ahmido
a449ecec5b
Beschreibung Implementiert das Drift MVP Feature (Spec: 044-drift-mvp) mit Fokus auf automatische Drift-Erkennung zwischen Inventory Sync Runs und Bulk-Triage für Findings. Was wurde implementiert? Drift-Erkennung: Vergleicht Policy-Snapshots, Assignments und Scope Tags zwischen Baseline- und Current-Runs. Deterministische Fingerprints verhindern Duplikate. Findings UI: Neue Filament Resource für Findings mit Listen- und Detail-Ansicht. DB-only Diffs (keine Graph-Calls zur Laufzeit). Bulk Acknowledge: "Acknowledge selected" (Bulk-Action auf der Liste) "Acknowledge all matching" (Header-Action, respektiert aktuelle Filter; Type-to-Confirm bei >100 Findings) Scope Tag Fix: Behebt False Positives bei Legacy-Daten ohne scope_tags.ids (inferiert Default-Werte). Authorization: Tenant-isoliert, Rollen-basiert (Owner/Manager/Operator können acknowledge). Tests: Vollständige Pest-Coverage (28 Tests, 347 Assertions) für Drift-Logik, UI und Bulk-Actions. Warum diese Änderungen? Problem: Keine automatisierte Drift-Erkennung; manuelle Triage bei vielen Findings ist mühsam. Lösung: Async Drift-Generierung mit persistenter Findings-Tabelle. Safe Bulk-Tools für Massen-Triage ohne Deletes. Konformität: Folgt AGENTS.md Workflow, Spec-Kit (Tasks + Checklists abgehakt), Laravel/Filament Best Practices. Technische Details Neue Dateien: ~40 (Models, Services, Tests, Views, Migrations) Änderungen: Filament Resources, Jobs, Policies DB: Neue findings Tabelle (JSONB für Evidence, Indexes für Performance) Tests: ./vendor/bin/sail artisan test tests/Feature/Drift --parallel → 28 passed Migration: ./vendor/bin/sail artisan migrate (neue Tabelle + Indexes) Screenshots / Links Spec: spec.md Tasks: tasks.md (alle abgehakt) UI: Findings-Liste mit Bulk-Actions; Detail-View mit Diffs Checklist Tests passieren (parallel + serial) Code formatiert (./vendor/bin/pint --dirty) Migration reversibel Tenant-Isolation enforced No Graph-Calls in Views Authorization checks Spec + Tasks aligned Deployment Notes Neue Migration: create_findings_table Neue Permissions: drift.view, drift.acknowledge Queue-Job: GenerateDriftFindingsJob (async, deduped)
58 lines
1.8 KiB
Markdown
58 lines
1.8 KiB
Markdown
# Phase 1 Design: Data Model (044)
|
|
|
|
## Entities
|
|
|
|
### Finding
|
|
|
|
New table: `findings`
|
|
|
|
**Purpose**: Generic, persisted pipeline for analytic findings (Drift now; Audit/Compare later).
|
|
|
|
**Core fields (MVP)**
|
|
- `id` (pk)
|
|
- `tenant_id` (fk tenants)
|
|
- `finding_type` (`drift` in MVP; later `audit`/`compare`)
|
|
- `scope_key` (string; deterministic; reuse Inventory selection hash)
|
|
- `baseline_run_id` (nullable fk inventory_sync_runs)
|
|
- `current_run_id` (nullable fk inventory_sync_runs)
|
|
- `fingerprint` (string; deterministic)
|
|
- `subject_type` (string; e.g. policy type)
|
|
- `subject_external_id` (string; Graph external id)
|
|
- `severity` (`low|medium|high`; MVP default `medium`)
|
|
- `status` (`new|acknowledged`)
|
|
- `acknowledged_at` (nullable)
|
|
- `acknowledged_by_user_id` (nullable fk users)
|
|
- `evidence_jsonb` (jsonb; sanitized, small; allowlist)
|
|
|
|
**Prepared for later (nullable, out of MVP)**
|
|
- `rule_id`, `control_id`, `expected_value`, `source`
|
|
|
|
## Constraints & Indexes
|
|
|
|
**Uniqueness**
|
|
- Unique: `(tenant_id, fingerprint)`
|
|
|
|
**Lookup indexes (suggested)**
|
|
- `(tenant_id, finding_type, status)`
|
|
- `(tenant_id, scope_key)`
|
|
- `(tenant_id, current_run_id)`
|
|
- `(tenant_id, baseline_run_id)`
|
|
- `(tenant_id, subject_type, subject_external_id)`
|
|
|
|
## Relationships
|
|
|
|
- `Finding` belongs to `Tenant`.
|
|
- `Finding` belongs to `User` via `acknowledged_by_user_id`.
|
|
- `Finding` belongs to `InventorySyncRun` via `baseline_run_id` (nullable) and `current_run_id` (nullable).
|
|
|
|
## Evidence shape (MVP allowlist)
|
|
|
|
For Drift MVP, `evidence_jsonb` should contain only:
|
|
- `change_type`
|
|
- `changed_fields` (list) and/or `change_counts`
|
|
- `run`:
|
|
- `baseline_run_id`, `current_run_id`
|
|
- `baseline_finished_at`, `current_finished_at`
|
|
|
|
No raw policy payload dumps; exclude secrets/tokens; exclude volatile fields for hashing.
|