSet::create([
        'tenant_id' => $tenant->id,
        'name' => 'Backup',
        'status' => 'completed',
        'item_count' => 1,
    ]);

    $payload = [
        'displayName' => 'Settings Catalog Beta',
        'Description' => 'desc',
        'Platforms' => ['windows'],
        'Settings' => [
            [
                'id' => 'setting-1',
                'settingInstance' => [
                    '@odata.type' => '#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance',
                    'settingDefinitionId' => 'test_setting',
                    'choiceSettingValue' => [
                        'value' => 'test_value',
                    ],
                ],
            ],
        ],
    ];

    $backupItem = BackupItem::create([
        'tenant_id' => $tenant->id,
        'backup_set_id' => $backupSet->id,
        'policy_id' => $policy->id,
        'policy_identifier' => $policy->external_id,
        'policy_type' => $policy->policy_type,
        'platform' => $policy->platform,
        'payload' => $payload,
    ]);

    $user = User::factory()->create();
    $this->actingAs($user);

    $service = app(RestoreService::class);
    $run = $service->execute(
        tenant: $tenant,
        backupSet: $backupSet,
        selectedItemIds: [$backupItem->id],
        dryRun: false,
        actorEmail: $user->email,
        actorName: $user->name,
    )->refresh();

    expect($run->status)->toBe('completed');
    expect($client->applyPolicyCalls)->toHaveCount(1);
    expect($client->applyPolicyCalls[0]['payload'])->toHaveKeys(['name', 'description']);
    expect($client->applyPolicyCalls[0]['payload'])->not->toHaveKey('platforms');
    expect($client->applyPolicyCalls[0]['payload'])->not->toHaveKey('Platforms');
    expect($client->applyPolicyCalls[0]['payload'])->not->toHaveKey('settings');
    expect($client->applyPolicyCalls[0]['payload']['name'])->toBe('Settings Catalog Beta');
    expect($client->applyPolicyCalls[0]['payload']['description'])->toBe('desc');

    expect($client->requestCalls)->toHaveCount(1);
    expect($client->requestCalls[0]['method'])->toBe('POST');
    expect($client->requestCalls[0]['path'])->toBe('deviceManagement/configurationPolicies/scp-2/settings');

    // Ensure we preserved settingInstance @odata.type and stripped ids in the bulk call
    expect($client->requestCalls[0]['payload'][0])->toHaveKey('@odata.type');
    expect($client->requestCalls[0]['payload'][0]['@odata.type'])->toBe('#microsoft.graph.deviceManagementConfigurationSetting');
    expect($client->requestCalls[0]['payload'][0])->not->toHaveKey('id');
    expect($client->requestCalls[0]['payload'][0]['settingInstance'])->toHaveKey('@odata.type');
    expect($client->requestCalls[0]['payload'][0]['settingInstance']['@odata.type'])
        ->toBe('#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance');
});

test('restore retries bulk apply with wrapped payload when graph expects json object', function () {
    $policyResponse = new GraphResponse(
        success: true,
        data: [],
        status: 200,
        errors: [],
        warnings: [],
        meta: ['request_id' => 'req-policy', 'client_request_id' => 'client-policy'],
    );

    $firstResponse = new GraphResponse(
        success: false,
        data: ['error' => ['code' => 'BadRequest', 'message' => 'Empty Payload. JSON content expected.']],
        status: 400,
        errors: [['code' => 'BadRequest', 'message' => 'Empty Payload. JSON content expected.']],
        warnings: [],
        meta: [
            'error_code' => 'BadRequest',
            'error_message' => 'Empty Payload. JSON content expected.',
            'request_id' => 'req-1',
            'client_request_id' => 'client-1',
        ],
    );

    $secondResponse = new GraphResponse(
        success: true,
        data: [],
        status: 200,
        errors: [],
        warnings: [],
        meta: ['request_id' => 'req-2', 'client_request_id' => 'client-2'],
    );

    $client = new SettingsCatalogRestoreGraphClient($policyResponse, [$firstResponse, $secondResponse]);

    app()->instance(GraphClientInterface::class, $client);

    $tenant = Tenant::create([
        'tenant_id' => 'tenant-4',
        'name' => 'Tenant Four',
        'metadata' => [],
    ]);

    $policy = Policy::create([
        'tenant_id' => $tenant->id,
        'external_id' => 'scp-4',
        'policy_type' => 'settingsCatalogPolicy',
        'display_name' => 'Settings Catalog Delta',
        'platform' => 'windows',
    ]);

    $backupSet = BackupSet::create([
        'tenant_id' => $tenant->id,
        'name' => 'Backup',
        'status' => 'completed',
        'item_count' => 1,
    ]);

    $payload = [
        'displayName' => 'Settings Catalog Delta',
        'Settings' => [
            [
                'id' => 'setting-1',
                'settingInstance' => [
                    '@odata.type' => '#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance',
                    'settingDefinitionId' => 'test_setting',
                    'simpleSettingValue' => [
                        '@odata.type' => '#microsoft.graph.deviceManagementConfigurationIntegerSettingValue',
                        'value' => 5,
                    ],
                ],
            ],
        ],
    ];

    $backupItem = BackupItem::create([
        'tenant_id' => $tenant->id,
        'backup_set_id' => $backupSet->id,
        'policy_id' => $policy->id,
        'policy_identifier' => $policy->external_id,
        'policy_type' => $policy->policy_type,
        'platform' => $policy->platform,
        'payload' => $payload,
    ]);

    $user = User::factory()->create();
    $this->actingAs($user);

    $service = app(RestoreService::class);
    $run = $service->execute(
        tenant: $tenant,
        backupSet: $backupSet,
        selectedItemIds: [$backupItem->id],
        dryRun: false,
        actorEmail: $user->email,
        actorName: $user->name,
    )->refresh();

    expect($run->status)->toBe('completed');
    expect($client->requestCalls)->toHaveCount(2);
    expect($client->requestCalls[0]['payload'])->toHaveKey(0);
    expect($client->requestCalls[1]['payload'])->toHaveKey('settings');
});

test('restore creates a new policy when settings endpoint is unsupported', function () {
    $policyResponse = new GraphResponse(
        success: true,
        data: [],
        status: 200,
        errors: [],
        warnings: [],
        meta: ['request_id' => 'req-policy', 'client_request_id' => 'client-policy'],
    );

    $settingsResponse = new GraphResponse(
        success: false,
        data: ['error' => ['code' => 'BadRequest', 'message' => 'No OData route exists that match template']],
        status: 400,
        errors: [['code' => 'BadRequest', 'message' => 'No OData route exists that match template']],
        warnings: [],
        meta: [
            'error_code' => 'No method match route template',
            'error_message' => 'No OData route exists that match template',
            'request_id' => 'req-unsupported',
            'client_request_id' => 'client-unsupported',
        ],
    );

    $createFailResponse = new GraphResponse(
        success: false,
        data: ['error' => ['code' => 'NotSupported', 'message' => 'NotSupported']],
        status: 400,
        errors: [['code' => 'NotSupported', 'message' => 'NotSupported']],
        warnings: [],
        meta: [
            'error_code' => 'NotSupported',
            'error_message' => 'NotSupported',
            'request_id' => 'req-create-fail',
            'client_request_id' => 'client-create-fail',
        ],
    );

    $createSuccessResponse = new GraphResponse(
        success: true,
        data: ['id' => 'new-policy-123'],
        status: 201,
        errors: [],
        warnings: [],
        meta: ['request_id' => 'req-create', 'client_request_id' => 'client-create'],
    );

    $client = new SettingsCatalogRestoreGraphClient($policyResponse, [$settingsResponse, $createFailResponse, $createSuccessResponse]);

    app()->instance(GraphClientInterface::class, $client);

    $tenant = Tenant::create([
        'tenant_id' => 'tenant-5',
        'name' => 'Tenant Five',
        'metadata' => [],
    ]);

    $policy = Policy::create([
        'tenant_id' => $tenant->id,
        'external_id' => 'scp-5',
        'policy_type' => 'settingsCatalogPolicy',
        'display_name' => 'Settings Catalog Epsilon',
        'platform' => 'windows',
    ]);

    $backupSet = BackupSet::create([
        'tenant_id' => $tenant->id,
        'name' => 'Backup',
        'status' => 'completed',
        'item_count' => 1,
    ]);

    $payload = [
        'displayName' => 'Settings Catalog Epsilon',
        'platforms' => ['windows'],
        'technologies' => ['mdm'],
        'Settings' => [
            [
                'id' => 'setting-1',
                'settingInstance' => [
                    '@odata.type' => '#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance',
                    'settingDefinitionId' => 'test_setting',
                    'simpleSettingValue' => [
                        '@odata.type' => '#microsoft.graph.deviceManagementConfigurationIntegerSettingValue',
                        'value' => 8,
                    ],
                ],
            ],
        ],
    ];

    $backupItem = BackupItem::create([
        'tenant_id' => $tenant->id,
        'backup_set_id' => $backupSet->id,
        'policy_id' => $policy->id,
        'policy_identifier' => $policy->external_id,
        'policy_type' => $policy->policy_type,
        'platform' => $policy->platform,
        'payload' => $payload,
    ]);

    $user = User::factory()->create();
    $this->actingAs($user);

    $service = app(RestoreService::class);
    $run = $service->execute(
        tenant: $tenant,
        backupSet: $backupSet,
        selectedItemIds: [$backupItem->id],
        dryRun: false,
        actorEmail: $user->email,
        actorName: $user->name,
    )->refresh();

    $result = $run->results['items'][$backupItem->id] ?? null;
    expect($result)->not->toBeNull();

    expect($run->status)->toBe('partial');
    expect($result['status'] ?? null)->toBe('partial');
    expect($result['created_policy_id'] ?? null)->toBe('new-policy-123');
    expect($result['created_policy_mode'] ?? null)->toBe('metadata_only');
    expect($result['settings_apply']['created_policy_id'] ?? null)->toBe('new-policy-123');
    expect($result['settings_apply']['created_policy_mode'] ?? null)->toBe('metadata_only');

    expect($client->requestCalls)->toHaveCount(3);
    expect($client->requestCalls[0]['path'])->toBe('deviceManagement/configurationPolicies/scp-5/settings');
    expect($client->requestCalls[1]['path'])->toBe('deviceManagement/configurationPolicies');
    expect($client->requestCalls[1]['payload'])->toHaveKey('settings');
    expect($client->requestCalls[1]['payload'])->toHaveKey('name');
    expect($client->requestCalls[1]['payload']['name'])->toBe('Restored_Settings Catalog Epsilon');
    expect($client->requestCalls[2]['path'])->toBe('deviceManagement/configurationPolicies');
    expect($client->requestCalls[2]['payload'])->not->toHaveKey('settings');
    expect($client->requestCalls[2]['payload'])->toHaveKey('name');
    expect($client->requestCalls[2]['payload']['name'])->toBe('Restored_Settings Catalog Epsilon');
});