ahmido
8426741068
## Summary - add explicit BaselineSnapshot lifecycle truth with conservative backfill and a shared truth resolver - block baseline compare from building, incomplete, or superseded snapshots and align workspace/tenant UI truth surfaces with effective snapshot state - surface artifact truth separately from operation outcome across baseline profile, snapshot, compare, and operation run pages ## Testing - integrated browser smoke test on the active feature surfaces - `vendor/bin/sail artisan test --compact tests/Feature/Filament/BaselineSnapshotTruthSurfaceTest.php tests/Feature/Filament/BaselineProfileCompareStartSurfaceTest.php` - targeted baseline lifecycle and compare guard coverage added in Pest - `vendor/bin/sail bin pint --dirty --format agent` ## Notes - Livewire v4 compliance preserved - no panel provider registration changes were needed; Laravel 12 providers remain in `bootstrap/providers.php` - global search remains disabled for the affected baseline resources by design - destructive actions remain confirmation-gated; capture and compare actions keep their existing authorization and confirmation behavior - no new panel assets were added; existing deploy flow for `filament:assets` is unchanged Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #189
112 lines
4.3 KiB
PHP
112 lines
4.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Filament\Resources\BaselineProfileResource;
|
|
use App\Filament\Resources\BaselineSnapshotResource;
|
|
use App\Models\BaselineProfile;
|
|
use App\Models\BaselineSnapshot;
|
|
use App\Models\BaselineSnapshotItem;
|
|
|
|
it('renders the baseline snapshot detail page as summary-first with grouped policy browsing', function (): void {
|
|
[$user, $tenant] = createUserWithTenant(role: 'readonly');
|
|
|
|
$profile = BaselineProfile::factory()->active()->create([
|
|
'workspace_id' => (int) $tenant->workspace_id,
|
|
'name' => 'Security Baseline',
|
|
]);
|
|
|
|
$snapshot = BaselineSnapshot::factory()->create([
|
|
'workspace_id' => (int) $tenant->workspace_id,
|
|
'baseline_profile_id' => (int) $profile->getKey(),
|
|
'summary_jsonb' => [
|
|
'total_items' => 3,
|
|
'policy_type_counts' => [
|
|
'intuneRoleDefinition' => 1,
|
|
'deviceCompliancePolicy' => 1,
|
|
'mysteryPolicyType' => 1,
|
|
],
|
|
'fidelity_counts' => ['content' => 2, 'meta' => 1],
|
|
'gaps' => ['count' => 1, 'by_reason' => ['meta_fallback' => 1]],
|
|
],
|
|
]);
|
|
|
|
BaselineSnapshotItem::factory()->create([
|
|
'baseline_snapshot_id' => (int) $snapshot->getKey(),
|
|
'policy_type' => 'intuneRoleDefinition',
|
|
'subject_key' => hash('sha256', 'intuneRoleDefinition|security-reader'),
|
|
'subject_external_id' => hash('sha256', 'intuneRoleDefinition|security-reader'),
|
|
'meta_jsonb' => [
|
|
'display_name' => 'Security Reader',
|
|
'evidence' => [
|
|
'fidelity' => 'content',
|
|
'source' => 'policy_version',
|
|
'observed_at' => '2026-03-09T12:00:00+00:00',
|
|
],
|
|
'identity' => ['strategy' => 'external_id'],
|
|
'rbac' => [
|
|
'is_built_in' => false,
|
|
'role_permission_count' => 2,
|
|
],
|
|
'version_reference' => ['policy_version_id' => 42],
|
|
],
|
|
]);
|
|
|
|
BaselineSnapshotItem::factory()->create([
|
|
'baseline_snapshot_id' => (int) $snapshot->getKey(),
|
|
'policy_type' => 'deviceCompliancePolicy',
|
|
'subject_key' => 'bitlocker require',
|
|
'subject_external_id' => hash('sha256', 'deviceCompliancePolicy|bitlocker require'),
|
|
'meta_jsonb' => [
|
|
'display_name' => 'Bitlocker Require',
|
|
'platform' => 'windows',
|
|
'assignment_target_count' => 3,
|
|
'evidence' => [
|
|
'fidelity' => 'meta',
|
|
'source' => 'inventory',
|
|
'observed_at' => '2026-03-09T11:00:00+00:00',
|
|
],
|
|
],
|
|
]);
|
|
|
|
BaselineSnapshotItem::factory()->create([
|
|
'baseline_snapshot_id' => (int) $snapshot->getKey(),
|
|
'policy_type' => 'mysteryPolicyType',
|
|
'subject_key' => 'mystery policy',
|
|
'subject_external_id' => hash('sha256', 'mysteryPolicyType|mystery policy'),
|
|
'meta_jsonb' => [
|
|
'display_name' => 'Mystery Policy',
|
|
'platform' => 'windows',
|
|
'evidence' => [
|
|
'fidelity' => 'content',
|
|
'source' => 'policy_version',
|
|
'observed_at' => '2026-03-09T10:00:00+00:00',
|
|
],
|
|
],
|
|
]);
|
|
|
|
$this->actingAs($user)
|
|
->get(BaselineSnapshotResource::getUrl('view', ['record' => $snapshot], panel: 'admin'))
|
|
->assertOk()
|
|
->assertSee('Snapshot truth')
|
|
->assertSee('Coverage')
|
|
->assertSee('Capture timing')
|
|
->assertSee('Related context')
|
|
->assertSee(BaselineProfileResource::getUrl('view', ['record' => $profile], panel: 'admin'), false)
|
|
->assertSeeInOrder(['Security Baseline', 'Coverage summary', 'Captured policy types', 'Technical detail'])
|
|
->assertSee('Security Reader')
|
|
->assertSee('Bitlocker Require')
|
|
->assertSee('Mystery Policy')
|
|
->assertSee('Intune RBAC Role Definition')
|
|
->assertSee('Device Compliance')
|
|
->assertSee('Mystery Policy Type')
|
|
->assertDontSee('Intune RBAC Role Definition References');
|
|
|
|
$this->actingAs($user)
|
|
->get(BaselineSnapshotResource::getUrl(panel: 'admin'))
|
|
->assertOk()
|
|
->assertSee('View baseline profile')
|
|
->assertSee(BaselineSnapshotResource::getUrl('view', ['record' => $snapshot], panel: 'admin'))
|
|
->assertDontSee('>View<', escape: false);
|
|
});
|