ahmido
6a5b8a3a11
Some checks failed
Main Confidence / confidence (push) Failing after 50s
## Summary - add a config-seeded canonical control catalog plus shared resolution primitives and Microsoft subject bindings - propagate canonical control references into findings-derived evidence snapshots and tenant review composition - add the feature spec artifacts and focused Pest coverage, plus the supporting workspace and Sail helper adjustments included in this branch ## Testing - cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Unit/Governance/CanonicalControlCatalogTest.php tests/Unit/Governance/CanonicalControlResolverTest.php tests/Feature/Governance/CanonicalControlResolutionIntegrationTest.php tests/Feature/Evidence/EvidenceSnapshotCanonicalControlReferenceTest.php tests/Feature/TenantReview/TenantReviewCanonicalControlReferenceTest.php tests/Feature/PlatformRelocation/CommandModelSmokeTest.php - cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #272
70 lines
2.3 KiB
PHP
70 lines
2.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Support\Governance\Controls;
|
|
|
|
final readonly class CanonicalControlResolver
|
|
{
|
|
/**
|
|
* @var list<string>
|
|
*/
|
|
private const SUPPORTED_CONTEXTS = ['baseline', 'drift', 'finding', 'evidence', 'exception', 'review', 'report'];
|
|
|
|
public function __construct(
|
|
private CanonicalControlCatalog $catalog,
|
|
) {}
|
|
|
|
public function resolve(CanonicalControlResolutionRequest $request): CanonicalControlResolutionResult
|
|
{
|
|
if ($request->provider !== 'microsoft') {
|
|
return CanonicalControlResolutionResult::unresolved('unsupported_provider', $request);
|
|
}
|
|
|
|
if (! in_array($request->consumerContext, self::SUPPORTED_CONTEXTS, true)) {
|
|
return CanonicalControlResolutionResult::unresolved('unsupported_consumer_context', $request);
|
|
}
|
|
|
|
if (! $request->hasDiscriminator()) {
|
|
return CanonicalControlResolutionResult::unresolved('insufficient_context', $request);
|
|
}
|
|
|
|
$bindings = array_values(array_filter(
|
|
$this->catalog->microsoftBindings(),
|
|
static fn (MicrosoftSubjectBinding $binding): bool => $binding->matches($request),
|
|
));
|
|
|
|
if ($bindings === []) {
|
|
return CanonicalControlResolutionResult::unresolved('missing_binding', $request);
|
|
}
|
|
|
|
$primaryBindings = array_values(array_filter(
|
|
$bindings,
|
|
static fn (MicrosoftSubjectBinding $binding): bool => $binding->primary,
|
|
));
|
|
|
|
if ($primaryBindings !== []) {
|
|
$bindings = $primaryBindings;
|
|
}
|
|
|
|
$candidateControlKeys = array_values(array_unique(array_map(
|
|
static fn (MicrosoftSubjectBinding $binding): string => $binding->controlKey,
|
|
$bindings,
|
|
)));
|
|
|
|
sort($candidateControlKeys, SORT_STRING);
|
|
|
|
if (count($candidateControlKeys) !== 1) {
|
|
return CanonicalControlResolutionResult::ambiguous($candidateControlKeys, $request);
|
|
}
|
|
|
|
$definition = $this->catalog->find($candidateControlKeys[0]);
|
|
|
|
if (! $definition instanceof CanonicalControlDefinition) {
|
|
return CanonicalControlResolutionResult::unresolved('missing_binding', $request);
|
|
}
|
|
|
|
return CanonicalControlResolutionResult::resolved($definition);
|
|
}
|
|
}
|