TenantAtlas/tests/Feature/Drift/DriftFindingDetailShowsAssignmentsDiffTest.php

<?php

use App\Filament\Resources\FindingResource;
use App\Models\EntraGroup;
use App\Models\Finding;
use App\Models\InventoryItem;
use App\Models\InventorySyncRun;
use App\Models\Policy;
use App\Models\PolicyVersion;
use App\Services\Directory\EntraGroupLabelResolver;

test('finding detail shows an assignments diff with DB-only group label resolution', function () {
    bindFailHardGraphClient();

    [$user, $tenant] = createUserWithTenant(role: 'manager');

    $baseline = InventorySyncRun::factory()->for($tenant)->create([
        'selection_hash' => hash('sha256', 'scope-assignments-diff'),
        'status' => InventorySyncRun::STATUS_SUCCESS,
        'finished_at' => now()->subDays(2),
    ]);

    $current = InventorySyncRun::factory()->for($tenant)->create([
        'selection_hash' => $baseline->selection_hash,
        'status' => InventorySyncRun::STATUS_SUCCESS,
        'finished_at' => now()->subDay(),
    ]);

    $policy = Policy::factory()->for($tenant)->create([
        'external_id' => 'policy-456',
        'policy_type' => 'deviceConfiguration',
        'platform' => 'windows10',
    ]);

    $group1 = '76b787af-cae9-4a8e-89e9-b8cc67f81779';
    $group2 = '6b0bc3d7-91f3-4e4b-8181-8236d908d2dd';
    $group3 = 'cbd8d685-0d95-4de0-8fce-140a5cad8ddc';

    EntraGroup::factory()->for($tenant)->create([
        'entra_id' => strtolower($group1),
        'display_name' => 'Group One',
    ]);

    EntraGroup::factory()->for($tenant)->create([
        'entra_id' => strtolower($group3),
        'display_name' => 'Group Three',
    ]);

    $baselineVersion = PolicyVersion::factory()->for($tenant)->create([
        'policy_id' => $policy->getKey(),
        'version_number' => 1,
        'policy_type' => $policy->policy_type,
        'platform' => $policy->platform,
        'captured_at' => $baseline->finished_at->copy()->subHour(),
        'assignments' => [
            [
                'intent' => 'apply',
                'target' => [
                    '@odata.type' => '#microsoft.graph.groupAssignmentTarget',
                    'groupId' => $group1,
                    'deviceAndAppManagementAssignmentFilterId' => null,
                    'deviceAndAppManagementAssignmentFilterType' => 'none',
                ],
            ],
            [
                'target' => [
                    '@odata.type' => '#microsoft.graph.exclusionGroupAssignmentTarget',
                    'groupId' => $group2,
                    'deviceAndAppManagementAssignmentFilterId' => null,
                    'deviceAndAppManagementAssignmentFilterType' => 'none',
                ],
            ],
        ],
    ]);

    $currentVersion = PolicyVersion::factory()->for($tenant)->create([
        'policy_id' => $policy->getKey(),
        'version_number' => 2,
        'policy_type' => $policy->policy_type,
        'platform' => $policy->platform,
        'captured_at' => $current->finished_at->copy()->subHour(),
        'assignments' => [
            [
                'intent' => 'apply',
                'target' => [
                    '@odata.type' => '#microsoft.graph.groupAssignmentTarget',
                    'groupId' => $group1,
                    'deviceAndAppManagementAssignmentFilterId' => '62fb77d0-8f85-4ba0-a1c7-fd71d418521d',
                    'deviceAndAppManagementAssignmentFilterType' => 'include',
                ],
            ],
            [
                'intent' => 'apply',
                'target' => [
                    '@odata.type' => '#microsoft.graph.groupAssignmentTarget',
                    'groupId' => $group3,
                    'deviceAndAppManagementAssignmentFilterId' => null,
                    'deviceAndAppManagementAssignmentFilterType' => 'none',
                ],
            ],
        ],
    ]);

    $finding = Finding::factory()->for($tenant)->create([
        'finding_type' => Finding::FINDING_TYPE_DRIFT,
        'scope_key' => (string) $current->selection_hash,
        'baseline_run_id' => $baseline->getKey(),
        'current_run_id' => $current->getKey(),
        'subject_type' => 'assignment',
        'subject_external_id' => $policy->external_id,
        'evidence_jsonb' => [
            'change_type' => 'modified',
            'summary' => [
                'kind' => 'policy_assignments',
                'changed_fields' => ['assignments_hash'],
            ],
            'baseline' => [
                'policy_id' => $policy->external_id,
                'policy_version_id' => $baselineVersion->getKey(),
                'assignments_hash' => 'baseline-assignments-hash',
            ],
            'current' => [
                'policy_id' => $policy->external_id,
                'policy_version_id' => $currentVersion->getKey(),
                'assignments_hash' => 'current-assignments-hash',
            ],
        ],
    ]);

    InventoryItem::factory()->for($tenant)->create([
        'external_id' => $finding->subject_external_id,
        'display_name' => 'My Policy 456',
    ]);

    $expectedGroup1 = EntraGroupLabelResolver::formatLabel('Group One', $group1);
    $expectedGroup2 = EntraGroupLabelResolver::formatLabel(null, $group2);
    $expectedGroup3 = EntraGroupLabelResolver::formatLabel('Group Three', $group3);

    $this->actingAs($user)
        ->get(FindingResource::getUrl('view', ['record' => $finding], tenant: $tenant))
        ->assertOk()
        ->assertSee('Assignments diff')
        ->assertSee('1 added')
        ->assertSee('1 removed')
        ->assertSee('1 changed')
        ->assertSee($expectedGroup1)
        ->assertSee($expectedGroup2)
        ->assertSee($expectedGroup3)
        ->assertSee('include')
        ->assertSee('none');
});