ahmido
92704a2f7e
Implements Spec 118 baseline drift engine improvements: - Resumable, budget-aware evidence capture for baseline capture/compare runs (resume token + UI action) - “Why no findings?” reason-code driven explanations and richer run context panels - Baseline Snapshot resource (list/detail) with fidelity visibility - Retention command + schedule for pruning baseline-purpose PolicyVersions - i18n strings for Baseline Compare landing Verification: - `vendor/bin/sail bin pint --dirty --format agent` - `vendor/bin/sail artisan test --compact --filter=Baseline` (159 passed) Note: - `docs/audits/redaction-audit-2026-03-04.md` left untracked (not part of PR). Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #143
87 lines
1.9 KiB
PHP
87 lines
1.9 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Support\Baselines;
|
|
|
|
use JsonException;
|
|
|
|
final class BaselineEvidenceResumeToken
|
|
{
|
|
private const int VERSION = 1;
|
|
|
|
/**
|
|
* @param array<string, mixed> $state
|
|
*/
|
|
public static function encode(array $state): string
|
|
{
|
|
$payload = [
|
|
'v' => self::VERSION,
|
|
'state' => $state,
|
|
];
|
|
|
|
$json = json_encode($payload, JSON_THROW_ON_ERROR);
|
|
|
|
return self::base64UrlEncode($json);
|
|
}
|
|
|
|
/**
|
|
* @return array<string, mixed>|null
|
|
*/
|
|
public static function decode(string $token): ?array
|
|
{
|
|
$token = trim($token);
|
|
|
|
if ($token === '') {
|
|
return null;
|
|
}
|
|
|
|
$json = self::base64UrlDecode($token);
|
|
|
|
if ($json === null) {
|
|
return null;
|
|
}
|
|
|
|
try {
|
|
$decoded = json_decode($json, true, flags: JSON_THROW_ON_ERROR);
|
|
} catch (JsonException) {
|
|
return null;
|
|
}
|
|
|
|
if (! is_array($decoded)) {
|
|
return null;
|
|
}
|
|
|
|
$version = $decoded['v'] ?? null;
|
|
$version = is_int($version) ? $version : (is_numeric($version) ? (int) $version : null);
|
|
|
|
if ($version !== self::VERSION) {
|
|
return null;
|
|
}
|
|
|
|
$state = $decoded['state'] ?? null;
|
|
|
|
return is_array($state) ? $state : null;
|
|
}
|
|
|
|
private static function base64UrlEncode(string $value): string
|
|
{
|
|
return rtrim(strtr(base64_encode($value), '+/', '-_'), '=');
|
|
}
|
|
|
|
private static function base64UrlDecode(string $value): ?string
|
|
{
|
|
$padded = strtr($value, '-_', '+/');
|
|
$padding = strlen($padded) % 4;
|
|
|
|
if ($padding !== 0) {
|
|
$padded .= str_repeat('=', 4 - $padding);
|
|
}
|
|
|
|
$decoded = base64_decode($padded, true);
|
|
|
|
return is_string($decoded) ? $decoded : null;
|
|
}
|
|
}
|
|
|