297 lines
10 KiB
PHP
297 lines
10 KiB
PHP
<?php
|
|
|
|
use App\Models\BackupItem;
|
|
use App\Models\BackupSchedule;
|
|
use App\Models\BackupScheduleRun;
|
|
use App\Models\BackupSet;
|
|
use App\Models\PolicyVersion;
|
|
use App\Models\Tenant;
|
|
use App\Services\Graph\GraphClientInterface;
|
|
use App\Services\Graph\GraphResponse;
|
|
use App\Services\Inventory\InventoryMetaSanitizer;
|
|
use App\Services\Inventory\InventoryMissingService;
|
|
use App\Services\Inventory\InventorySyncService;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Cache;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
function fakeGraphClient(array $policiesByType = [], array $failedTypes = [], ?Throwable $throwable = null): GraphClientInterface
|
|
{
|
|
return new class($policiesByType, $failedTypes, $throwable) implements GraphClientInterface
|
|
{
|
|
public function __construct(
|
|
private readonly array $policiesByType,
|
|
private readonly array $failedTypes,
|
|
private readonly ?Throwable $throwable,
|
|
) {}
|
|
|
|
public function listPolicies(string $policyType, array $options = []): GraphResponse
|
|
{
|
|
if ($this->throwable instanceof Throwable) {
|
|
throw $this->throwable;
|
|
}
|
|
|
|
if (in_array($policyType, $this->failedTypes, true)) {
|
|
return new GraphResponse(false, [], 403, ['error' => ['code' => 'Forbidden', 'message' => 'forbidden']], [], []);
|
|
}
|
|
|
|
return new GraphResponse(true, $this->policiesByType[$policyType] ?? []);
|
|
}
|
|
|
|
public function getPolicy(string $policyType, string $policyId, array $options = []): GraphResponse
|
|
{
|
|
return new GraphResponse(true, []);
|
|
}
|
|
|
|
public function getOrganization(array $options = []): GraphResponse
|
|
{
|
|
return new GraphResponse(true, []);
|
|
}
|
|
|
|
public function applyPolicy(string $policyType, string $policyId, array $payload, array $options = []): GraphResponse
|
|
{
|
|
return new GraphResponse(true, []);
|
|
}
|
|
|
|
public function getServicePrincipalPermissions(array $options = []): GraphResponse
|
|
{
|
|
return new GraphResponse(true, []);
|
|
}
|
|
|
|
public function request(string $method, string $path, array $options = []): GraphResponse
|
|
{
|
|
return new GraphResponse(true, []);
|
|
}
|
|
};
|
|
}
|
|
|
|
test('inventory sync upserts and updates last_seen fields without duplicates', function () {
|
|
$tenant = Tenant::factory()->create();
|
|
|
|
app()->instance(GraphClientInterface::class, fakeGraphClient([
|
|
'deviceConfiguration' => [
|
|
['id' => 'cfg-1', 'displayName' => 'Config 1', '@odata.type' => '#microsoft.graph.deviceConfiguration'],
|
|
],
|
|
]));
|
|
|
|
$service = app(InventorySyncService::class);
|
|
|
|
$selection = [
|
|
'policy_types' => ['deviceConfiguration'],
|
|
'categories' => ['Configuration'],
|
|
'include_foundations' => false,
|
|
'include_dependencies' => false,
|
|
];
|
|
|
|
$runA = $service->syncNow($tenant, $selection);
|
|
expect($runA->status)->toBe('success');
|
|
|
|
$item = \App\Models\InventoryItem::query()->where('tenant_id', $tenant->id)->first();
|
|
expect($item)->not->toBeNull();
|
|
expect($item->external_id)->toBe('cfg-1');
|
|
expect($item->last_seen_run_id)->toBe($runA->id);
|
|
|
|
$runB = $service->syncNow($tenant, $selection);
|
|
|
|
$items = \App\Models\InventoryItem::query()->where('tenant_id', $tenant->id)->get();
|
|
expect($items)->toHaveCount(1);
|
|
|
|
$items->first()->refresh();
|
|
expect($items->first()->last_seen_run_id)->toBe($runB->id);
|
|
});
|
|
|
|
test('meta whitelist drops unknown keys without failing', function () {
|
|
$tenant = Tenant::factory()->create();
|
|
|
|
$sanitizer = app(InventoryMetaSanitizer::class);
|
|
|
|
$meta = $sanitizer->sanitize([
|
|
'odata_type' => '#microsoft.graph.deviceConfiguration',
|
|
'etag' => 'W/\"123\"',
|
|
'scope_tag_ids' => ['0', 'tag-1'],
|
|
'assignment_target_count' => '5',
|
|
'warnings' => ['ok'],
|
|
'unknown_key' => 'should_not_persist',
|
|
]);
|
|
|
|
$item = \App\Models\InventoryItem::query()->create([
|
|
'tenant_id' => $tenant->id,
|
|
'policy_type' => 'deviceConfiguration',
|
|
'external_id' => 'cfg-1',
|
|
'display_name' => 'Config 1',
|
|
'meta_jsonb' => $meta,
|
|
'last_seen_at' => now(),
|
|
'last_seen_run_id' => null,
|
|
]);
|
|
|
|
$item->refresh();
|
|
|
|
$stored = is_array($item->meta_jsonb) ? $item->meta_jsonb : [];
|
|
|
|
expect($stored)->not->toHaveKey('unknown_key');
|
|
expect($stored['assignment_target_count'] ?? null)->toBe(5);
|
|
});
|
|
|
|
test('inventory missing is derived from latest completed run and low confidence on partial runs', function () {
|
|
$tenant = Tenant::factory()->create();
|
|
|
|
$selection = [
|
|
'policy_types' => ['deviceConfiguration'],
|
|
'categories' => ['Configuration'],
|
|
'include_foundations' => false,
|
|
'include_dependencies' => false,
|
|
];
|
|
|
|
app()->instance(GraphClientInterface::class, fakeGraphClient([
|
|
'deviceConfiguration' => [
|
|
['id' => 'cfg-1', 'displayName' => 'Config 1', '@odata.type' => '#microsoft.graph.deviceConfiguration'],
|
|
],
|
|
]));
|
|
|
|
app(InventorySyncService::class)->syncNow($tenant, $selection);
|
|
|
|
app()->instance(GraphClientInterface::class, fakeGraphClient([
|
|
'deviceConfiguration' => [],
|
|
]));
|
|
|
|
app(InventorySyncService::class)->syncNow($tenant, $selection);
|
|
|
|
$missingService = app(InventoryMissingService::class);
|
|
$result = $missingService->missingForSelection($tenant, $selection);
|
|
|
|
expect($result['missing'])->toHaveCount(1);
|
|
expect($result['lowConfidence'])->toBeFalse();
|
|
|
|
app()->instance(GraphClientInterface::class, fakeGraphClient([
|
|
'deviceConfiguration' => [],
|
|
], failedTypes: ['deviceConfiguration']));
|
|
|
|
app(InventorySyncService::class)->syncNow($tenant, $selection);
|
|
|
|
$result2 = $missingService->missingForSelection($tenant, $selection);
|
|
expect($result2['missing'])->toHaveCount(1);
|
|
expect($result2['lowConfidence'])->toBeTrue();
|
|
});
|
|
|
|
test('selection isolation: run for selection Y does not affect selection X missing', function () {
|
|
$tenant = Tenant::factory()->create();
|
|
|
|
$selectionX = [
|
|
'policy_types' => ['deviceConfiguration'],
|
|
'categories' => ['Configuration'],
|
|
'include_foundations' => false,
|
|
'include_dependencies' => false,
|
|
];
|
|
|
|
$selectionY = [
|
|
'policy_types' => ['deviceCompliancePolicy'],
|
|
'categories' => ['Compliance'],
|
|
'include_foundations' => false,
|
|
'include_dependencies' => false,
|
|
];
|
|
|
|
app()->instance(GraphClientInterface::class, fakeGraphClient([
|
|
'deviceConfiguration' => [
|
|
['id' => 'cfg-1', 'displayName' => 'Config 1', '@odata.type' => '#microsoft.graph.deviceConfiguration'],
|
|
],
|
|
'deviceCompliancePolicy' => [
|
|
['id' => 'cmp-1', 'displayName' => 'Compliance 1', '@odata.type' => '#microsoft.graph.deviceCompliancePolicy'],
|
|
],
|
|
]));
|
|
|
|
$service = app(InventorySyncService::class);
|
|
$service->syncNow($tenant, $selectionX);
|
|
|
|
$service->syncNow($tenant, $selectionY);
|
|
|
|
$missingService = app(InventoryMissingService::class);
|
|
$resultX = $missingService->missingForSelection($tenant, $selectionX);
|
|
|
|
expect($resultX['missing'])->toHaveCount(0);
|
|
});
|
|
|
|
test('lock prevents overlapping runs for same tenant and selection', function () {
|
|
$tenant = Tenant::factory()->create();
|
|
|
|
app()->instance(GraphClientInterface::class, fakeGraphClient([
|
|
'deviceConfiguration' => [],
|
|
]));
|
|
|
|
$service = app(InventorySyncService::class);
|
|
|
|
$selection = [
|
|
'policy_types' => ['deviceConfiguration'],
|
|
'categories' => ['Configuration'],
|
|
'include_foundations' => false,
|
|
'include_dependencies' => false,
|
|
];
|
|
|
|
$hash = app(\App\Services\Inventory\InventorySelectionHasher::class)->hash($selection);
|
|
$lock = Cache::lock("inventory_sync:tenant:{$tenant->id}:selection:{$hash}", 900);
|
|
expect($lock->get())->toBeTrue();
|
|
|
|
$run = $service->syncNow($tenant, $selection);
|
|
|
|
expect($run->status)->toBe('skipped');
|
|
expect($run->error_codes)->toContain('lock_contended');
|
|
|
|
$lock->release();
|
|
});
|
|
|
|
test('inventory sync does not create snapshot or backup rows', function () {
|
|
$tenant = Tenant::factory()->create();
|
|
|
|
$baseline = [
|
|
'policy_versions' => PolicyVersion::query()->count(),
|
|
'backup_sets' => BackupSet::query()->count(),
|
|
'backup_items' => BackupItem::query()->count(),
|
|
'backup_schedules' => BackupSchedule::query()->count(),
|
|
'backup_schedule_runs' => BackupScheduleRun::query()->count(),
|
|
];
|
|
|
|
app()->instance(GraphClientInterface::class, fakeGraphClient([
|
|
'deviceConfiguration' => [],
|
|
]));
|
|
|
|
$service = app(InventorySyncService::class);
|
|
|
|
$service->syncNow($tenant, [
|
|
'policy_types' => ['deviceConfiguration'],
|
|
'categories' => ['Configuration'],
|
|
'include_foundations' => false,
|
|
'include_dependencies' => false,
|
|
]);
|
|
|
|
expect(PolicyVersion::query()->count())->toBe($baseline['policy_versions']);
|
|
expect(BackupSet::query()->count())->toBe($baseline['backup_sets']);
|
|
expect(BackupItem::query()->count())->toBe($baseline['backup_items']);
|
|
expect(BackupSchedule::query()->count())->toBe($baseline['backup_schedules']);
|
|
expect(BackupScheduleRun::query()->count())->toBe($baseline['backup_schedule_runs']);
|
|
});
|
|
|
|
test('run error persistence is safe and does not include bearer tokens', function () {
|
|
$tenant = Tenant::factory()->create();
|
|
|
|
$throwable = new RuntimeException('Graph failed: Bearer abc.def.ghi');
|
|
|
|
app()->instance(GraphClientInterface::class, fakeGraphClient(throwable: $throwable));
|
|
|
|
$service = app(InventorySyncService::class);
|
|
|
|
$run = $service->syncNow($tenant, [
|
|
'policy_types' => ['deviceConfiguration'],
|
|
'categories' => ['Configuration'],
|
|
'include_foundations' => false,
|
|
'include_dependencies' => false,
|
|
]);
|
|
|
|
expect($run->status)->toBe('failed');
|
|
|
|
$context = is_array($run->error_context) ? $run->error_context : [];
|
|
$message = (string) ($context['message'] ?? '');
|
|
|
|
expect($message)->not->toContain('abc.def.ghi');
|
|
expect($message)->toContain('Bearer [REDACTED]');
|
|
});
|