Beschreibung Implementiert das Drift MVP Feature (Spec: 044-drift-mvp) mit Fokus auf automatische Drift-Erkennung zwischen Inventory Sync Runs und Bulk-Triage für Findings. Was wurde implementiert? Drift-Erkennung: Vergleicht Policy-Snapshots, Assignments und Scope Tags zwischen Baseline- und Current-Runs. Deterministische Fingerprints verhindern Duplikate. Findings UI: Neue Filament Resource für Findings mit Listen- und Detail-Ansicht. DB-only Diffs (keine Graph-Calls zur Laufzeit). Bulk Acknowledge: "Acknowledge selected" (Bulk-Action auf der Liste) "Acknowledge all matching" (Header-Action, respektiert aktuelle Filter; Type-to-Confirm bei >100 Findings) Scope Tag Fix: Behebt False Positives bei Legacy-Daten ohne scope_tags.ids (inferiert Default-Werte). Authorization: Tenant-isoliert, Rollen-basiert (Owner/Manager/Operator können acknowledge). Tests: Vollständige Pest-Coverage (28 Tests, 347 Assertions) für Drift-Logik, UI und Bulk-Actions. Warum diese Änderungen? Problem: Keine automatisierte Drift-Erkennung; manuelle Triage bei vielen Findings ist mühsam. Lösung: Async Drift-Generierung mit persistenter Findings-Tabelle. Safe Bulk-Tools für Massen-Triage ohne Deletes. Konformität: Folgt AGENTS.md Workflow, Spec-Kit (Tasks + Checklists abgehakt), Laravel/Filament Best Practices. Technische Details Neue Dateien: ~40 (Models, Services, Tests, Views, Migrations) Änderungen: Filament Resources, Jobs, Policies DB: Neue findings Tabelle (JSONB für Evidence, Indexes für Performance) Tests: ./vendor/bin/sail artisan test tests/Feature/Drift --parallel → 28 passed Migration: ./vendor/bin/sail artisan migrate (neue Tabelle + Indexes) Screenshots / Links Spec: spec.md Tasks: tasks.md (alle abgehakt) UI: Findings-Liste mit Bulk-Actions; Detail-View mit Diffs Checklist Tests passieren (parallel + serial) Code formatiert (./vendor/bin/pint --dirty) Migration reversibel Tenant-Isolation enforced No Graph-Calls in Views Authorization checks Spec + Tasks aligned Deployment Notes Neue Migration: create_findings_table Neue Permissions: drift.view, drift.acknowledge Queue-Job: GenerateDriftFindingsJob (async, deduped)
114 lines
3.4 KiB
PHP
114 lines
3.4 KiB
PHP
<?php
|
|
|
|
namespace App\Services\Drift\Normalizers;
|
|
|
|
use Illuminate\Support\Arr;
|
|
|
|
class AssignmentsNormalizer
|
|
{
|
|
/**
|
|
* @return array<int, array{key:string,include_exclude:string,target_type:string,target_id:string,filter_type:string,filter_id:?string,intent:?string,mode:?string}>
|
|
*/
|
|
public function normalizeForDiff(mixed $assignments): array
|
|
{
|
|
if (! is_array($assignments)) {
|
|
return [];
|
|
}
|
|
|
|
$rows = [];
|
|
|
|
foreach ($assignments as $assignment) {
|
|
if (! is_array($assignment)) {
|
|
continue;
|
|
}
|
|
|
|
$target = $assignment['target'] ?? null;
|
|
if (! is_array($target)) {
|
|
continue;
|
|
}
|
|
|
|
$rawType = $target['@odata.type'] ?? null;
|
|
$targetType = $this->normalizeOdataType(is_string($rawType) ? $rawType : '');
|
|
|
|
$includeExclude = str_contains($targetType, 'exclusion') ? 'exclude' : 'include';
|
|
$targetId = $this->extractTargetId($targetType, $target);
|
|
|
|
if ($targetId === '') {
|
|
continue;
|
|
}
|
|
|
|
$filterId = $target['deviceAndAppManagementAssignmentFilterId'] ?? null;
|
|
$filterType = $target['deviceAndAppManagementAssignmentFilterType'] ?? 'none';
|
|
|
|
$intent = $assignment['intent'] ?? null;
|
|
$mode = $assignment['mode'] ?? null;
|
|
|
|
$row = [
|
|
'key' => implode('|', [
|
|
$includeExclude,
|
|
$targetType,
|
|
$targetId,
|
|
]),
|
|
'include_exclude' => $includeExclude,
|
|
'target_type' => $targetType,
|
|
'target_id' => $targetId,
|
|
'filter_type' => is_string($filterType) && $filterType !== '' ? strtolower(trim($filterType)) : 'none',
|
|
'filter_id' => is_string($filterId) && $filterId !== '' ? $filterId : null,
|
|
'intent' => is_string($intent) && $intent !== '' ? strtolower(trim($intent)) : null,
|
|
'mode' => is_string($mode) && $mode !== '' ? strtolower(trim($mode)) : null,
|
|
];
|
|
|
|
$rows[] = $row;
|
|
}
|
|
|
|
usort($rows, function (array $a, array $b): int {
|
|
return strcmp($a['key'], $b['key']);
|
|
});
|
|
|
|
return array_values($rows);
|
|
}
|
|
|
|
private function normalizeOdataType(string $odataType): string
|
|
{
|
|
$value = trim($odataType);
|
|
$value = ltrim($value, '#');
|
|
|
|
if ($value === '') {
|
|
return 'unknown';
|
|
}
|
|
|
|
if (str_contains($value, '.')) {
|
|
$value = (string) strrchr($value, '.');
|
|
$value = ltrim($value, '.');
|
|
}
|
|
|
|
return strtolower(trim($value));
|
|
}
|
|
|
|
/**
|
|
* @param array<string, mixed> $target
|
|
*/
|
|
private function extractTargetId(string $targetType, array $target): string
|
|
{
|
|
if (str_contains($targetType, 'alldevicesassignmenttarget')) {
|
|
return 'all_devices';
|
|
}
|
|
|
|
if (str_contains($targetType, 'allusersassignmenttarget')) {
|
|
return 'all_users';
|
|
}
|
|
|
|
$groupId = Arr::get($target, 'groupId');
|
|
if (is_string($groupId) && $groupId !== '') {
|
|
return $groupId;
|
|
}
|
|
|
|
$collectionId = Arr::get($target, 'collectionId');
|
|
if (is_string($collectionId) && $collectionId !== '') {
|
|
return $collectionId;
|
|
}
|
|
|
|
return '';
|
|
}
|
|
}
|