ahmido
c6e7591d19
## Summary - add Intune RBAC role definitions and role assignments as foundation-backed inventory, backup, and versioned snapshot types - add RBAC-specific normalization, coverage, permission-warning handling, and preview-only restore safety behavior across existing Filament and service surfaces - add spec 127 artifacts, contracts, audits, and focused regression coverage for inventory, backup, versioning, verification, and authorization behavior ## Testing - `vendor/bin/sail bin pint --dirty --format agent` - `vendor/bin/sail artisan test --compact tests/Feature/Inventory/InventorySyncServiceTest.php tests/Feature/Filament/InventoryCoverageTableTest.php tests/Feature/FoundationBackupTest.php tests/Feature/Filament/RestoreExecutionTest.php tests/Feature/RestoreUnknownPolicyTypeSafetyTest.php tests/Unit/GraphContractRegistryTest.php tests/Unit/FoundationSnapshotServiceTest.php tests/Feature/Verification/IntuneRbacPermissionCoverageTest.php tests/Unit/IntuneRoleDefinitionNormalizerTest.php tests/Unit/IntuneRoleAssignmentNormalizerTest.php` ## Notes - tasks in `specs/127-rbac-inventory-backup/tasks.md` are complete except `T041`, which is the documented manual QA validation step Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #155
92 lines
3.5 KiB
PHP
92 lines
3.5 KiB
PHP
<?php
|
|
|
|
use App\Services\Intune\IntuneRoleDefinitionNormalizer;
|
|
|
|
it('normalizes built-in intune role definitions into readable permission blocks', function (): void {
|
|
$normalizer = app(IntuneRoleDefinitionNormalizer::class);
|
|
|
|
$snapshot = [
|
|
'@odata.type' => '#microsoft.graph.deviceAndAppManagementRoleDefinition',
|
|
'displayName' => 'Policy and Profile Manager',
|
|
'description' => 'Built-in RBAC role',
|
|
'isBuiltIn' => true,
|
|
'rolePermissions' => [
|
|
[
|
|
'resourceActions' => [
|
|
[
|
|
'allowedResourceActions' => [
|
|
'Microsoft.Intune/deviceConfigurations/read',
|
|
'Microsoft.Intune/deviceConfigurations/create',
|
|
],
|
|
'notAllowedResourceActions' => [
|
|
'Microsoft.Intune/deviceConfigurations/delete',
|
|
],
|
|
],
|
|
],
|
|
],
|
|
],
|
|
'roleScopeTagIds' => ['scope-1', '0'],
|
|
];
|
|
|
|
$result = $normalizer->normalize($snapshot, 'intuneRoleDefinition', 'all');
|
|
|
|
$summary = collect($result['settings'])->firstWhere('title', 'Role definition');
|
|
$permissionBlock = collect($result['settings'])->firstWhere('title', 'Permission block 1');
|
|
$summaryEntries = collect($summary['entries'] ?? [])->keyBy('key');
|
|
$permissionEntries = collect($permissionBlock['entries'] ?? [])->keyBy('key');
|
|
|
|
expect($result['status'])->toBe('ok');
|
|
expect($summaryEntries['Role source']['value'] ?? null)->toBe('Built-in');
|
|
expect($summaryEntries['Permission blocks']['value'] ?? null)->toBe(1);
|
|
expect($summaryEntries['Scope tag IDs']['value'] ?? null)->toBe(['scope-1', '0']);
|
|
expect($permissionEntries['Allowed actions']['value'] ?? null)->toBe([
|
|
'Microsoft.Intune/deviceConfigurations/create',
|
|
'Microsoft.Intune/deviceConfigurations/read',
|
|
]);
|
|
expect($permissionEntries['Denied actions']['value'] ?? null)->toBe([
|
|
'Microsoft.Intune/deviceConfigurations/delete',
|
|
]);
|
|
});
|
|
|
|
it('flattens custom intune role definitions deterministically regardless of permission block order', function (): void {
|
|
$normalizer = app(IntuneRoleDefinitionNormalizer::class);
|
|
|
|
$firstSnapshot = [
|
|
'displayName' => 'Custom RBAC Role',
|
|
'isBuiltIn' => false,
|
|
'rolePermissions' => [
|
|
[
|
|
'resourceActions' => [
|
|
[
|
|
'allowedResourceActions' => [
|
|
'Microsoft.Intune/deviceCompliancePolicies/read',
|
|
],
|
|
],
|
|
],
|
|
],
|
|
[
|
|
'resourceActions' => [
|
|
[
|
|
'allowedResourceActions' => [
|
|
'Microsoft.Intune/deviceConfigurations/read',
|
|
],
|
|
'condition' => '@Resource[Microsoft.Intune/deviceConfigurations] Exists',
|
|
],
|
|
],
|
|
],
|
|
],
|
|
];
|
|
|
|
$secondSnapshot = [
|
|
'displayName' => 'Custom RBAC Role',
|
|
'isBuiltIn' => false,
|
|
'rolePermissions' => [
|
|
$firstSnapshot['rolePermissions'][1],
|
|
$firstSnapshot['rolePermissions'][0],
|
|
],
|
|
];
|
|
|
|
expect($normalizer->flattenForDiff($firstSnapshot, 'intuneRoleDefinition', 'all'))
|
|
->toBe($normalizer->flattenForDiff($secondSnapshot, 'intuneRoleDefinition', 'all'));
|
|
});
|