Beschreibung Implementiert das Drift MVP Feature (Spec: 044-drift-mvp) mit Fokus auf automatische Drift-Erkennung zwischen Inventory Sync Runs und Bulk-Triage für Findings. Was wurde implementiert? Drift-Erkennung: Vergleicht Policy-Snapshots, Assignments und Scope Tags zwischen Baseline- und Current-Runs. Deterministische Fingerprints verhindern Duplikate. Findings UI: Neue Filament Resource für Findings mit Listen- und Detail-Ansicht. DB-only Diffs (keine Graph-Calls zur Laufzeit). Bulk Acknowledge: "Acknowledge selected" (Bulk-Action auf der Liste) "Acknowledge all matching" (Header-Action, respektiert aktuelle Filter; Type-to-Confirm bei >100 Findings) Scope Tag Fix: Behebt False Positives bei Legacy-Daten ohne scope_tags.ids (inferiert Default-Werte). Authorization: Tenant-isoliert, Rollen-basiert (Owner/Manager/Operator können acknowledge). Tests: Vollständige Pest-Coverage (28 Tests, 347 Assertions) für Drift-Logik, UI und Bulk-Actions. Warum diese Änderungen? Problem: Keine automatisierte Drift-Erkennung; manuelle Triage bei vielen Findings ist mühsam. Lösung: Async Drift-Generierung mit persistenter Findings-Tabelle. Safe Bulk-Tools für Massen-Triage ohne Deletes. Konformität: Folgt AGENTS.md Workflow, Spec-Kit (Tasks + Checklists abgehakt), Laravel/Filament Best Practices. Technische Details Neue Dateien: ~40 (Models, Services, Tests, Views, Migrations) Änderungen: Filament Resources, Jobs, Policies DB: Neue findings Tabelle (JSONB für Evidence, Indexes für Performance) Tests: ./vendor/bin/sail artisan test tests/Feature/Drift --parallel → 28 passed Migration: ./vendor/bin/sail artisan migrate (neue Tabelle + Indexes) Screenshots / Links Spec: spec.md Tasks: tasks.md (alle abgehakt) UI: Findings-Liste mit Bulk-Actions; Detail-View mit Diffs Checklist Tests passieren (parallel + serial) Code formatiert (./vendor/bin/pint --dirty) Migration reversibel Tenant-Isolation enforced No Graph-Calls in Views Authorization checks Spec + Tasks aligned Deployment Notes Neue Migration: create_findings_table Neue Permissions: drift.view, drift.acknowledge Queue-Job: GenerateDriftFindingsJob (async, deduped)
102 lines
2.6 KiB
PHP
102 lines
2.6 KiB
PHP
<?php
|
|
|
|
namespace App\Services\Drift;
|
|
|
|
class DriftHasher
|
|
{
|
|
/**
|
|
* @param array<int, string> $volatileKeys
|
|
*/
|
|
public function hashNormalized(mixed $value, array $volatileKeys = [
|
|
'@odata.context',
|
|
'@odata.etag',
|
|
'createdDateTime',
|
|
'lastModifiedDateTime',
|
|
'modifiedDateTime',
|
|
'createdAt',
|
|
'updatedAt',
|
|
]): string
|
|
{
|
|
$normalized = $this->normalizeValue($value, $volatileKeys);
|
|
|
|
return hash('sha256', json_encode($normalized, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE));
|
|
}
|
|
|
|
public function fingerprint(
|
|
int $tenantId,
|
|
string $scopeKey,
|
|
string $subjectType,
|
|
string $subjectExternalId,
|
|
string $changeType,
|
|
string $baselineHash,
|
|
string $currentHash,
|
|
): string {
|
|
$parts = [
|
|
(string) $tenantId,
|
|
$this->normalize($scopeKey),
|
|
$this->normalize($subjectType),
|
|
$this->normalize($subjectExternalId),
|
|
$this->normalize($changeType),
|
|
$this->normalize($baselineHash),
|
|
$this->normalize($currentHash),
|
|
];
|
|
|
|
return hash('sha256', implode('|', $parts));
|
|
}
|
|
|
|
private function normalize(string $value): string
|
|
{
|
|
return trim(mb_strtolower($value));
|
|
}
|
|
|
|
/**
|
|
* @param array<int, string> $volatileKeys
|
|
*/
|
|
private function normalizeValue(mixed $value, array $volatileKeys): mixed
|
|
{
|
|
if (is_array($value)) {
|
|
if ($this->isList($value)) {
|
|
$items = array_map(fn ($item) => $this->normalizeValue($item, $volatileKeys), $value);
|
|
|
|
usort($items, function ($a, $b): int {
|
|
return strcmp(
|
|
json_encode($a, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE),
|
|
json_encode($b, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE)
|
|
);
|
|
});
|
|
|
|
return $items;
|
|
}
|
|
|
|
$result = [];
|
|
|
|
foreach ($value as $key => $item) {
|
|
if (is_string($key) && in_array($key, $volatileKeys, true)) {
|
|
continue;
|
|
}
|
|
|
|
$result[$key] = $this->normalizeValue($item, $volatileKeys);
|
|
}
|
|
|
|
ksort($result);
|
|
|
|
return $result;
|
|
}
|
|
|
|
if (is_string($value)) {
|
|
return trim($value);
|
|
}
|
|
|
|
return $value;
|
|
}
|
|
|
|
private function isList(array $value): bool
|
|
{
|
|
if ($value === []) {
|
|
return true;
|
|
}
|
|
|
|
return array_keys($value) === range(0, count($value) - 1);
|
|
}
|
|
}
|