ahmido
cd811cff4f
## Summary - replace broad substring-based masking with a shared exact/path-based secret classifier and workspace-scoped fingerprint hashing - persist protected snapshot metadata on `policy_versions` and keep secret-only changes visible in compare, drift, restore, review, verification, and ops surfaces - add Spec 120 artifacts, audit documentation, and focused Pest regression coverage for snapshot, audit, verification, review-pack, and notification behavior ## Validation - `vendor/bin/sail artisan test --compact tests/Feature/Intune/PolicySnapshotRedactionTest.php tests/Feature/Intune/PolicySnapshotFingerprintIsolationTest.php tests/Feature/ReviewPack/ReviewPackRedactionIntegrityTest.php tests/Feature/OpsUx/OperationRunNotificationRedactionTest.php tests/Feature/Verification/VerificationReportViewerDbOnlyTest.php` - `vendor/bin/sail bin pint --dirty --format agent` ## Spec / checklist status | Checklist | Total | Completed | Incomplete | Status | |-----------|-------|-----------|------------|--------| | requirements.md | 16 | 16 | 0 | ✓ PASS | - `tasks.md`: T001-T032 complete - `tasks.md`: T033 manual quickstart validation is still open and noted for follow-up ## Filament / platform notes - Livewire v4 compliance is unchanged - no panel provider changes; `bootstrap/providers.php` remains the registration location - no new globally searchable resources were introduced, so global search requirements are unchanged - no new destructive Filament actions were added - no new Filament assets were added; no `filament:assets` deployment change is required ## Testing coverage touched - snapshot persistence and fingerprint isolation - compare/drift protected-change evidence - audit, verification, review-pack, ops-failure, and notification sanitization - viewer/read-only Filament presentation updates Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #146
93 lines
2.5 KiB
JSON
93 lines
2.5 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://tenantatlas.local/specs/120-secret-redaction-integrity/contracts/protected-snapshot.schema.json",
|
|
"title": "Protected Snapshot Contract",
|
|
"type": "object",
|
|
"required": [
|
|
"redaction_version",
|
|
"snapshot",
|
|
"secret_fingerprints"
|
|
],
|
|
"properties": {
|
|
"redaction_version": {
|
|
"type": "integer",
|
|
"const": 1,
|
|
"description": "Classifier contract version for newly protected policy versions."
|
|
},
|
|
"snapshot": {
|
|
"description": "Protected snapshot payload with safe configuration values preserved.",
|
|
"$ref": "#/$defs/jsonValue"
|
|
},
|
|
"assignments": {
|
|
"description": "Protected assignments payload under the same contract.",
|
|
"$ref": "#/$defs/jsonValue"
|
|
},
|
|
"scope_tags": {
|
|
"description": "Protected scope-tag payload under the same contract.",
|
|
"$ref": "#/$defs/jsonValue"
|
|
},
|
|
"secret_fingerprints": {
|
|
"type": "object",
|
|
"required": ["snapshot", "assignments", "scope_tags"],
|
|
"properties": {
|
|
"snapshot": {
|
|
"$ref": "#/$defs/fingerprintBucket"
|
|
},
|
|
"assignments": {
|
|
"$ref": "#/$defs/fingerprintBucket"
|
|
},
|
|
"scope_tags": {
|
|
"$ref": "#/$defs/fingerprintBucket"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"$defs": {
|
|
"jsonValue": {
|
|
"oneOf": [
|
|
{ "type": "object", "additionalProperties": { "$ref": "#/$defs/jsonValue" } },
|
|
{ "type": "array", "items": { "$ref": "#/$defs/jsonValue" } },
|
|
{ "type": "string" },
|
|
{ "type": "number" },
|
|
{ "type": "integer" },
|
|
{ "type": "boolean" },
|
|
{ "type": "null" }
|
|
]
|
|
},
|
|
"fingerprintBucket": {
|
|
"type": "object",
|
|
"description": "Map of RFC 6901 JSON Pointer paths to lowercase HMAC-SHA256 hex digests.",
|
|
"propertyNames": {
|
|
"type": "string",
|
|
"pattern": "^/(|.*)$"
|
|
},
|
|
"additionalProperties": {
|
|
"type": "string",
|
|
"pattern": "^[a-f0-9]{64}$"
|
|
}
|
|
}
|
|
},
|
|
"examples": [
|
|
{
|
|
"redaction_version": 1,
|
|
"snapshot": {
|
|
"wifi": {
|
|
"ssid": "Corp",
|
|
"password": "[REDACTED]"
|
|
},
|
|
"passwordMinimumLength": 12
|
|
},
|
|
"assignments": [],
|
|
"scope_tags": [],
|
|
"secret_fingerprints": {
|
|
"snapshot": {
|
|
"/wifi/password": "2a1ec8cbf1ea9c0d5a9770b7eeed93ec651987369f9fbeb6f1df2dfeb5a86fd4"
|
|
},
|
|
"assignments": {},
|
|
"scope_tags": {}
|
|
}
|
|
}
|
|
]
|
|
}
|