ahmido
da1adbdeb5
Implements Spec 119 (Drift Golden Master Cutover): - Baseline Compare is the only drift writer (`source = baseline.compare`). - Drift findings now store diff-compatible `evidence_jsonb` (summary.kind, baseline/current policy_version_id refs, fidelity + provenance). - Findings UI renders one-sided diffs for `missing_policy`/`unexpected_policy` when a single ref exists; otherwise shows explicit “diff unavailable”. - Removes legacy drift generator runtime (jobs/services/UI) and related tests. - Adds one-time migration to delete legacy drift findings (`finding_type=drift` where source is null or != baseline.compare). - Scopes baseline capture & landing duplicate warnings to latest completed inventory sync. - Canonicalizes compliance `scheduledActionsForRule` drift signal and keeps legacy snapshots comparable. Tests: - `vendor/bin/sail artisan test --compact` (full suite per tasks) - Focused pack: BaselinePolicyVersionResolverTest, BaselineCompareDriftEvidenceContractTest, DriftFindingDiffUnavailableTest, LegacyDriftFindingsCleanupMigrationTest, ComplianceNoncomplianceActionsDriftTest Notes: - Livewire v4+ / Filament v5 compatible (no legacy APIs). - No new external dependencies. Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #144
125 lines
4.6 KiB
PHP
125 lines
4.6 KiB
PHP
<?php
|
|
|
|
use App\Models\BaselineProfile;
|
|
use App\Models\BaselineTenantAssignment;
|
|
use App\Models\Tenant;
|
|
|
|
// --- T039: Assignment CRUD tests (RBAC + uniqueness) ---
|
|
|
|
it('creates a tenant assignment with workspace context', function () {
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
|
|
$profile = BaselineProfile::factory()->active()->create([
|
|
'workspace_id' => $tenant->workspace_id,
|
|
'scope_jsonb' => ['policy_types' => ['deviceConfiguration']],
|
|
]);
|
|
|
|
$assignment = BaselineTenantAssignment::create([
|
|
'workspace_id' => (int) $tenant->workspace_id,
|
|
'tenant_id' => (int) $tenant->getKey(),
|
|
'baseline_profile_id' => (int) $profile->getKey(),
|
|
'assigned_by_user_id' => (int) $user->getKey(),
|
|
]);
|
|
|
|
expect($assignment)->toBeInstanceOf(BaselineTenantAssignment::class);
|
|
expect($assignment->workspace_id)->toBe((int) $tenant->workspace_id);
|
|
expect($assignment->tenant_id)->toBe((int) $tenant->getKey());
|
|
expect($assignment->baseline_profile_id)->toBe((int) $profile->getKey());
|
|
expect($assignment->assigned_by_user_id)->toBe((int) $user->getKey());
|
|
});
|
|
|
|
it('prevents duplicate assignments for the same workspace+tenant', function () {
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
|
|
$profile1 = BaselineProfile::factory()->active()->create([
|
|
'workspace_id' => $tenant->workspace_id,
|
|
]);
|
|
$profile2 = BaselineProfile::factory()->active()->create([
|
|
'workspace_id' => $tenant->workspace_id,
|
|
]);
|
|
|
|
BaselineTenantAssignment::create([
|
|
'workspace_id' => (int) $tenant->workspace_id,
|
|
'tenant_id' => (int) $tenant->getKey(),
|
|
'baseline_profile_id' => (int) $profile1->getKey(),
|
|
'assigned_by_user_id' => (int) $user->getKey(),
|
|
]);
|
|
|
|
// Attempting to assign the same tenant in the same workspace should fail
|
|
// due to the unique constraint on (workspace_id, tenant_id)
|
|
expect(fn () => BaselineTenantAssignment::create([
|
|
'workspace_id' => (int) $tenant->workspace_id,
|
|
'tenant_id' => (int) $tenant->getKey(),
|
|
'baseline_profile_id' => (int) $profile2->getKey(),
|
|
'assigned_by_user_id' => (int) $user->getKey(),
|
|
]))->toThrow(\Illuminate\Database\QueryException::class);
|
|
});
|
|
|
|
it('allows the same tenant to be assigned in different workspaces', function () {
|
|
[$user1, $tenant1] = createUserWithTenant(role: 'owner');
|
|
[$user2, $tenant2] = createUserWithTenant(role: 'owner');
|
|
|
|
$profile1 = BaselineProfile::factory()->active()->create([
|
|
'workspace_id' => $tenant1->workspace_id,
|
|
]);
|
|
$profile2 = BaselineProfile::factory()->active()->create([
|
|
'workspace_id' => $tenant2->workspace_id,
|
|
]);
|
|
|
|
$a1 = BaselineTenantAssignment::create([
|
|
'workspace_id' => (int) $tenant1->workspace_id,
|
|
'tenant_id' => (int) $tenant1->getKey(),
|
|
'baseline_profile_id' => (int) $profile1->getKey(),
|
|
]);
|
|
$a2 = BaselineTenantAssignment::create([
|
|
'workspace_id' => (int) $tenant2->workspace_id,
|
|
'tenant_id' => (int) $tenant2->getKey(),
|
|
'baseline_profile_id' => (int) $profile2->getKey(),
|
|
]);
|
|
|
|
expect($a1->exists)->toBeTrue();
|
|
expect($a2->exists)->toBeTrue();
|
|
});
|
|
|
|
it('deletes an assignment without deleting related models', function () {
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
|
|
$profile = BaselineProfile::factory()->active()->create([
|
|
'workspace_id' => $tenant->workspace_id,
|
|
]);
|
|
|
|
$assignment = BaselineTenantAssignment::create([
|
|
'workspace_id' => (int) $tenant->workspace_id,
|
|
'tenant_id' => (int) $tenant->getKey(),
|
|
'baseline_profile_id' => (int) $profile->getKey(),
|
|
'assigned_by_user_id' => (int) $user->getKey(),
|
|
]);
|
|
|
|
$assignmentId = $assignment->getKey();
|
|
$assignment->delete();
|
|
|
|
expect(BaselineTenantAssignment::query()->find($assignmentId))->toBeNull();
|
|
expect(BaselineProfile::query()->find($profile->getKey()))->not->toBeNull();
|
|
expect(Tenant::query()->find($tenant->getKey()))->not->toBeNull();
|
|
});
|
|
|
|
it('loads the baseline profile relationship from assignment', function () {
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
|
|
$profile = BaselineProfile::factory()->active()->create([
|
|
'workspace_id' => $tenant->workspace_id,
|
|
'name' => 'Test Profile',
|
|
]);
|
|
|
|
$assignment = BaselineTenantAssignment::create([
|
|
'workspace_id' => (int) $tenant->workspace_id,
|
|
'tenant_id' => (int) $tenant->getKey(),
|
|
'baseline_profile_id' => (int) $profile->getKey(),
|
|
]);
|
|
|
|
$loaded = $assignment->baselineProfile;
|
|
|
|
expect($loaded)->not->toBeNull();
|
|
expect($loaded->name)->toBe('Test Profile');
|
|
});
|