ahmido 3030dd9af2 054-unify-runs-suitewide (#63 )

Summary

Kurz: Implementiert Feature 054 — canonical OperationRun-flow, Monitoring UI, dispatch-safety, notifications, dedupe, plus small UX safety clarifications (RBAC group search delegated; Restore group mapping DB-only).
What Changed

Core service: OperationRun lifecycle, dedupe and dispatch helpers — OperationRunService.php.
Model + migration: OperationRun model and migration — OperationRun.php, 2026_01_16_180642_create_operation_runs_table.php.
Notifications: queued + terminal DB notifications (initiator-only) — OperationRunQueued.php, OperationRunCompleted.php.
Monitoring UI: Filament list/detail + Livewire pieces (DB-only render) — OperationRunResource.php and related pages/views.
Start surfaces / Jobs: instrumented start surfaces, job middleware, and job updates to use canonical runs — multiple app/Jobs/* and app/Filament/* updates (see tests for full coverage).
RBAC + Restore UX clarifications: RBAC group search is delegated-Graph-based and disabled without delegated token; Restore group mapping remains DB-only (directory cache) and helper text always visible — TenantResource.php, RestoreRunResource.php.
Specs / Constitution: updated spec & quickstart and added one-line constitution guideline about Graph usage:
spec.md
quickstart.md
constitution.md
Tests & Verification

Unit / Feature tests added/updated for run lifecycle, notifications, idempotency, and UI guards: see tests/Feature/* (notably OperationRunServiceTest, MonitoringOperationsTest, OperationRunNotificationTest, and various Filament feature tests).
Full test run locally: ./vendor/bin/sail artisan test → 587 passed, 5 skipped.
Migrations

Adds create_operation_runs_table migration; run php artisan migrate in staging after review.
Notes / Rationale

Monitoring pages are explicitly DB-only at render time (no Graph calls). Start surfaces enqueue work only and return a “View run” link.
Delegated Graph access is used only for explicit user actions (RBAC group search); restore mapping intentionally uses cached DB data only to avoid render-time Graph calls.
Dispatch wrapper marks runs failed immediately if background dispatch throws synchronously to avoid misleading “queued” states.
Upgrade / Deploy Considerations

Run migrations: ./vendor/bin/sail artisan migrate.
Background workers should be running to process queued jobs (recommended to monitor queue health during rollout).
No secret or token persistence changes.
PR checklist

Tests updated/added for changed behavior
Specs updated: 054-unify-runs-suitewide docs + quickstart
Constitution note added (.specify)
Pint formatting applied

Co-authored-by: Ahmed Darrazi <ahmeddarrazi@adsmac.local>
Reviewed-on: #63

2026-01-17 22:25:00 +00:00

1.6 KiB

Raw Blame History

Quickstart: Adding a New Operation

1. Register Run Type

Add your new type constant to App\Support\OperationRunType (if using Enums) or just use the string convention resource.action.

2. Implement Idempotency Inputs

Define what makes a run "unique" for your feature.

Example: ['scope' => 'full'] vs ['scope' => 'policy', 'policy_id' => 1].

3. Use `OperationRunService`

In your Start Action (Controller/Livewire):

// 1. Ensure Run
$run = $service->ensureRun($tenant, 'my_resource.action', $inputs, auth()->user());

// 2. Dispatch Job (if new)
if ($run->wasRecentlyCreated) {
    $service->dispatchOrFail($run, function () use ($run, $inputs): void {
        MyJob::dispatch($run, $inputs);
    });
}

// 3. Return View Link
return redirect(\App\Support\OperationRunLinks::viewUrl($tenant, $run));

4. Instrument Job

In your Job:

public function handle(\App\Services\OperationRunService $service)
{
    try {
        // ... do work ...
        
        // Success
        $service->updateRun($this->run, status: 'completed', outcome: 'succeeded', summaryCounts: [
            'processed' => 100,
        ]);
    } catch (\Throwable $e) {
        // Failure
        $service->failRun($this->run, $e);
    }
}

Notes: Monitoring & Run-Standard (Graph safety)

RBAC Wizard (TenantResource): group search is delegated-Graph-based and the picker is disabled without a delegated token.
Restore Wizard (RestoreRunResource): group mapping stays DB-only (Directory Cache / entra_groups) during the mapping phase — no Graph calls there; fallback helper text is always visible.

1.6 KiB Raw Blame History