ahmido
0dc79520a4
Implements provider access hardening for Intune write operations: - RBAC-based write gate with configurable staleness thresholds - Gate enforced at restore start and in jobs (execute + assignments) - UI affordances: disabled rerun action, tenant RBAC status card, refresh RBAC action - Audit logging for blocked writes - Ops UX label: `rbac.health_check` now displays as “RBAC health check” - Adds/updates Pest tests and SpecKit artifacts for feature 108 Notes: - Filament v5 / Livewire v4 compliant. - Destructive actions require confirmation. - Assets: no new global assets. Tested: - `vendor/bin/sail artisan test --compact` (suite previously green) + focused OpsUx tests for OperationCatalog labels. - `vendor/bin/sail bin pint --dirty`. Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #132
69 lines
2.2 KiB
PHP
69 lines
2.2 KiB
PHP
<?php
|
|
|
|
namespace App\Support\Providers;
|
|
|
|
final class ProviderReasonCodes
|
|
{
|
|
public const string ProviderConnectionMissing = 'provider_connection_missing';
|
|
|
|
public const string ProviderConnectionInvalid = 'provider_connection_invalid';
|
|
|
|
public const string ProviderCredentialMissing = 'provider_credential_missing';
|
|
|
|
public const string ProviderCredentialInvalid = 'provider_credential_invalid';
|
|
|
|
public const string ProviderConsentMissing = 'provider_consent_missing';
|
|
|
|
public const string ProviderAuthFailed = 'provider_auth_failed';
|
|
|
|
public const string ProviderPermissionMissing = 'provider_permission_missing';
|
|
|
|
public const string ProviderPermissionDenied = 'provider_permission_denied';
|
|
|
|
public const string ProviderPermissionRefreshFailed = 'provider_permission_refresh_failed';
|
|
|
|
public const string TenantTargetMismatch = 'tenant_target_mismatch';
|
|
|
|
public const string NetworkUnreachable = 'network_unreachable';
|
|
|
|
public const string RateLimited = 'rate_limited';
|
|
|
|
public const string UnknownError = 'unknown_error';
|
|
|
|
public const string IntuneRbacNotConfigured = 'intune_rbac.not_configured';
|
|
|
|
public const string IntuneRbacUnhealthy = 'intune_rbac.unhealthy';
|
|
|
|
public const string IntuneRbacStale = 'intune_rbac.stale';
|
|
|
|
/**
|
|
* @return array<int, string>
|
|
*/
|
|
public static function all(): array
|
|
{
|
|
return [
|
|
self::ProviderConnectionMissing,
|
|
self::ProviderConnectionInvalid,
|
|
self::ProviderCredentialMissing,
|
|
self::ProviderCredentialInvalid,
|
|
self::ProviderConsentMissing,
|
|
self::ProviderAuthFailed,
|
|
self::ProviderPermissionMissing,
|
|
self::ProviderPermissionDenied,
|
|
self::ProviderPermissionRefreshFailed,
|
|
self::TenantTargetMismatch,
|
|
self::NetworkUnreachable,
|
|
self::RateLimited,
|
|
self::UnknownError,
|
|
self::IntuneRbacNotConfigured,
|
|
self::IntuneRbacUnhealthy,
|
|
self::IntuneRbacStale,
|
|
];
|
|
}
|
|
|
|
public static function isKnown(string $reasonCode): bool
|
|
{
|
|
return in_array($reasonCode, self::all(), true) || str_starts_with($reasonCode, 'ext.');
|
|
}
|
|
}
|