ahmido
92f39d9749
## Summary - introduce a shared reason-translation contract with envelopes, presenter helpers, fallback handling, and provider translation support - adopt translated operator-facing reason presentation across operation runs, notifications, provider guidance, tenant operability, and RBAC-related surfaces - add Spec 157 design artifacts and targeted regression coverage for translation quality, diagnostics retention, and authorization-safe guidance ## Validation - `vendor/bin/sail bin pint --dirty --format agent` - `vendor/bin/sail artisan test --compact tests/Architecture/ReasonTranslationPrimarySurfaceGuardTest.php tests/Unit/Support/ReasonTranslation/ReasonResolutionEnvelopeTest.php tests/Unit/Support/ReasonTranslation/ExecutionDenialReasonTranslationTest.php tests/Unit/Support/ReasonTranslation/TenantOperabilityReasonTranslationTest.php tests/Unit/Support/ReasonTranslation/RbacReasonTranslationTest.php tests/Unit/Support/ReasonTranslation/ProviderReasonTranslationTest.php tests/Feature/Notifications/OperationRunNotificationTest.php tests/Feature/Operations/OperationRunBlockedExecutionPresentationTest.php tests/Feature/Operations/TenantlessOperationRunViewerTest.php tests/Feature/ReasonTranslation/GovernanceReasonPresentationTest.php tests/Feature/Authorization/ReasonTranslationScopeSafetyTest.php tests/Feature/Monitoring/OperationRunBlockedSpec081Test.php tests/Feature/ProviderConnections/ProviderOperationBlockedGuidanceSpec081Test.php tests/Feature/ProviderConnections/ProviderGatewayRuntimeSmokeSpec081Test.php` ## Notes - Livewire v4.0+ compliance remains unchanged within the existing Filament v5 stack. - No new panel was added; provider registration remains in `bootstrap/providers.php`. - No new globally searchable resource was introduced. - No new destructive action family was introduced. - No new assets were added; the existing `filament:assets` deployment behavior remains unchanged. Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #187
57 lines
2.5 KiB
PHP
57 lines
2.5 KiB
PHP
<?php
|
|
|
|
use App\Support\OpsUx\RunFailureSanitizer;
|
|
use App\Support\Providers\ProviderReasonCodes;
|
|
|
|
it('normalizes provider auth and outage reason codes', function (): void {
|
|
expect(RunFailureSanitizer::normalizeReasonCode('invalid_client'))->toBe(ProviderReasonCodes::ProviderAuthFailed);
|
|
expect(RunFailureSanitizer::normalizeReasonCode('AADSTS700016'))->toBe(ProviderReasonCodes::ProviderAuthFailed);
|
|
expect(RunFailureSanitizer::normalizeReasonCode('bad_gateway'))->toBe(ProviderReasonCodes::NetworkUnreachable);
|
|
expect(RunFailureSanitizer::normalizeReasonCode('500'))->toBe(ProviderReasonCodes::NetworkUnreachable);
|
|
});
|
|
|
|
it('distinguishes structured operator reason codes from fallback-only inputs', function (): void {
|
|
expect(RunFailureSanitizer::isStructuredOperatorReasonCode('missing_capability'))->toBeTrue()
|
|
->and(RunFailureSanitizer::isStructuredOperatorReasonCode('provider_connection_missing'))->toBeTrue()
|
|
->and(RunFailureSanitizer::isStructuredOperatorReasonCode('foundation.capture_failed'))->toBeFalse();
|
|
});
|
|
|
|
it('redacts common secret patterns and forbidden substrings', function (): void {
|
|
$message = 'Authorization: Bearer super-secret-token access_token=abc refresh_token=def client_secret=ghi password=jkl';
|
|
|
|
$sanitized = RunFailureSanitizer::sanitizeMessage($message);
|
|
|
|
expect($sanitized)
|
|
->not->toContain('Authorization')
|
|
->not->toContain('Bearer ')
|
|
->not->toContain('access_token')
|
|
->not->toContain('refresh_token')
|
|
->not->toContain('client_secret')
|
|
->not->toContain('password')
|
|
->not->toContain('super-secret-token')
|
|
->not->toContain('abc')
|
|
->not->toContain('def')
|
|
->not->toContain('ghi')
|
|
->not->toContain('jkl');
|
|
});
|
|
|
|
it('keeps safe configuration language readable in failure messages', function (): void {
|
|
$message = 'passwordMinimumLength is 12 while password=super-secret should stay hidden.';
|
|
|
|
$sanitized = RunFailureSanitizer::sanitizeMessage($message);
|
|
|
|
expect($sanitized)->toContain('passwordMinimumLength');
|
|
expect($sanitized)->not->toContain('super-secret');
|
|
});
|
|
|
|
it('redacts email domains that survive token redaction boundaries', function (): void {
|
|
$message = 'Authorization: Bearer highly-sensitive-token-for-user@example.com';
|
|
|
|
$sanitized = RunFailureSanitizer::sanitizeMessage($message);
|
|
|
|
expect($sanitized)
|
|
->not->toContain('Bearer')
|
|
->not->toContain('@example.com')
|
|
->toContain('[REDACTED_EMAIL]');
|
|
});
|