ahmido
1655cc481e
## Summary - migrate provider connections to the canonical three-dimension state model: lifecycle via `is_enabled`, consent via `consent_status`, and verification via `verification_status` - remove legacy provider status and health badge paths, update admin and system directory surfaces, and align onboarding, consent callback, verification, resolver, and mutation flows with the new model - add the Spec 188 artifact set, schema migrations, guard coverage, and expanded provider-state tests across admin, system, onboarding, verification, and rendering paths ## Verification - `cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent` - `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/Auth/SystemPanelAuthTest.php tests/Feature/Filament/TenantGlobalSearchLifecycleScopeTest.php tests/Feature/ProviderConnections/ProviderConnectionEnableDisableTest.php tests/Feature/ProviderConnections/ProviderConnectionTruthCleanupSpec179Test.php` - integrated browser smoke: validated admin provider list/detail/edit, tenant provider summary, system directory tenant detail, provider-connection search exclusion, and cleaned up the temporary smoke record afterward ## Filament / implementation notes - Livewire v4.0+ compliance: preserved; this change targets Filament v5 on Livewire v4 and does not introduce older APIs - Provider registration location: unchanged; Laravel 11+ panel providers remain registered in `bootstrap/providers.php` - Globally searchable resources: `ProviderConnectionResource` remains intentionally excluded from global search; tenant global search remains enabled and continues to resolve to view pages - Destructive actions: no new destructive action surface was introduced without confirmation or authorization; existing capability checks continue to gate provider mutations - Asset strategy: unchanged; no new Filament assets were added, so deploy behavior for `php artisan filament:assets` remains unchanged - Testing plan covered: system auth, tenant global search, provider lifecycle enable/disable behavior, and provider truth cleanup cutover behavior Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #219
90 lines
3.1 KiB
PHP
90 lines
3.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\Policy;
|
|
use App\Models\ProviderConnection;
|
|
use App\Models\ProviderCredential;
|
|
use App\Models\Tenant;
|
|
use App\Services\Graph\GraphClientInterface;
|
|
use App\Services\Graph\GraphLogger;
|
|
use App\Services\Graph\GraphResponse;
|
|
use App\Services\Intune\PolicySyncService;
|
|
|
|
use function Pest\Laravel\mock;
|
|
|
|
function tenantWithDefaultMicrosoftConnectionForPolicySyncReport(array $attributes = []): Tenant
|
|
{
|
|
$tenant = Tenant::factory()->create($attributes + [
|
|
'status' => 'active',
|
|
'app_client_id' => null,
|
|
'app_client_secret' => null,
|
|
]);
|
|
|
|
$connection = ProviderConnection::factory()->consentGranted()->create([
|
|
'tenant_id' => (int) $tenant->getKey(),
|
|
'provider' => 'microsoft',
|
|
'is_default' => true,
|
|
'consent_status' => 'granted',
|
|
'entra_tenant_id' => (string) ($tenant->tenant_id ?: 'tenant-'.$tenant->getKey()),
|
|
]);
|
|
|
|
ProviderCredential::factory()->create([
|
|
'provider_connection_id' => (int) $connection->getKey(),
|
|
'type' => 'client_secret',
|
|
'payload' => [
|
|
'client_id' => 'provider-client-'.$tenant->getKey(),
|
|
'client_secret' => 'provider-secret-'.$tenant->getKey(),
|
|
],
|
|
]);
|
|
|
|
return $tenant;
|
|
}
|
|
|
|
it('returns a report with failures when policy list calls fail', function () {
|
|
$tenant = tenantWithDefaultMicrosoftConnectionForPolicySyncReport();
|
|
|
|
$logger = mock(GraphLogger::class);
|
|
$logger->shouldReceive('logRequest')->zeroOrMoreTimes()->andReturnNull();
|
|
$logger->shouldReceive('logResponse')->zeroOrMoreTimes()->andReturnNull();
|
|
|
|
mock(GraphClientInterface::class)
|
|
->shouldReceive('listPolicies')
|
|
->andReturnUsing(function (string $policyType) {
|
|
return match ($policyType) {
|
|
'endpointSecurityPolicy' => new GraphResponse(
|
|
success: false,
|
|
data: [],
|
|
status: 403,
|
|
errors: [['message' => 'Forbidden']],
|
|
meta: ['path' => '/deviceManagement/configurationPolicies'],
|
|
),
|
|
default => new GraphResponse(
|
|
success: true,
|
|
data: [
|
|
['id' => 'scp-1', 'displayName' => 'Settings Catalog', 'technologies' => ['mdm']],
|
|
],
|
|
status: 200,
|
|
),
|
|
};
|
|
});
|
|
|
|
$service = app(PolicySyncService::class);
|
|
|
|
$result = $service->syncPoliciesWithReport($tenant, [
|
|
['type' => 'endpointSecurityPolicy', 'platform' => 'windows'],
|
|
['type' => 'settingsCatalogPolicy', 'platform' => 'windows'],
|
|
]);
|
|
|
|
expect($result)->toHaveKeys(['synced', 'failures']);
|
|
expect($result['synced'])->toBeArray();
|
|
expect($result['failures'])->toBeArray();
|
|
|
|
expect(count($result['synced']))->toBe(1);
|
|
expect(Policy::query()->where('tenant_id', $tenant->id)->count())->toBe(1);
|
|
|
|
expect(count($result['failures']))->toBe(1);
|
|
expect($result['failures'][0]['policy_type'])->toBe('endpointSecurityPolicy');
|
|
expect($result['failures'][0]['status'])->toBe(403);
|
|
});
|