ahmido
45a804970e
## Summary - complete Spec 136 canonical admin tenant rollout across admin-visible and shared Filament surfaces - add the shared panel-aware tenant resolver helper, persisted filter-state synchronization, and admin navigation segregation for tenant-sensitive resources - expand regression, guard, and parity coverage for admin-path tenant resolution, stale filters, workspace-wide tenant-default surfaces, and panel split behavior ## Validation - `vendor/bin/sail artisan test --compact tests/Feature/Guards/AdminTenantResolverGuardTest.php` - `vendor/bin/sail artisan test --compact tests/Feature/Filament/TableStatePersistenceTest.php` - `vendor/bin/sail artisan test --compact --filter='CanonicalAdminTenantFilterState|PolicyResource|BackupSchedule|BackupSet|FindingResource|BaselineCompareLanding|RestoreRunResource|InventoryItemResource|PolicyVersionResource|ProviderConnectionResource|TenantDiagnostics|InventoryCoverage|InventoryKpiHeader|AuditLog|EntraGroup'` - `vendor/bin/sail bin pint --dirty --format agent` ## Notes - Livewire v4.0+ compliance is preserved with Filament v5. - Provider registration remains unchanged in `bootstrap/providers.php`. - `PolicyResource` and `PolicyVersionResource` have admin global search disabled explicitly; `EntraGroupResource` keeps admin-aware scoped search with a View page. - Destructive and governance-sensitive actions retain existing confirmation and authorization behavior while using canonical tenant parity. - No new assets were introduced, so deployment asset strategy is unchanged and does not add new `filament:assets` work. Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #165
51 lines
2.1 KiB
PHP
51 lines
2.1 KiB
PHP
<?php
|
|
|
|
use App\Support\OpsUx\RunFailureSanitizer;
|
|
use App\Support\Providers\ProviderReasonCodes;
|
|
|
|
it('normalizes provider auth and outage reason codes', function (): void {
|
|
expect(RunFailureSanitizer::normalizeReasonCode('invalid_client'))->toBe(ProviderReasonCodes::ProviderAuthFailed);
|
|
expect(RunFailureSanitizer::normalizeReasonCode('AADSTS700016'))->toBe(ProviderReasonCodes::ProviderAuthFailed);
|
|
expect(RunFailureSanitizer::normalizeReasonCode('bad_gateway'))->toBe(ProviderReasonCodes::NetworkUnreachable);
|
|
expect(RunFailureSanitizer::normalizeReasonCode('500'))->toBe(ProviderReasonCodes::NetworkUnreachable);
|
|
});
|
|
|
|
it('redacts common secret patterns and forbidden substrings', function (): void {
|
|
$message = 'Authorization: Bearer super-secret-token access_token=abc refresh_token=def client_secret=ghi password=jkl';
|
|
|
|
$sanitized = RunFailureSanitizer::sanitizeMessage($message);
|
|
|
|
expect($sanitized)
|
|
->not->toContain('Authorization')
|
|
->not->toContain('Bearer ')
|
|
->not->toContain('access_token')
|
|
->not->toContain('refresh_token')
|
|
->not->toContain('client_secret')
|
|
->not->toContain('password')
|
|
->not->toContain('super-secret-token')
|
|
->not->toContain('abc')
|
|
->not->toContain('def')
|
|
->not->toContain('ghi')
|
|
->not->toContain('jkl');
|
|
});
|
|
|
|
it('keeps safe configuration language readable in failure messages', function (): void {
|
|
$message = 'passwordMinimumLength is 12 while password=super-secret should stay hidden.';
|
|
|
|
$sanitized = RunFailureSanitizer::sanitizeMessage($message);
|
|
|
|
expect($sanitized)->toContain('passwordMinimumLength');
|
|
expect($sanitized)->not->toContain('super-secret');
|
|
});
|
|
|
|
it('redacts email domains that survive token redaction boundaries', function (): void {
|
|
$message = 'Authorization: Bearer highly-sensitive-token-for-user@example.com';
|
|
|
|
$sanitized = RunFailureSanitizer::sanitizeMessage($message);
|
|
|
|
expect($sanitized)
|
|
->not->toContain('Bearer')
|
|
->not->toContain('@example.com')
|
|
->toContain('[REDACTED_EMAIL]');
|
|
});
|