ahmido
c86b399b43
Some checks failed
Main Confidence / confidence (push) Failing after 53s
## Summary This PR delivers three related improvements: ### 1. Finding Ownership Semantics (Spec 219) - Add responsibility/accountability labels to findings and finding exceptions - `owner_user_id` = accountable party (governance owner) - `assignee_user_id` = responsible party (technical implementer) - Expose Assign/Reassign actions in FindingResource with audit logging - Add ownership columns and filters to finding list - Propagate owner from finding to exception on creation - Tests: ownership semantics, assignment audit, workflow actions ### 2. Constitution v2.7.0 — LEAN-001 Pre-Production Lean Doctrine - New principle forbidding legacy aliases, migration shims, dual-write logic, and compatibility fixtures in a pre-production codebase - AI-agent 4-question verification gate before adding any compatibility path - Review rule: compatibility shims without answering the gate questions = merge blocker - Exit condition: LEAN-001 expires at first production deployment - Spec template: added default "Compatibility posture" block - Agent instructions: added "Pre-production compatibility check" section ### 3. Backup Set Operation Type Unification - Unified `backup_set.add_policies` and `backup_set.remove_policies` into single canonical `backup_set.update` - Removed all legacy aliases, constants, and test fixtures - Added lifecycle coverage for `backup_set.update` in config - Updated all 14+ test files referencing legacy types ### Spec Artifacts - `specs/219-finding-ownership-semantics/` — full spec, plan, tasks, research, data model, contracts, checklist ### Tests - All affected tests pass (OperationCatalog, backup set, finding workflow, ownership semantics) Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #256
85 lines
3.6 KiB
PHP
85 lines
3.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\Finding;
|
|
use App\Models\User;
|
|
use App\Services\Findings\FindingWorkflowService;
|
|
use Illuminate\Auth\Access\AuthorizationException;
|
|
|
|
it('classifies assignment audit metadata for owner assignee and clear mutations', function (
|
|
string $ownerTarget,
|
|
string $assigneeTarget,
|
|
string $expectedClassification,
|
|
string $expectedSummary,
|
|
): void {
|
|
[$actor, $tenant] = createUserWithTenant(role: 'owner');
|
|
|
|
$existingOwner = User::factory()->create(['name' => 'Existing Owner']);
|
|
createUserWithTenant(tenant: $tenant, user: $existingOwner, role: 'manager');
|
|
|
|
$existingAssignee = User::factory()->create(['name' => 'Existing Assignee']);
|
|
createUserWithTenant(tenant: $tenant, user: $existingAssignee, role: 'operator');
|
|
|
|
$replacementOwner = User::factory()->create(['name' => 'Replacement Owner']);
|
|
createUserWithTenant(tenant: $tenant, user: $replacementOwner, role: 'manager');
|
|
|
|
$replacementAssignee = User::factory()->create(['name' => 'Replacement Assignee']);
|
|
createUserWithTenant(tenant: $tenant, user: $replacementAssignee, role: 'operator');
|
|
|
|
$finding = $this->makeFindingForWorkflow($tenant, Finding::STATUS_TRIAGED, [
|
|
'owner_user_id' => (int) $existingOwner->getKey(),
|
|
'assignee_user_id' => (int) $existingAssignee->getKey(),
|
|
]);
|
|
|
|
$ownerUserId = match ($ownerTarget) {
|
|
'replacement' => (int) $replacementOwner->getKey(),
|
|
'clear' => null,
|
|
default => (int) $existingOwner->getKey(),
|
|
};
|
|
|
|
$assigneeUserId = match ($assigneeTarget) {
|
|
'replacement' => (int) $replacementAssignee->getKey(),
|
|
'clear' => null,
|
|
default => (int) $existingAssignee->getKey(),
|
|
};
|
|
|
|
$updated = app(FindingWorkflowService::class)->assign(
|
|
finding: $finding,
|
|
tenant: $tenant,
|
|
actor: $actor,
|
|
assigneeUserId: $assigneeUserId,
|
|
ownerUserId: $ownerUserId,
|
|
);
|
|
|
|
$audit = $this->latestFindingAudit($updated, 'finding.assigned');
|
|
|
|
expect($audit)->not->toBeNull();
|
|
expect(data_get($audit?->metadata, 'responsibility_change_classification'))->toBe($expectedClassification)
|
|
->and(data_get($audit?->metadata, 'responsibility_change_summary'))->toBe($expectedSummary);
|
|
|
|
expect($updated->owner_user_id)->toBe($ownerUserId)
|
|
->and($updated->assignee_user_id)->toBe($assigneeUserId);
|
|
})->with([
|
|
'owner only' => ['replacement', 'existing', 'owner_only', 'Updated the accountable owner and kept the active assignee unchanged.'],
|
|
'assignee only' => ['existing', 'replacement', 'assignee_only', 'Updated the active assignee and kept the accountable owner unchanged.'],
|
|
'owner and assignee' => ['replacement', 'replacement', 'owner_and_assignee', 'Updated the accountable owner and the active assignee.'],
|
|
'clear owner' => ['clear', 'existing', 'clear_owner', 'Cleared the accountable owner and kept the active assignee unchanged.'],
|
|
'clear assignee' => ['existing', 'clear', 'clear_assignee', 'Cleared the active assignee and kept the accountable owner unchanged.'],
|
|
]);
|
|
|
|
it('preserves 403 semantics for in-scope members without assignment capability', function (): void {
|
|
[$owner, $tenant] = createUserWithTenant(role: 'owner');
|
|
[$readonly] = createUserWithTenant(tenant: $tenant, role: 'readonly');
|
|
|
|
$finding = $this->makeFindingForWorkflow($tenant, Finding::STATUS_NEW);
|
|
|
|
expect(fn () => app(FindingWorkflowService::class)->assign(
|
|
finding: $finding,
|
|
tenant: $tenant,
|
|
actor: $readonly,
|
|
assigneeUserId: null,
|
|
ownerUserId: (int) $owner->getKey(),
|
|
))->toThrow(AuthorizationException::class);
|
|
});
|