ahmido
bab01f07a9
## Summary - standardize Microsoft provider connections around explicit platform vs dedicated identity modes - centralize admin-consent URL and runtime identity resolution so platform flows no longer fall back to tenant-local credentials - add migration classification, richer consent and verification state handling, dedicated override management, and focused regression coverage ## Validation - focused repo test coverage was added across provider identity, onboarding, audit, policy, guard, and migration flows - latest explicit passing run in the workspace: `vendor/bin/sail artisan test --compact tests/Feature/AdminConsentCallbackTest.php tests/Feature/Audit/ProviderConnectionConsentAuditTest.php` ## Notes - branch includes the full Spec 137 artifact set under `specs/137-platform-provider-identity/` - target base branch: `dev` Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #166
75 lines
2.7 KiB
PHP
75 lines
2.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\AuditLog;
|
|
use App\Models\ProviderConnection;
|
|
use App\Models\ProviderCredential;
|
|
use App\Models\Tenant;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
it('audits classification backfill orchestration and applied migration outcomes', function (): void {
|
|
config()->set('graph.client_id', 'platform-client-id');
|
|
config()->set('graph.client_secret', 'platform-client-secret');
|
|
|
|
$tenant = Tenant::factory()->create([
|
|
'tenant_id' => 'audit-classification-tenant-id',
|
|
'app_client_id' => 'legacy-tenant-client-id',
|
|
'app_client_secret' => 'legacy-tenant-client-secret',
|
|
]);
|
|
|
|
$connection = ProviderConnection::factory()->platform()->verifiedHealthy()->create([
|
|
'tenant_id' => (int) $tenant->getKey(),
|
|
'workspace_id' => (int) $tenant->workspace_id,
|
|
'provider' => 'microsoft',
|
|
'entra_tenant_id' => 'audit-classification-tenant-id',
|
|
'is_default' => true,
|
|
]);
|
|
|
|
ProviderCredential::factory()->create([
|
|
'provider_connection_id' => (int) $connection->getKey(),
|
|
'source' => null,
|
|
'payload' => [
|
|
'client_id' => 'legacy-different-client-id',
|
|
'client_secret' => 'legacy-different-client-secret',
|
|
],
|
|
]);
|
|
|
|
$this->artisan('tenantpilot:provider-connections:classify', ['--write' => true])
|
|
->assertSuccessful();
|
|
|
|
$started = AuditLog::query()
|
|
->where('tenant_id', (int) $tenant->getKey())
|
|
->where('action', 'provider_connection.migration_classification_started')
|
|
->latest('id')
|
|
->first();
|
|
|
|
$applied = AuditLog::query()
|
|
->where('tenant_id', (int) $tenant->getKey())
|
|
->where('action', 'provider_connection.migration_classification_applied')
|
|
->latest('id')
|
|
->first();
|
|
|
|
expect($started)->not->toBeNull()
|
|
->and($started?->status)->toBe('success')
|
|
->and($started?->metadata)->toMatchArray([
|
|
'source' => 'tenantpilot:provider-connections:classify',
|
|
'candidate_count' => 1,
|
|
'write' => true,
|
|
]);
|
|
|
|
expect($applied)->not->toBeNull()
|
|
->and($applied?->status)->toBe('success')
|
|
->and($applied?->resource_type)->toBe('provider_connection')
|
|
->and($applied?->resource_id)->toBe((string) $connection->getKey())
|
|
->and($applied?->metadata)->toMatchArray([
|
|
'source' => 'tenantpilot:provider-connections:classify',
|
|
'provider_connection_id' => (int) $connection->getKey(),
|
|
'provider' => 'microsoft',
|
|
'connection_type' => 'dedicated',
|
|
'migration_review_required' => true,
|
|
]);
|
|
});
|