ahmido
0dc79520a4
Implements provider access hardening for Intune write operations: - RBAC-based write gate with configurable staleness thresholds - Gate enforced at restore start and in jobs (execute + assignments) - UI affordances: disabled rerun action, tenant RBAC status card, refresh RBAC action - Audit logging for blocked writes - Ops UX label: `rbac.health_check` now displays as “RBAC health check” - Adds/updates Pest tests and SpecKit artifacts for feature 108 Notes: - Filament v5 / Livewire v4 compliant. - Destructive actions require confirmation. - Assets: no new global assets. Tested: - `vendor/bin/sail artisan test --compact` (suite previously green) + focused OpsUx tests for OperationCatalog labels. - `vendor/bin/sail bin pint --dirty`. Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #132
126 lines
4.0 KiB
PHP
126 lines
4.0 KiB
PHP
<?php
|
|
|
|
use App\Jobs\ExecuteRestoreRunJob;
|
|
use App\Models\BackupSet;
|
|
use App\Models\RestoreRun;
|
|
use App\Models\Tenant;
|
|
use App\Services\Intune\AuditLogger;
|
|
use App\Services\Intune\RestoreService;
|
|
use App\Services\OperationRunService;
|
|
use App\Support\OperationRunOutcome;
|
|
use App\Support\RestoreRunStatus;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Mockery\MockInterface;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function () {
|
|
config()->set('tenantpilot.hardening.intune_write_gate.enabled', true);
|
|
config()->set('tenantpilot.hardening.intune_write_gate.freshness_threshold_hours', 24);
|
|
});
|
|
|
|
test('execute restore run job marks run failed when rbac_status is not_configured', function () {
|
|
$tenant = Tenant::factory()->create([
|
|
'rbac_status' => 'not_configured',
|
|
'rbac_last_checked_at' => null,
|
|
]);
|
|
|
|
$backupSet = BackupSet::create([
|
|
'tenant_id' => $tenant->id,
|
|
'name' => 'Backup',
|
|
'status' => 'completed',
|
|
'item_count' => 0,
|
|
]);
|
|
|
|
$restoreRun = RestoreRun::create([
|
|
'tenant_id' => $tenant->id,
|
|
'backup_set_id' => $backupSet->id,
|
|
'requested_by' => 'actor@example.com',
|
|
'is_dry_run' => false,
|
|
'status' => RestoreRunStatus::Queued->value,
|
|
'requested_items' => null,
|
|
'preview' => [],
|
|
'results' => null,
|
|
'metadata' => [],
|
|
]);
|
|
|
|
$this->mock(RestoreService::class, function (MockInterface $mock) {
|
|
$mock->shouldNotReceive('executeForRun');
|
|
});
|
|
|
|
$operationRun = app(OperationRunService::class)->ensureRun(
|
|
tenant: $tenant,
|
|
type: 'restore.execute',
|
|
inputs: [
|
|
'restore_run_id' => $restoreRun->id,
|
|
'backup_set_id' => $backupSet->id,
|
|
'is_dry_run' => false,
|
|
],
|
|
);
|
|
|
|
$job = new ExecuteRestoreRunJob($restoreRun->id, 'actor@example.com', 'Actor', $operationRun);
|
|
$job->handle(app(RestoreService::class), app(AuditLogger::class));
|
|
|
|
$restoreRun->refresh();
|
|
$operationRun->refresh();
|
|
|
|
expect($restoreRun->status)->toBe(RestoreRunStatus::Failed->value)
|
|
->and($restoreRun->failure_reason)->toContain('not configured')
|
|
->and($operationRun->outcome)->toBe(OperationRunOutcome::Failed->value);
|
|
|
|
$failures = is_array($operationRun->failure_summary) ? $operationRun->failure_summary : [];
|
|
$reasonCodes = array_column($failures, 'reason_code');
|
|
|
|
expect($reasonCodes)->toContain('intune_rbac.not_configured');
|
|
});
|
|
|
|
test('execute restore run job marks run failed when rbac_status is stale', function () {
|
|
$tenant = Tenant::factory()->create([
|
|
'rbac_status' => 'ok',
|
|
'rbac_last_checked_at' => now()->subHours(48),
|
|
]);
|
|
|
|
$backupSet = BackupSet::create([
|
|
'tenant_id' => $tenant->id,
|
|
'name' => 'Backup',
|
|
'status' => 'completed',
|
|
'item_count' => 0,
|
|
]);
|
|
|
|
$restoreRun = RestoreRun::create([
|
|
'tenant_id' => $tenant->id,
|
|
'backup_set_id' => $backupSet->id,
|
|
'requested_by' => 'actor@example.com',
|
|
'is_dry_run' => false,
|
|
'status' => RestoreRunStatus::Queued->value,
|
|
'requested_items' => null,
|
|
'preview' => [],
|
|
'results' => null,
|
|
'metadata' => [],
|
|
]);
|
|
|
|
$this->mock(RestoreService::class, function (MockInterface $mock) {
|
|
$mock->shouldNotReceive('executeForRun');
|
|
});
|
|
|
|
$operationRun = app(OperationRunService::class)->ensureRun(
|
|
tenant: $tenant,
|
|
type: 'restore.execute',
|
|
inputs: [
|
|
'restore_run_id' => $restoreRun->id,
|
|
'backup_set_id' => $backupSet->id,
|
|
'is_dry_run' => false,
|
|
],
|
|
);
|
|
|
|
$job = new ExecuteRestoreRunJob($restoreRun->id, 'actor@example.com', 'Actor', $operationRun);
|
|
$job->handle(app(RestoreService::class), app(AuditLogger::class));
|
|
|
|
$operationRun->refresh();
|
|
|
|
$failures = is_array($operationRun->failure_summary) ? $operationRun->failure_summary : [];
|
|
$reasonCodes = array_column($failures, 'reason_code');
|
|
|
|
expect($reasonCodes)->toContain('intune_rbac.stale');
|
|
});
|