ahmido/TenantAtlas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity
88ba8a14d8
TenantAtlas/app/Support/Badges/Domains
History
ahmido 6a15fe978a feat: Spec 105 — Entra Admin Roles Evidence + Findings (#128) 
## Summary

Automated scanning of Entra ID directory roles to surface high-privilege role assignments as trackable findings with alerting support.

## What's included

### Core Services
- **EntraAdminRolesReportService** — Fetches role definitions + assignments via Graph API, builds payload with fingerprint deduplication
- **EntraAdminRolesFindingGenerator** — Creates/resolves/reopens findings based on high-privilege role catalog
- **HighPrivilegeRoleCatalog** — Curated list of high-privilege Entra roles (Global Admin, Privileged Auth Admin, etc.)
- **ScanEntraAdminRolesJob** — Queued job orchestrating scan → report → findings → alerts pipeline

### UI
- **AdminRolesSummaryWidget** — Tenant dashboard card showing last scan time, high-privilege assignment count, scan trigger button
- RBAC-gated: `ENTRA_ROLES_VIEW` for viewing, `ENTRA_ROLES_MANAGE` for scan trigger

### Infrastructure
- Graph contracts for `entraRoleDefinitions` + `entraRoleAssignments`
- `config/entra_permissions.php` — Entra permission registry
- `StoredReport.fingerprint` migration (deduplication support)
- `OperationCatalog` label + duration for `entra.admin_roles.scan`
- Artisan command `entra:scan-admin-roles` for CLI/scheduled use

### Global UX improvement
- **SummaryCountsNormalizer**: Zero values filtered, snake_case keys humanized (e.g. `report_deduped: 1` → `Report deduped: 1`). Affects all operation notifications.

## Test Coverage
- **12 test files**, **79+ tests**, **307+ assertions**
- Report service, finding generator, job orchestration, widget rendering, alert integration, RBAC enforcement, badge mapping

## Spec artifacts
- `specs/105-entra-admin-roles-evidence-findings/tasks.md` — Full task breakdown (38 tasks, all complete)
- `specs/105-entra-admin-roles-evidence-findings/checklists/requirements.md` — All items checked

## Files changed
46 files changed, 3641 insertions(+), 15 deletions(-)

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #128
2026-02-22 02:37:36 +00:00
..
AlertDeliveryStatusBadge.php feat(alerts): test message + last test status + deep links (#122) 2026-02-18 23:12:38 +00:00
AlertDestinationLastTestStatusBadge.php feat(alerts): test message + last test status + deep links (#122) 2026-02-18 23:12:38 +00:00
BackupSetStatusBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
BaselineProfileStatusBadge.php Baseline governance UX polish + view Infolist (#123) 2026-02-19 23:56:09 +00:00
BooleanEnabledBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
BooleanHasErrorsBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
FindingSeverityBadge.php feat: Workspace settings slices v1 (backup, drift, operations) (#120) 2026-02-16 03:18:33 +00:00
FindingStatusBadge.php feat(104): Provider Permission Posture (#127) 2026-02-21 22:32:52 +00:00
FindingTypeBadge.php feat: Spec 105 — Entra Admin Roles Evidence + Findings (#128) 2026-02-22 02:37:36 +00:00
IgnoredAtBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
ManagedTenantOnboardingVerificationStatusBadge.php 073-unified-managed-tenant-onboarding-wizard (#90) 2026-02-04 23:30:55 +00:00
OperationRunOutcomeBadge.php Spec 081: Provider connection cutover (#98) 2026-02-08 11:28:51 +00:00
OperationRunStatusBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
PolicyRestoreModeBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
PolicyRiskBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
PolicySnapshotModeBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
ProviderConnectionHealthBadge.php feat: unify provider connection actions and notifications (#73) 2026-01-25 01:01:37 +00:00
ProviderConnectionStatusBadge.php feat: unify provider connection actions and notifications (#73) 2026-01-25 01:01:37 +00:00
RestoreCheckSeverityBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
RestorePreviewDecisionBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
RestoreResultStatusBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
RestoreRunStatusBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
TenantAppStatusBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
TenantPermissionStatusBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
TenantRbacStatusBadge.php 059-unified-badges (#71) 2026-01-22 23:44:51 +00:00
TenantStatusBadge.php feat: unified managed tenant onboarding wizard (#88) 2026-02-03 17:30:15 +00:00
VerificationCheckSeverityBadge.php feat: verification report framework (074) (#89) 2026-02-03 23:58:17 +00:00
VerificationCheckStatusBadge.php feat: verification report framework (074) (#89) 2026-02-03 23:58:17 +00:00
VerificationReportOverallBadge.php feat: verification report framework (074) (#89) 2026-02-03 23:58:17 +00:00