ahmido/TenantAtlas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity
9fd8cdef83
TenantAtlas/app/Filament/Resources
History
ahmido 6a15fe978a feat: Spec 105 — Entra Admin Roles Evidence + Findings (#128) 
## Summary

Automated scanning of Entra ID directory roles to surface high-privilege role assignments as trackable findings with alerting support.

## What's included

### Core Services
- **EntraAdminRolesReportService** — Fetches role definitions + assignments via Graph API, builds payload with fingerprint deduplication
- **EntraAdminRolesFindingGenerator** — Creates/resolves/reopens findings based on high-privilege role catalog
- **HighPrivilegeRoleCatalog** — Curated list of high-privilege Entra roles (Global Admin, Privileged Auth Admin, etc.)
- **ScanEntraAdminRolesJob** — Queued job orchestrating scan → report → findings → alerts pipeline

### UI
- **AdminRolesSummaryWidget** — Tenant dashboard card showing last scan time, high-privilege assignment count, scan trigger button
- RBAC-gated: `ENTRA_ROLES_VIEW` for viewing, `ENTRA_ROLES_MANAGE` for scan trigger

### Infrastructure
- Graph contracts for `entraRoleDefinitions` + `entraRoleAssignments`
- `config/entra_permissions.php` — Entra permission registry
- `StoredReport.fingerprint` migration (deduplication support)
- `OperationCatalog` label + duration for `entra.admin_roles.scan`
- Artisan command `entra:scan-admin-roles` for CLI/scheduled use

### Global UX improvement
- **SummaryCountsNormalizer**: Zero values filtered, snake_case keys humanized (e.g. `report_deduped: 1` → `Report deduped: 1`). Affects all operation notifications.

## Test Coverage
- **12 test files**, **79+ tests**, **307+ assertions**
- Report service, finding generator, job orchestration, widget rendering, alert integration, RBAC enforcement, badge mapping

## Spec artifacts
- `specs/105-entra-admin-roles-evidence-findings/tasks.md` — Full task breakdown (38 tasks, all complete)
- `specs/105-entra-admin-roles-evidence-findings/checklists/requirements.md` — All items checked

## Files changed
46 files changed, 3641 insertions(+), 15 deletions(-)

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #128
2026-02-22 02:37:36 +00:00
..
AlertDeliveryResource/Pages feat(alerts): Monitoring cluster + v1 resources (spec 099) (#121) 2026-02-18 15:20:43 +00:00
AlertDestinationResource/Pages Spec 103: IA semantics (scope vs filter vs targeting) + UI polish (#126) 2026-02-21 00:28:15 +00:00
AlertRuleResource/Pages Spec 103: IA semantics (scope vs filter vs targeting) + UI polish (#126) 2026-02-21 00:28:15 +00:00
BackupScheduleResource feat(spec-091): BackupSchedule lifecycle + create-CTA placement rule (#109) 2026-02-14 13:46:06 +00:00
BackupSetResource Spec 094: Assignment ops observability hardening (#113) 2026-02-15 14:08:14 +00:00
BaselineProfileResource Baseline governance UX polish + view Infolist (#123) 2026-02-19 23:56:09 +00:00
EntraGroupResource/Pages feat(spec-087): remove legacy runs (#106) 2026-02-12 12:40:51 +00:00
FindingResource/Pages feat(spec-087): remove legacy runs (#106) 2026-02-12 12:40:51 +00:00
InventoryItemResource/Pages feat(spec-087): remove legacy runs (#106) 2026-02-12 12:40:51 +00:00
PolicyResource feat(spec-090): action surface contract compliance (#108) 2026-02-13 01:30:22 +00:00
PolicyVersionResource/Pages feat/004-assignments-scope-tags (#4) 2025-12-23 21:49:58 +00:00
ProviderConnectionResource/Pages Spec 094: Assignment ops observability hardening (#113) 2026-02-15 14:08:14 +00:00
RestoreRunResource/Pages Spec 094: Assignment ops observability hardening (#113) 2026-02-15 14:08:14 +00:00
TenantResource feat: Spec 105 — Entra Admin Roles Evidence + Findings (#128) 2026-02-22 02:37:36 +00:00
Workspaces feat(spec-091): BackupSchedule lifecycle + create-CTA placement rule (#109) 2026-02-14 13:46:06 +00:00
AlertDeliveryResource.php feat(alerts): test message + last test status + deep links (#122) 2026-02-18 23:12:38 +00:00
AlertDestinationResource.php feat(alerts): test message + last test status + deep links (#122) 2026-02-18 23:12:38 +00:00
AlertRuleResource.php feat: Spec 105 — Entra Admin Roles Evidence + Findings (#128) 2026-02-22 02:37:36 +00:00
BackupScheduleResource.php Spec 092: Legacy Purge (runs/routes/UI/test shims) (#110) 2026-02-14 18:43:56 +00:00
BackupSetResource.php feat: upgrade Filament to v5.2.1 (#124) 2026-02-20 12:20:42 +00:00
BaselineProfileResource.php Spec 103: IA semantics (scope vs filter vs targeting) + UI polish (#126) 2026-02-21 00:28:15 +00:00
EntraGroupResource.php feat: action-surface contract inspect affordance + clickable rows (#100) 2026-02-08 20:31:36 +00:00
FindingResource.php feat(104): Provider Permission Posture (#127) 2026-02-21 22:32:52 +00:00
InventoryItemResource.php feat(spec-087): remove legacy runs (#106) 2026-02-12 12:40:51 +00:00
OperationRunResource.php 085-tenant-operate-hub (#103) 2026-02-11 13:02:03 +00:00
PolicyResource.php 085-tenant-operate-hub (#104) 2026-02-11 21:01:23 +00:00
PolicyVersionResource.php feat(spec-090): action surface contract compliance (#108) 2026-02-13 01:30:22 +00:00
ProviderConnectionResource.php Spec 103: IA semantics (scope vs filter vs targeting) + UI polish (#126) 2026-02-21 00:28:15 +00:00
RestoreRunResource.php 085-tenant-operate-hub (#103) 2026-02-11 13:02:03 +00:00
TenantResource.php Spec 103: IA semantics (scope vs filter vs targeting) + UI polish (#126) 2026-02-21 00:28:15 +00:00