TenantAtlas/apps/platform/tests/Feature/Graph/GraphContractRegistryCoverageSpec095Test.php

<?php

declare(strict_types=1);

use App\Services\Graph\GraphContractRegistry;

it('Spec095 keeps graph contract entries for governed deviceManagement resources', function (): void {
    $requiredResources = [
        'configurationPolicyTemplate' => 'deviceManagement/configurationPolicyTemplates',
        'settingsCatalogDefinition' => 'deviceManagement/configurationSettings',
        'settingsCatalogCategory' => 'deviceManagement/configurationCategories',
        'rbacRoleAssignment' => 'deviceManagement/roleAssignments',
    ];

    foreach ($requiredResources as $contractType => $resourcePath) {
        $resource = config("graph_contracts.types.{$contractType}.resource");

        expect($resource)
            ->toBeString("Spec095 missing graph contract resource for {$contractType}")
            ->toBe($resourcePath, "Spec095 graph contract resource mismatch for {$contractType}");
    }

    $settingTemplatesPath = config('graph_contracts.types.configurationPolicyTemplate.subresources.settingTemplates.path');

    expect($settingTemplatesPath)
        ->toBeString('Spec095 missing settingTemplates subresource for configurationPolicyTemplate');

    expect(str_contains((string) $settingTemplatesPath, '{id}'))
        ->toBeTrue('Spec095 settingTemplates subresource path must include the parent {id} placeholder');
});

it('Spec095 keeps registry path helpers for governed resources', function (): void {
    $contracts = app(GraphContractRegistry::class);

    expect($contracts->configurationPolicyTemplateListPath())
        ->toBe('/deviceManagement/configurationPolicyTemplates');

    expect($contracts->configurationPolicyTemplateItemPath('template/abc'))
        ->toBe('/deviceManagement/configurationPolicyTemplates/template%2Fabc');

    expect($contracts->configurationPolicyTemplateSettingTemplatesPath('template/abc'))
        ->toBe('/deviceManagement/configurationPolicyTemplates/template%2Fabc/settingTemplates');

    expect($contracts->settingsCatalogDefinitionItemPath('definition/abc'))
        ->toBe('/deviceManagement/configurationSettings/definition%2Fabc');

    expect($contracts->settingsCatalogCategoryItemPath('category/abc'))
        ->toBe('/deviceManagement/configurationCategories/category%2Fabc');

    expect($contracts->rbacRoleAssignmentItemPath('assignment/abc'))
        ->toBe('/deviceManagement/roleAssignments/assignment%2Fabc');
});

it('Spec095 guards against hardcoded governed endpoint strings in scoped call sites', function (): void {
    $scopedGuards = [
        'app/Services/Intune/ConfigurationPolicyTemplateResolver.php' => ['deviceManagement/configurationPolicyTemplates'],
        'app/Services/Intune/SettingsCatalogDefinitionResolver.php' => ['deviceManagement/configurationSettings'],
        'app/Services/Intune/SettingsCatalogCategoryResolver.php' => ['deviceManagement/configurationCategories'],
        'app/Services/Intune/RbacOnboardingService.php' => ['deviceManagement/roleAssignments'],
        'app/Services/Intune/RbacHealthService.php' => ['deviceManagement/roleAssignments'],
    ];

    foreach ($scopedGuards as $file => $forbiddenSubstrings) {
        $contents = file_get_contents(base_path($file));

        expect($contents)
            ->not->toBeFalse("Spec095 regression guard could not read {$file}");

        foreach ($forbiddenSubstrings as $forbiddenSubstring) {
            expect(str_contains((string) $contents, $forbiddenSubstring))
                ->toBeFalse("Spec095 regression guard found hardcoded '{$forbiddenSubstring}' in {$file}; use GraphContractRegistry helper paths instead.");
        }
    }
});