## Summary - add Intune RBAC role definitions and role assignments as foundation-backed inventory, backup, and versioned snapshot types - add RBAC-specific normalization, coverage, permission-warning handling, and preview-only restore safety behavior across existing Filament and service surfaces - add spec 127 artifacts, contracts, audits, and focused regression coverage for inventory, backup, versioning, verification, and authorization behavior ## Testing - `vendor/bin/sail bin pint --dirty --format agent` - `vendor/bin/sail artisan test --compact tests/Feature/Inventory/InventorySyncServiceTest.php tests/Feature/Filament/InventoryCoverageTableTest.php tests/Feature/FoundationBackupTest.php tests/Feature/Filament/RestoreExecutionTest.php tests/Feature/RestoreUnknownPolicyTypeSafetyTest.php tests/Unit/GraphContractRegistryTest.php tests/Unit/FoundationSnapshotServiceTest.php tests/Feature/Verification/IntuneRbacPermissionCoverageTest.php tests/Unit/IntuneRoleDefinitionNormalizerTest.php tests/Unit/IntuneRoleAssignmentNormalizerTest.php` ## Notes - tasks in `specs/127-rbac-inventory-backup/tasks.md` are complete except `T041`, which is the documented manual QA validation step Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #155
124 lines
3.1 KiB
PHP
124 lines
3.1 KiB
PHP
<?php
|
|
|
|
namespace App\Models;
|
|
|
|
use App\Support\Concerns\DerivesWorkspaceIdFromTenant;
|
|
use App\Support\Concerns\InteractsWithODataTypes;
|
|
use Illuminate\Database\Eloquent\Factories\HasFactory;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Database\Eloquent\Relations\BelongsTo;
|
|
use Illuminate\Database\Eloquent\SoftDeletes;
|
|
|
|
class BackupItem extends Model
|
|
{
|
|
use DerivesWorkspaceIdFromTenant;
|
|
use HasFactory;
|
|
use InteractsWithODataTypes;
|
|
use SoftDeletes;
|
|
|
|
protected $guarded = [];
|
|
|
|
protected $casts = [
|
|
'payload' => 'array',
|
|
'metadata' => 'array',
|
|
'assignments' => 'array',
|
|
'captured_at' => 'datetime',
|
|
];
|
|
|
|
public function tenant(): BelongsTo
|
|
{
|
|
return $this->belongsTo(Tenant::class);
|
|
}
|
|
|
|
public function backupSet(): BelongsTo
|
|
{
|
|
return $this->belongsTo(BackupSet::class);
|
|
}
|
|
|
|
public function policy(): BelongsTo
|
|
{
|
|
return $this->belongsTo(Policy::class);
|
|
}
|
|
|
|
public function policyVersion(): BelongsTo
|
|
{
|
|
return $this->belongsTo(PolicyVersion::class);
|
|
}
|
|
|
|
// Assignment helpers
|
|
public function getAssignmentCountAttribute(): int
|
|
{
|
|
return count($this->assignments ?? []);
|
|
}
|
|
|
|
public function hasAssignments(): bool
|
|
{
|
|
return ! empty($this->assignments);
|
|
}
|
|
|
|
public function getGroupIdsAttribute(): array
|
|
{
|
|
return collect($this->assignments ?? [])
|
|
->pluck('target.groupId')
|
|
->filter()
|
|
->unique()
|
|
->values()
|
|
->toArray();
|
|
}
|
|
|
|
public function getScopeTagIdsAttribute(): array
|
|
{
|
|
return $this->metadata['scope_tag_ids'] ?? ['0'];
|
|
}
|
|
|
|
public function getScopeTagNamesAttribute(): array
|
|
{
|
|
return $this->metadata['scope_tag_names'] ?? ['Default'];
|
|
}
|
|
|
|
public function hasOrphanedAssignments(): bool
|
|
{
|
|
return $this->metadata['has_orphaned_assignments'] ?? false;
|
|
}
|
|
|
|
public function assignmentsFetchFailed(): bool
|
|
{
|
|
return $this->metadata['assignments_fetch_failed'] ?? false;
|
|
}
|
|
|
|
public function isFoundation(): bool
|
|
{
|
|
$types = array_column(config('tenantpilot.foundation_types', []), 'type');
|
|
|
|
return in_array($this->policy_type, $types, true);
|
|
}
|
|
|
|
public function resolvedDisplayName(): string
|
|
{
|
|
$metadata = $this->metadata ?? [];
|
|
$payload = is_array($this->payload) ? $this->payload : [];
|
|
$versionSnapshot = is_array($this->policyVersion?->snapshot) ? $this->policyVersion->snapshot : [];
|
|
$name = $metadata['displayName']
|
|
?? $metadata['display_name']
|
|
?? $payload['displayName']
|
|
?? $payload['name']
|
|
?? $versionSnapshot['displayName']
|
|
?? $versionSnapshot['name']
|
|
?? $this->policy?->display_name
|
|
?? null;
|
|
|
|
if (is_string($name) && $name !== '') {
|
|
return $name;
|
|
}
|
|
|
|
return $this->policy_identifier;
|
|
}
|
|
|
|
// Scopes
|
|
public function scopeWithAssignments($query)
|
|
{
|
|
return $query->whereNotNull('assignments')
|
|
->whereRaw('json_array_length(assignments) > 0');
|
|
}
|
|
}
|