TenantAtlas/tests/Feature/Operations/AssignmentRestoreOperationRunTest.php
ahmido bda1d90fc4 Spec 094: Assignment ops observability hardening (#113)
Implements spec 094 (assignment fetch/restore observability hardening):

- Adds OperationRun tracking for assignment fetch (during backup) and assignment restore (during restore execution)
- Normalizes failure codes/reason_code and sanitizes failure messages
- Ensures exactly one audit log entry per assignment restore execution
- Enforces correct guard/membership vs capability semantics on affected admin surfaces
- Switches assignment Graph services to depend on GraphClientInterface

Also includes Postgres-only FK defense-in-depth check and a discoverable `composer test:pgsql` runner (scoped to the FK constraint test).

Tests:
- `vendor/bin/sail artisan test --compact` (passed)
- `vendor/bin/sail composer test:pgsql` (passed)

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #113
2026-02-15 14:08:14 +00:00

118 lines
3.8 KiB
PHP

<?php
use App\Models\BackupItem;
use App\Models\BackupSet;
use App\Models\OperationRun;
use App\Models\Policy;
use App\Models\Tenant;
use App\Models\User;
use App\Services\Graph\GraphClientInterface;
use App\Services\Graph\GraphResponse;
use App\Services\Intune\RestoreService;
use Illuminate\Foundation\Testing\RefreshDatabase;
uses(RefreshDatabase::class);
test('assignment restore writes an operation run with lifecycle and counters', function () {
app()->instance(GraphClientInterface::class, new class implements GraphClientInterface
{
public function listPolicies(string $policyType, array $options = []): GraphResponse
{
return new GraphResponse(true, []);
}
public function getPolicy(string $policyType, string $policyId, array $options = []): GraphResponse
{
return new GraphResponse(true, []);
}
public function getOrganization(array $options = []): GraphResponse
{
return new GraphResponse(true, []);
}
public function applyPolicy(string $policyType, string $policyId, array $payload, array $options = []): GraphResponse
{
return new GraphResponse(true, []);
}
public function request(string $method, string $path, array $options = []): GraphResponse
{
return new GraphResponse(true, []);
}
public function getServicePrincipalPermissions(array $options = []): GraphResponse
{
return new GraphResponse(true, []);
}
});
$tenant = Tenant::factory()->create([
'tenant_id' => 'tenant-assignment-restore-success',
]);
ensureDefaultProviderConnection($tenant);
$policy = Policy::factory()->create([
'tenant_id' => (int) $tenant->getKey(),
'external_id' => 'policy-assignment-restore-success',
'policy_type' => 'settingsCatalogPolicy',
]);
$backupSet = BackupSet::factory()->create([
'tenant_id' => (int) $tenant->getKey(),
]);
$backupItem = BackupItem::factory()->create([
'tenant_id' => (int) $tenant->getKey(),
'backup_set_id' => (int) $backupSet->getKey(),
'policy_id' => (int) $policy->getKey(),
'policy_identifier' => (string) $policy->external_id,
'policy_type' => (string) $policy->policy_type,
'assignments' => [
[
'id' => 'assignment-1',
'target' => [
'@odata.type' => '#microsoft.graph.groupAssignmentTarget',
'groupId' => 'group-source-1',
],
],
],
'payload' => [
'@odata.type' => '#microsoft.graph.deviceManagementConfigurationPolicy',
],
]);
$user = User::factory()->create([
'email' => 'assignment.restore.success@example.com',
]);
$this->actingAs($user);
$restoreRun = app(RestoreService::class)->execute(
tenant: $tenant,
backupSet: $backupSet,
selectedItemIds: [(int) $backupItem->getKey()],
dryRun: false,
actorEmail: $user->email,
actorName: $user->name,
groupMapping: [
'group-source-1' => 'group-target-1',
],
);
$assignmentRun = OperationRun::query()
->where('tenant_id', (int) $tenant->getKey())
->where('type', 'assignments.restore')
->latest('id')
->first();
expect($assignmentRun)->not->toBeNull();
expect($assignmentRun?->status)->toBe('completed');
expect($assignmentRun?->outcome)->toBe('succeeded');
expect($assignmentRun?->context['restore_run_id'] ?? null)->toBe((int) $restoreRun->getKey());
expect($assignmentRun?->summary_counts ?? [])->toMatchArray([
'total' => 1,
'processed' => 1,
'failed' => 0,
]);
});