Beschreibung Implementiert das Drift MVP Feature (Spec: 044-drift-mvp) mit Fokus auf automatische Drift-Erkennung zwischen Inventory Sync Runs und Bulk-Triage für Findings. Was wurde implementiert? Drift-Erkennung: Vergleicht Policy-Snapshots, Assignments und Scope Tags zwischen Baseline- und Current-Runs. Deterministische Fingerprints verhindern Duplikate. Findings UI: Neue Filament Resource für Findings mit Listen- und Detail-Ansicht. DB-only Diffs (keine Graph-Calls zur Laufzeit). Bulk Acknowledge: "Acknowledge selected" (Bulk-Action auf der Liste) "Acknowledge all matching" (Header-Action, respektiert aktuelle Filter; Type-to-Confirm bei >100 Findings) Scope Tag Fix: Behebt False Positives bei Legacy-Daten ohne scope_tags.ids (inferiert Default-Werte). Authorization: Tenant-isoliert, Rollen-basiert (Owner/Manager/Operator können acknowledge). Tests: Vollständige Pest-Coverage (28 Tests, 347 Assertions) für Drift-Logik, UI und Bulk-Actions. Warum diese Änderungen? Problem: Keine automatisierte Drift-Erkennung; manuelle Triage bei vielen Findings ist mühsam. Lösung: Async Drift-Generierung mit persistenter Findings-Tabelle. Safe Bulk-Tools für Massen-Triage ohne Deletes. Konformität: Folgt AGENTS.md Workflow, Spec-Kit (Tasks + Checklists abgehakt), Laravel/Filament Best Practices. Technische Details Neue Dateien: ~40 (Models, Services, Tests, Views, Migrations) Änderungen: Filament Resources, Jobs, Policies DB: Neue findings Tabelle (JSONB für Evidence, Indexes für Performance) Tests: ./vendor/bin/sail artisan test tests/Feature/Drift --parallel → 28 passed Migration: ./vendor/bin/sail artisan migrate (neue Tabelle + Indexes) Screenshots / Links Spec: spec.md Tasks: tasks.md (alle abgehakt) UI: Findings-Liste mit Bulk-Actions; Detail-View mit Diffs Checklist Tests passieren (parallel + serial) Code formatiert (./vendor/bin/pint --dirty) Migration reversibel Tenant-Isolation enforced No Graph-Calls in Views Authorization checks Spec + Tasks aligned Deployment Notes Neue Migration: create_findings_table Neue Permissions: drift.view, drift.acknowledge Queue-Job: GenerateDriftFindingsJob (async, deduped)
236 lines
7.5 KiB
PHP
236 lines
7.5 KiB
PHP
<?php
|
|
|
|
namespace App\Filament\Pages;
|
|
|
|
use App\Filament\Resources\BulkOperationRunResource;
|
|
use App\Filament\Resources\FindingResource;
|
|
use App\Filament\Resources\InventorySyncRunResource;
|
|
use App\Jobs\GenerateDriftFindingsJob;
|
|
use App\Models\BulkOperationRun;
|
|
use App\Models\Finding;
|
|
use App\Models\InventorySyncRun;
|
|
use App\Models\Tenant;
|
|
use App\Models\User;
|
|
use App\Services\BulkOperationService;
|
|
use App\Services\Drift\DriftRunSelector;
|
|
use App\Support\RunIdempotency;
|
|
use BackedEnum;
|
|
use Filament\Pages\Page;
|
|
use UnitEnum;
|
|
|
|
class DriftLanding extends Page
|
|
{
|
|
protected static string|BackedEnum|null $navigationIcon = 'heroicon-o-arrows-right-left';
|
|
|
|
protected static string|UnitEnum|null $navigationGroup = 'Drift';
|
|
|
|
protected static ?string $navigationLabel = 'Drift';
|
|
|
|
protected string $view = 'filament.pages.drift-landing';
|
|
|
|
public ?string $state = null;
|
|
|
|
public ?string $message = null;
|
|
|
|
public ?string $scopeKey = null;
|
|
|
|
public ?int $baselineRunId = null;
|
|
|
|
public ?int $currentRunId = null;
|
|
|
|
public ?string $baselineFinishedAt = null;
|
|
|
|
public ?string $currentFinishedAt = null;
|
|
|
|
public ?int $bulkOperationRunId = null;
|
|
|
|
/** @var array<string, int>|null */
|
|
public ?array $statusCounts = null;
|
|
|
|
public static function canAccess(): bool
|
|
{
|
|
return FindingResource::canAccess();
|
|
}
|
|
|
|
public function mount(): void
|
|
{
|
|
$tenant = Tenant::current();
|
|
|
|
$user = auth()->user();
|
|
if (! $user instanceof User) {
|
|
abort(403, 'Not allowed');
|
|
}
|
|
|
|
$latestSuccessful = InventorySyncRun::query()
|
|
->where('tenant_id', $tenant->getKey())
|
|
->where('status', InventorySyncRun::STATUS_SUCCESS)
|
|
->whereNotNull('finished_at')
|
|
->orderByDesc('finished_at')
|
|
->first();
|
|
|
|
if (! $latestSuccessful instanceof InventorySyncRun) {
|
|
$this->state = 'blocked';
|
|
$this->message = 'No successful inventory runs found yet.';
|
|
|
|
return;
|
|
}
|
|
|
|
$scopeKey = (string) $latestSuccessful->selection_hash;
|
|
$this->scopeKey = $scopeKey;
|
|
|
|
$selector = app(DriftRunSelector::class);
|
|
$comparison = $selector->selectBaselineAndCurrent($tenant, $scopeKey);
|
|
|
|
if ($comparison === null) {
|
|
$this->state = 'blocked';
|
|
$this->message = 'Need at least 2 successful runs for this scope to calculate drift.';
|
|
|
|
return;
|
|
}
|
|
|
|
$baseline = $comparison['baseline'];
|
|
$current = $comparison['current'];
|
|
|
|
$this->baselineRunId = (int) $baseline->getKey();
|
|
$this->currentRunId = (int) $current->getKey();
|
|
|
|
$this->baselineFinishedAt = $baseline->finished_at?->toDateTimeString();
|
|
$this->currentFinishedAt = $current->finished_at?->toDateTimeString();
|
|
|
|
$idempotencyKey = RunIdempotency::buildKey(
|
|
tenantId: (int) $tenant->getKey(),
|
|
operationType: 'drift.generate',
|
|
targetId: $scopeKey,
|
|
context: [
|
|
'scope_key' => $scopeKey,
|
|
'baseline_run_id' => (int) $baseline->getKey(),
|
|
'current_run_id' => (int) $current->getKey(),
|
|
],
|
|
);
|
|
|
|
$exists = Finding::query()
|
|
->where('tenant_id', $tenant->getKey())
|
|
->where('finding_type', Finding::FINDING_TYPE_DRIFT)
|
|
->where('scope_key', $scopeKey)
|
|
->where('baseline_run_id', $baseline->getKey())
|
|
->where('current_run_id', $current->getKey())
|
|
->exists();
|
|
|
|
if ($exists) {
|
|
$this->state = 'ready';
|
|
$newCount = (int) Finding::query()
|
|
->where('tenant_id', $tenant->getKey())
|
|
->where('finding_type', Finding::FINDING_TYPE_DRIFT)
|
|
->where('scope_key', $scopeKey)
|
|
->where('baseline_run_id', $baseline->getKey())
|
|
->where('current_run_id', $current->getKey())
|
|
->where('status', Finding::STATUS_NEW)
|
|
->count();
|
|
|
|
$this->statusCounts = [Finding::STATUS_NEW => $newCount];
|
|
|
|
return;
|
|
}
|
|
|
|
$latestRun = BulkOperationRun::query()
|
|
->where('tenant_id', $tenant->getKey())
|
|
->where('idempotency_key', $idempotencyKey)
|
|
->latest('id')
|
|
->first();
|
|
|
|
$activeRun = RunIdempotency::findActiveBulkOperationRun((int) $tenant->getKey(), $idempotencyKey);
|
|
if ($activeRun instanceof BulkOperationRun) {
|
|
$this->state = 'generating';
|
|
$this->bulkOperationRunId = (int) $activeRun->getKey();
|
|
|
|
return;
|
|
}
|
|
|
|
if ($latestRun instanceof BulkOperationRun && $latestRun->status === 'completed') {
|
|
$this->state = 'ready';
|
|
$this->bulkOperationRunId = (int) $latestRun->getKey();
|
|
|
|
$newCount = (int) Finding::query()
|
|
->where('tenant_id', $tenant->getKey())
|
|
->where('finding_type', Finding::FINDING_TYPE_DRIFT)
|
|
->where('scope_key', $scopeKey)
|
|
->where('baseline_run_id', $baseline->getKey())
|
|
->where('current_run_id', $current->getKey())
|
|
->where('status', Finding::STATUS_NEW)
|
|
->count();
|
|
|
|
$this->statusCounts = [Finding::STATUS_NEW => $newCount];
|
|
|
|
if ($newCount === 0) {
|
|
$this->message = 'No drift findings for this comparison. If you changed settings after the current run, run Inventory Sync again to capture a newer snapshot.';
|
|
}
|
|
|
|
return;
|
|
}
|
|
|
|
if ($latestRun instanceof BulkOperationRun && in_array($latestRun->status, ['failed', 'aborted'], true)) {
|
|
$this->state = 'error';
|
|
$this->message = 'Drift generation failed for this comparison. See the run for details.';
|
|
$this->bulkOperationRunId = (int) $latestRun->getKey();
|
|
|
|
return;
|
|
}
|
|
|
|
$bulkOperationService = app(BulkOperationService::class);
|
|
$run = $bulkOperationService->createRun(
|
|
tenant: $tenant,
|
|
user: $user,
|
|
resource: 'drift',
|
|
action: 'generate',
|
|
itemIds: [$scopeKey],
|
|
totalItems: 1,
|
|
);
|
|
|
|
$run->update(['idempotency_key' => $idempotencyKey]);
|
|
|
|
$this->state = 'generating';
|
|
$this->bulkOperationRunId = (int) $run->getKey();
|
|
|
|
GenerateDriftFindingsJob::dispatch(
|
|
tenantId: (int) $tenant->getKey(),
|
|
userId: (int) $user->getKey(),
|
|
baselineRunId: (int) $baseline->getKey(),
|
|
currentRunId: (int) $current->getKey(),
|
|
scopeKey: $scopeKey,
|
|
bulkOperationRunId: (int) $run->getKey(),
|
|
);
|
|
}
|
|
|
|
public function getFindingsUrl(): string
|
|
{
|
|
return FindingResource::getUrl('index', tenant: Tenant::current());
|
|
}
|
|
|
|
public function getBaselineRunUrl(): ?string
|
|
{
|
|
if (! is_int($this->baselineRunId)) {
|
|
return null;
|
|
}
|
|
|
|
return InventorySyncRunResource::getUrl('view', ['record' => $this->baselineRunId], tenant: Tenant::current());
|
|
}
|
|
|
|
public function getCurrentRunUrl(): ?string
|
|
{
|
|
if (! is_int($this->currentRunId)) {
|
|
return null;
|
|
}
|
|
|
|
return InventorySyncRunResource::getUrl('view', ['record' => $this->currentRunId], tenant: Tenant::current());
|
|
}
|
|
|
|
public function getBulkRunUrl(): ?string
|
|
{
|
|
if (! is_int($this->bulkOperationRunId)) {
|
|
return null;
|
|
}
|
|
|
|
return BulkOperationRunResource::getUrl('view', ['record' => $this->bulkOperationRunId], tenant: Tenant::current());
|
|
}
|
|
}
|