TenantAtlas/apps/platform/tests/Browser/Spec424SecurityDefaultsComparableRenderableOperatorSurfaceSmokeTest.php

<?php

declare(strict_types=1);

use App\Filament\Pages\TenantConfiguration\CoverageV2Readiness;
use App\Models\ManagedEnvironment;
use App\Models\OperationRun;
use App\Models\ProviderConnection;
use App\Models\TenantConfigurationResource;
use App\Models\TenantConfigurationResourceEvidence;
use App\Models\TenantConfigurationResourceType;
use App\Models\TenantConfigurationSupportedScope;
use App\Models\User;
use App\Services\TenantConfiguration\ResourceTypeRegistry;
use App\Support\OperationRunOutcome;
use App\Support\OperationRunStatus;
use App\Support\OperationRunType;
use App\Support\TenantConfiguration\CanonicalKeyKind;
use App\Support\TenantConfiguration\CaptureOutcome;
use App\Support\TenantConfiguration\ClaimState;
use App\Support\TenantConfiguration\CoverageLevel;
use App\Support\TenantConfiguration\EvidenceState;
use App\Support\TenantConfiguration\IdentityState;
use App\Support\TenantConfiguration\SourceClass;
use App\Support\Workspaces\WorkspaceContext;
use Illuminate\Foundation\Testing\RefreshDatabase;

uses(RefreshDatabase::class);

pest()->browser()->timeout(60_000);

it('Spec424 smokes the Coverage v2 inspect surface for Security Defaults renderable evidence', function (): void {
    [$user, $environment] = spec424CoverageV2BrowserFixture();
    spec424AuthenticateCoverageV2Browser($this, $user, $environment);

    $page = visit(CoverageV2Readiness::getUrl(tenant: $environment, panel: 'admin'))
        ->resize(768, 1100)
        ->waitForText('Coverage v2 Readiness')
        ->waitForText('Spec424 Browser Security Defaults')
        ->assertSee('Resource type registry')
        ->assertSee('Resource instances')
        ->assertSee('Security defaults')
        ->assertSee('Coverage level')
        ->assertSee('Renderable')
        ->assertSee('Internal only')
        ->assertDontSee('Security Defaults covered')
        ->assertDontSee('certified')
        ->assertDontSee('restore-ready')
        ->assertDontSee('customer-ready')
        ->assertDontSee('100%')
        ->assertDontSee('spec424-raw-secret')
        ->assertDontSee('spec424-normalized-secret')
        ->assertScript('typeof window.Livewire !== "undefined"', true)
        ->assertScript('(() => document.querySelectorAll("table tbody tr").length > 0)()', true)
        ->assertScript("(() => performance.getEntriesByType('resource').filter((entry) => /graph\\.microsoft\\.com|\\/tcm\\b|provider-remote/i.test(entry.name)).length)()", 0)
        ->assertScript("(() => Array.from(document.querySelectorAll('main button, main a')).map((element) => element.textContent.trim()).filter(Boolean).some((label) => /^(Capture|Restore|Certify|Export|Download)$/i.test(label)))()", false)
        ->assertNoJavaScriptErrors()
        ->assertNoConsoleLogs();

    $page->script(<<<'JS'
        (() => {
            const rows = Array.from(document.querySelectorAll('table tbody tr'));
            const row = rows.find((candidate) => candidate.textContent.includes('Spec424 Browser Security Defaults'));
            const inspect = Array.from(row?.querySelectorAll('button, a') ?? [])
                .find((element) => element.textContent.includes('Spec424 Browser Security Defaults'));

            inspect?.click();
        })()
    JS);

    $page
        ->waitForText('Coverage: Renderable')
        ->assertSee('Security Defaults')
        ->assertSee('Display name')
        ->assertSee('Spec424 Browser Security Defaults')
        ->assertSee('Enabled state')
        ->assertSee('Enabled')
        ->assertSee('Compare summary')
        ->assertSee('Material changes detected')
        ->assertSee('Previous comparable evidence')
        ->assertSee('Enabled State')
        ->assertSee('Redacted fields')
        ->assertSee('clientSecret')
        ->assertSee('Evidence: Content backed')
        ->assertSee('Identity: Stable')
        ->assertSee('Claim: Internal only')
        ->assertDontSee('Security Defaults covered')
        ->assertDontSee('certified')
        ->assertDontSee('restore-ready')
        ->assertDontSee('customer-ready')
        ->assertDontSee('100%')
        ->assertDontSee('identitySecurityDefaultsEnforcementPolicy')
        ->assertDontSee('spec424-raw-secret')
        ->assertDontSee('spec424-normalized-secret')
        ->assertNoJavaScriptErrors()
        ->assertNoConsoleLogs()
        ->screenshot(true, 'spec424-security-defaults-comparable-renderable-operator-surface');
});

/**
 * @return array{0: User, 1: ManagedEnvironment}
 */
function spec424CoverageV2BrowserFixture(): array
{
    app(ResourceTypeRegistry::class)->syncDefaults();

    $environment = ManagedEnvironment::factory()->active()->create([
        'name' => 'Spec424 Browser Environment',
        'external_id' => 'spec424-browser-environment',
    ]);

    [$user, $environment] = createUserWithTenant(
        tenant: $environment,
        role: 'owner',
        workspaceRole: 'owner',
        clearCapabilityCaches: true,
    );

    $connection = ProviderConnection::factory()->create([
        'workspace_id' => (int) $environment->workspace_id,
        'managed_environment_id' => (int) $environment->getKey(),
        'display_name' => 'Spec424 Browser Microsoft provider',
    ]);

    $resourceType = TenantConfigurationResourceType::query()
        ->where('canonical_type', 'securityDefaults')
        ->where('source_class', SourceClass::GraphV1Fallback->value)
        ->firstOrFail();

    TenantConfigurationSupportedScope::factory()->create([
        'scope_key' => 'spec424_browser_internal_security_defaults_scope',
        'display_name' => 'Spec424 Browser internal Security Defaults scope',
        'minimum_coverage_level' => CoverageLevel::ContentBacked->value,
        'included_resource_types' => ['securityDefaults'],
        'allow_graph_fallback' => true,
        'allow_beta' => false,
        'customer_claims_allowed' => false,
    ]);

    $previousRun = spec424BrowserRun($environment, $user, now()->subMinutes(6), now()->subMinutes(5));
    $run = spec424BrowserRun($environment, $user, now()->subMinute(), now());

    $resource = TenantConfigurationResource::factory()->create([
        'workspace_id' => (int) $environment->workspace_id,
        'managed_environment_id' => (int) $environment->getKey(),
        'provider_connection_id' => (int) $connection->getKey(),
        'resource_type_id' => (int) $resourceType->getKey(),
        'canonical_type' => 'securityDefaults',
        'canonical_resource_key' => 'securityDefaults:graph_object_id:spec424-browser-security-defaults',
        'canonical_key_kind' => CanonicalKeyKind::GraphObjectId->value,
        'source_resource_id' => 'securityDefaults',
        'source_display_name' => 'Spec424 Browser Security Defaults',
        'source_class' => SourceClass::GraphV1Fallback->value,
        'source_metadata' => [
            'source_contract_key' => 'securityDefaults',
            'source_endpoint' => '/policies/identitySecurityDefaultsEnforcementPolicy',
            'source_version' => 'v1.0',
            'registry_source_class' => SourceClass::GraphV1Fallback->value,
            'registry_support_state' => 'fallback_supported',
        ],
        'identity_strategy' => 'graph.security_defaults.v1',
        'source_identity' => [
            'primary_field' => 'id',
            'primary_value' => 'securityDefaults',
        ],
        'identity_diagnostics' => [
            'reason_code' => 'stable_identity_resolved',
        ],
        'identity_evaluated_at' => now(),
        'latest_evidence_state' => EvidenceState::ContentBacked->value,
        'latest_identity_state' => IdentityState::Stable->value,
        'latest_claim_state' => ClaimState::InternalOnly->value,
        'latest_captured_at' => now(),
    ]);

    TenantConfigurationResourceEvidence::factory()->create([
        'resource_id' => (int) $resource->getKey(),
        'workspace_id' => (int) $environment->workspace_id,
        'managed_environment_id' => (int) $environment->getKey(),
        'provider_connection_id' => (int) $connection->getKey(),
        'resource_type_id' => (int) $resourceType->getKey(),
        'operation_run_id' => (int) $previousRun->getKey(),
        'source_contract_key' => 'securityDefaults',
        'source_endpoint' => '/policies/identitySecurityDefaultsEnforcementPolicy',
        'source_version' => 'v1.0',
        'source_schema_hash' => 'spec424-browser-previous-schema-hash',
        'source_metadata' => [
            'registry_source_class' => SourceClass::GraphV1Fallback->value,
            'registry_support_state' => 'fallback_supported',
        ],
        'raw_payload' => ['id' => 'securityDefaults'],
        'normalized_payload' => [
            'id' => 'securityDefaults',
            'displayName' => 'Spec424 Browser Security Defaults',
            'description' => 'Tenant-wide Security Defaults policy.',
            'isEnabled' => false,
        ],
        'payload_hash' => str_repeat('a', 64),
        'permission_context' => ['scopes_granted' => ['Policy.Read.All']],
        'evidence_state' => EvidenceState::ContentBacked->value,
        'coverage_level' => CoverageLevel::Comparable->value,
        'capture_outcome' => CaptureOutcome::Captured->value,
        'captured_at' => now()->subMinutes(5),
    ]);

    $evidence = TenantConfigurationResourceEvidence::factory()->create([
        'resource_id' => (int) $resource->getKey(),
        'workspace_id' => (int) $environment->workspace_id,
        'managed_environment_id' => (int) $environment->getKey(),
        'provider_connection_id' => (int) $connection->getKey(),
        'resource_type_id' => (int) $resourceType->getKey(),
        'operation_run_id' => (int) $run->getKey(),
        'source_contract_key' => 'securityDefaults',
        'source_endpoint' => '/policies/identitySecurityDefaultsEnforcementPolicy',
        'source_version' => 'v1.0',
        'source_schema_hash' => 'spec424-browser-schema-hash',
        'source_metadata' => [
            'registry_source_class' => SourceClass::GraphV1Fallback->value,
            'registry_support_state' => 'fallback_supported',
        ],
        'raw_payload' => ['id' => 'securityDefaults', 'secret' => 'spec424-raw-secret'],
        'normalized_payload' => [
            'id' => 'securityDefaults',
            'displayName' => 'Spec424 Browser Security Defaults',
            'description' => 'Tenant-wide Security Defaults policy.',
            'isEnabled' => true,
            'clientSecret' => '[redacted]',
        ],
        'payload_hash' => str_repeat('b', 64),
        'permission_context' => ['scopes_granted' => ['Policy.Read.All']],
        'evidence_state' => EvidenceState::ContentBacked->value,
        'coverage_level' => CoverageLevel::Renderable->value,
        'capture_outcome' => CaptureOutcome::Captured->value,
        'captured_at' => now(),
    ]);

    $resource->forceFill([
        'latest_evidence_id' => (int) $evidence->getKey(),
        'latest_payload_hash' => str_repeat('b', 64),
    ])->save();

    return [$user, $environment->refresh()];
}

function spec424BrowserRun(ManagedEnvironment $environment, User $user, $startedAt, $completedAt): OperationRun
{
    return OperationRun::factory()->create([
        'workspace_id' => (int) $environment->workspace_id,
        'managed_environment_id' => (int) $environment->getKey(),
        'user_id' => (int) $user->getKey(),
        'initiator_name' => (string) $user->name,
        'type' => OperationRunType::TenantConfigurationCapture->value,
        'status' => OperationRunStatus::Completed->value,
        'outcome' => OperationRunOutcome::Succeeded->value,
        'summary_counts' => [
            'total' => 1,
            'processed' => 1,
            'succeeded' => 1,
            'skipped' => 0,
            'failed' => 0,
            'errors_recorded' => 0,
        ],
        'context' => [
            'requested_resource_types' => ['securityDefaults'],
            'outcomes' => [
                ['canonical_type' => 'securityDefaults', 'outcome' => CaptureOutcome::Captured->value],
            ],
        ],
        'started_at' => $startedAt,
        'completed_at' => $completedAt,
    ]);
}

function spec424AuthenticateCoverageV2Browser(
    mixed $test,
    User $user,
    ManagedEnvironment $environment,
): void {
    $workspaceId = (int) $environment->workspace_id;

    $test->actingAs($user)->withSession([
        WorkspaceContext::SESSION_KEY => $workspaceId,
        WorkspaceContext::LAST_ENVIRONMENT_IDS_SESSION_KEY => [
            (string) $workspaceId => (int) $environment->getKey(),
        ],
    ]);

    session()->put(WorkspaceContext::SESSION_KEY, $workspaceId);
    session()->put(WorkspaceContext::LAST_ENVIRONMENT_IDS_SESSION_KEY, [
        (string) $workspaceId => (int) $environment->getKey(),
    ]);
}