ahmido
92704a2f7e
Implements Spec 118 baseline drift engine improvements: - Resumable, budget-aware evidence capture for baseline capture/compare runs (resume token + UI action) - “Why no findings?” reason-code driven explanations and richer run context panels - Baseline Snapshot resource (list/detail) with fidelity visibility - Retention command + schedule for pruning baseline-purpose PolicyVersions - i18n strings for Baseline Compare landing Verification: - `vendor/bin/sail bin pint --dirty --format agent` - `vendor/bin/sail artisan test --compact --filter=Baseline` (159 passed) Note: - `docs/audits/redaction-audit-2026-03-04.md` left untracked (not part of PR). Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #143
91 lines
3.1 KiB
PHP
91 lines
3.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\Policy;
|
|
use App\Models\PolicyVersion;
|
|
use App\Services\Drift\DriftHasher;
|
|
use App\Services\Drift\Normalizers\AssignmentsNormalizer;
|
|
use App\Services\Drift\Normalizers\SettingsNormalizer;
|
|
use App\Services\Drift\Normalizers\ScopeTagsNormalizer;
|
|
use App\Services\Intune\VersionService;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
it('redacts secrets before persisting snapshots and hashing content', function (): void {
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
|
|
$policy = Policy::factory()->create([
|
|
'tenant_id' => (int) $tenant->getKey(),
|
|
'policy_type' => 'settingsCatalogPolicy',
|
|
'platform' => 'windows10',
|
|
]);
|
|
|
|
/** @var VersionService $service */
|
|
$service = app(VersionService::class);
|
|
|
|
$version1 = $service->captureVersion(
|
|
policy: $policy,
|
|
payload: [
|
|
'wifi' => [
|
|
'ssid' => 'Corp',
|
|
'password' => 'super-secret-1',
|
|
],
|
|
'settings' => [
|
|
'example' => true,
|
|
],
|
|
],
|
|
createdBy: $user->email,
|
|
);
|
|
|
|
$version2 = $service->captureVersion(
|
|
policy: $policy,
|
|
payload: [
|
|
'wifi' => [
|
|
'ssid' => 'Corp',
|
|
'password' => 'super-secret-2',
|
|
],
|
|
'settings' => [
|
|
'example' => true,
|
|
],
|
|
],
|
|
createdBy: $user->email,
|
|
);
|
|
|
|
$fresh1 = PolicyVersion::query()->findOrFail((int) $version1->getKey());
|
|
$fresh2 = PolicyVersion::query()->findOrFail((int) $version2->getKey());
|
|
|
|
expect($fresh1->snapshot['wifi']['password'])->toBe('[REDACTED]');
|
|
expect($fresh2->snapshot['wifi']['password'])->toBe('[REDACTED]');
|
|
expect($fresh1->snapshot['wifi']['ssid'])->toBe('Corp');
|
|
expect($fresh2->snapshot['wifi']['ssid'])->toBe('Corp');
|
|
|
|
$settingsNormalizer = app(SettingsNormalizer::class);
|
|
$assignmentsNormalizer = app(AssignmentsNormalizer::class);
|
|
$scopeTagsNormalizer = app(ScopeTagsNormalizer::class);
|
|
$hasher = app(DriftHasher::class);
|
|
|
|
$hash1 = $hasher->hashNormalized([
|
|
'settings' => $settingsNormalizer->normalizeForDiff(
|
|
snapshot: $fresh1->snapshot,
|
|
policyType: (string) $fresh1->policy_type,
|
|
platform: is_string($fresh1->platform) ? (string) $fresh1->platform : null,
|
|
),
|
|
'assignments' => $assignmentsNormalizer->normalizeForDiff($fresh1->assignments ?? []),
|
|
'scope_tag_ids' => $scopeTagsNormalizer->normalizeIds($fresh1->scope_tags ?? []),
|
|
]);
|
|
|
|
$hash2 = $hasher->hashNormalized([
|
|
'settings' => $settingsNormalizer->normalizeForDiff(
|
|
snapshot: $fresh2->snapshot,
|
|
policyType: (string) $fresh2->policy_type,
|
|
platform: is_string($fresh2->platform) ? (string) $fresh2->platform : null,
|
|
),
|
|
'assignments' => $assignmentsNormalizer->normalizeForDiff($fresh2->assignments ?? []),
|
|
'scope_tag_ids' => $scopeTagsNormalizer->normalizeIds($fresh2->scope_tags ?? []),
|
|
]);
|
|
|
|
expect($hash1)->toBe($hash2);
|
|
});
|