## Summary
Implements and polishes the Platform Ops Runbooks feature (Spec 113) — the operator control plane for safe backfills and data repair from `/system`.
## Changes
### UX Polish (Phase 7 — US4)
- **Filament-native components**: Rewrote `runbooks.blade.php` and `view-run.blade.php` using `<x-filament::section>` instead of raw Tailwind div cards. Cards now render correctly with Filament's built-in borders, shadows and dark mode.
- **System panel theme**: Created `resources/css/filament/system/theme.css` and registered `->viteTheme()` on `SystemPanelProvider`. The system panel previously had no theme CSS registered — Tailwind utility classes weren't compiled for its views, causing the warning icon SVG to expand to full container size.
- **Live scope selector**: Added `->live()` to the scope `Radio` field so "Single tenant" immediately reveals the tenant search dropdown without requiring a Submit first.
### Core Feature (Phases 1–6, previously shipped)
- `/system/ops/runbooks` — runbook catalog, preflight, run with typed confirmation + reason
- `/system/ops/runs` — run history table with status/outcome badges
- `/system/ops/runs/{id}` — run detail view with summary counts, failures, collapsible context
- `FindingsLifecycleBackfillRunbookService` — preflight + execution logic
- AllowedTenantUniverse — scopes tenant picker to non-platform tenants only
- RBAC: `platform.ops.view`, `platform.runbooks.view`, `platform.runbooks.run`, `platform.runbooks.findings.lifecycle_backfill`
- Rate-limited `/system/login` (10/min per IP+username)
- Distinct session cookie for `/system` isolation
## Test Coverage
- 16 tests / 141 assertions — all passing
- Covers: page access, RBAC, preflight, run dispatch, scope selector, run detail, run list
## Checklist
- [x] Filament v5 / Livewire v4 compliant
- [x] Provider registered in `bootstrap/providers.php`
- [x] Destructive actions require confirmation (`->requiresConfirmation()`)
- [x] System panel theme registered (`viteTheme`)
- [x] Pint clean
- [x] Tests pass
Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #137
104 lines
2.7 KiB
PHP
104 lines
2.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Str;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
class UseSystemSessionCookieForLivewireRequests
|
|
{
|
|
/**
|
|
* @param \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response) $next
|
|
*/
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
if (! $this->shouldUseSystemCookie($request)) {
|
|
return $next($request);
|
|
}
|
|
|
|
$originalCookieName = (string) config('session.cookie');
|
|
|
|
config(['session.cookie' => $this->systemCookieName()]);
|
|
|
|
try {
|
|
return $next($request);
|
|
} finally {
|
|
config(['session.cookie' => $originalCookieName]);
|
|
}
|
|
}
|
|
|
|
private function shouldUseSystemCookie(Request $request): bool
|
|
{
|
|
if (
|
|
! $request->is('livewire-*/update')
|
|
&& ! $request->is('livewire-*/upload-file')
|
|
&& ! $request->is('livewire-*/preview-file/*')
|
|
) {
|
|
return false;
|
|
}
|
|
|
|
if ($this->snapshotIndicatesSystemPanel($request)) {
|
|
return true;
|
|
}
|
|
|
|
$refererPath = parse_url((string) $request->headers->get('referer', ''), PHP_URL_PATH) ?? '';
|
|
$refererPath = '/'.ltrim((string) $refererPath, '/');
|
|
|
|
return $refererPath === '/system' || str_starts_with($refererPath, '/system/');
|
|
}
|
|
|
|
private function snapshotIndicatesSystemPanel(Request $request): bool
|
|
{
|
|
if (! $request->is('livewire-*/update')) {
|
|
return false;
|
|
}
|
|
|
|
$components = $request->input('components');
|
|
|
|
if (! is_array($components)) {
|
|
return false;
|
|
}
|
|
|
|
foreach ($components as $componentPayload) {
|
|
if (! is_array($componentPayload)) {
|
|
continue;
|
|
}
|
|
|
|
$snapshot = $componentPayload['snapshot'] ?? null;
|
|
|
|
if (! is_string($snapshot) || $snapshot === '') {
|
|
continue;
|
|
}
|
|
|
|
$decodedSnapshot = json_decode($snapshot, associative: true);
|
|
|
|
if (! is_array($decodedSnapshot)) {
|
|
continue;
|
|
}
|
|
|
|
$path = $decodedSnapshot['memo']['path'] ?? null;
|
|
|
|
if (! is_string($path) || $path === '') {
|
|
continue;
|
|
}
|
|
|
|
$path = '/'.ltrim($path, '/');
|
|
|
|
if ($path === '/system' || str_starts_with($path, '/system/')) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
private function systemCookieName(): string
|
|
{
|
|
return Str::slug((string) config('app.name', 'laravel')).'-system-session';
|
|
}
|
|
}
|