ahmido
acc8947384
## Summary - add the Spec 194 governance action catalog, friction classes, reason policies, and regression guards - align exception, review, evidence, finding, tenant, provider connection, and system run actions to the shared semantics model - add focused feature, RBAC, audit, unit, and browser coverage, including the tenant detail triage header consistency update ## Verification - ran the focused Spec 194 verification pack from the quickstart and task plan - ran targeted tenant triage coverage after the detail-header update - ran `cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent` ## Filament Notes - Filament v5 / Livewire v4 compliance preserved - provider registration remains in `apps/platform/bootstrap/providers.php` - globally searchable resources were not changed - destructive actions remain confirmation-gated and server-authorized - no new Filament assets were introduced; the existing `cd apps/platform && php artisan filament:assets` deploy step stays unchanged Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #229
102 lines
4.8 KiB
PHP
102 lines
4.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\Finding;
|
|
use App\Models\User;
|
|
use App\Services\Findings\FindingWorkflowService;
|
|
use App\Support\Audit\AuditActionId;
|
|
use Illuminate\Auth\Access\AuthorizationException;
|
|
|
|
it('enforces the canonical transition matrix for service-driven status changes', function (): void {
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
|
|
$service = app(FindingWorkflowService::class);
|
|
|
|
$newFinding = $this->makeFindingForWorkflow($tenant, Finding::STATUS_NEW);
|
|
$triagedFinding = $service->triage($newFinding, $tenant, $user);
|
|
|
|
expect($triagedFinding->status)->toBe(Finding::STATUS_TRIAGED)
|
|
->and($this->latestFindingAudit($triagedFinding, AuditActionId::FindingTriaged))->not->toBeNull();
|
|
|
|
$inProgressFinding = $service->startProgress($triagedFinding, $tenant, $user);
|
|
|
|
expect($inProgressFinding->status)->toBe(Finding::STATUS_IN_PROGRESS)
|
|
->and($this->latestFindingAudit($inProgressFinding, AuditActionId::FindingInProgress))->not->toBeNull();
|
|
|
|
$resolvedFinding = $service->resolve($inProgressFinding, $tenant, $user, 'patched');
|
|
|
|
expect($resolvedFinding->status)->toBe(Finding::STATUS_RESOLVED)
|
|
->and($resolvedFinding->resolved_reason)->toBe('patched')
|
|
->and($this->latestFindingAudit($resolvedFinding, AuditActionId::FindingResolved))->not->toBeNull();
|
|
|
|
$reopenedFinding = $service->reopen($resolvedFinding, $tenant, $user, 'The issue recurred after remediation.');
|
|
|
|
expect($reopenedFinding->status)->toBe(Finding::STATUS_REOPENED)
|
|
->and($reopenedFinding->reopened_at)->not->toBeNull()
|
|
->and($this->latestFindingAudit($reopenedFinding, AuditActionId::FindingReopened))->not->toBeNull();
|
|
|
|
expect(fn () => $service->startProgress($this->makeFindingForWorkflow($tenant, Finding::STATUS_NEW), $tenant, $user))
|
|
->toThrow(\InvalidArgumentException::class, 'Finding cannot be moved to in-progress from the current status.');
|
|
});
|
|
|
|
it('enforces tenant-member validation for owner and assignee reassignment', function (): void {
|
|
[$owner, $tenant] = createUserWithTenant(role: 'owner');
|
|
$assignee = User::factory()->create();
|
|
createUserWithTenant(tenant: $tenant, user: $assignee, role: 'operator');
|
|
$outsider = User::factory()->create();
|
|
|
|
$finding = $this->makeFindingForWorkflow($tenant, Finding::STATUS_TRIAGED);
|
|
$service = app(FindingWorkflowService::class);
|
|
|
|
$assignedFinding = $service->assign(
|
|
finding: $finding,
|
|
tenant: $tenant,
|
|
actor: $owner,
|
|
assigneeUserId: (int) $assignee->getKey(),
|
|
ownerUserId: (int) $owner->getKey(),
|
|
);
|
|
|
|
expect((int) $assignedFinding->assignee_user_id)->toBe((int) $assignee->getKey())
|
|
->and((int) $assignedFinding->owner_user_id)->toBe((int) $owner->getKey())
|
|
->and($this->latestFindingAudit($assignedFinding, AuditActionId::FindingAssigned))->not->toBeNull();
|
|
|
|
expect(fn () => $service->assign(
|
|
finding: $assignedFinding,
|
|
tenant: $tenant,
|
|
actor: $owner,
|
|
assigneeUserId: (int) $outsider->getKey(),
|
|
ownerUserId: (int) $owner->getKey(),
|
|
))->toThrow(\InvalidArgumentException::class, 'assignee_user_id must reference a current tenant member.');
|
|
});
|
|
|
|
it('requires explicit reasons for resolve close and risk accept mutations', function (): void {
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
|
|
$service = app(FindingWorkflowService::class);
|
|
|
|
expect(fn () => $service->resolve($this->makeFindingForWorkflow($tenant, Finding::STATUS_NEW), $tenant, $user, ' '))
|
|
->toThrow(\InvalidArgumentException::class, 'resolved_reason is required.');
|
|
|
|
expect(fn () => $service->close($this->makeFindingForWorkflow($tenant, Finding::STATUS_NEW), $tenant, $user, ' '))
|
|
->toThrow(\InvalidArgumentException::class, 'closed_reason is required.');
|
|
|
|
expect(fn () => $service->reopen($this->makeFindingForWorkflow($tenant, Finding::STATUS_RESOLVED), $tenant, $user, ' '))
|
|
->toThrow(\InvalidArgumentException::class, 'reopen_reason is required.');
|
|
|
|
expect(fn () => $service->riskAccept($this->makeFindingForWorkflow($tenant, Finding::STATUS_NEW), $tenant, $user, ' '))
|
|
->toThrow(\InvalidArgumentException::class, 'closed_reason is required.');
|
|
});
|
|
|
|
it('returns 403 for in-scope members without the required workflow capability', function (): void {
|
|
[$owner, $tenant] = createUserWithTenant(role: 'owner');
|
|
[$readonly] = createUserWithTenant(tenant: $tenant, role: 'readonly');
|
|
$finding = $this->makeFindingForWorkflow($tenant, Finding::STATUS_NEW);
|
|
|
|
expect(fn () => app(FindingWorkflowService::class)->resolve($finding, $tenant, $readonly, 'patched'))
|
|
->toThrow(AuthorizationException::class);
|
|
|
|
expect(app(FindingWorkflowService::class)->resolve($finding, $tenant, $owner, 'patched')->status)
|
|
->toBe(Finding::STATUS_RESOLVED);
|
|
});
|