ahmido
a449ecec5b
Beschreibung Implementiert das Drift MVP Feature (Spec: 044-drift-mvp) mit Fokus auf automatische Drift-Erkennung zwischen Inventory Sync Runs und Bulk-Triage für Findings. Was wurde implementiert? Drift-Erkennung: Vergleicht Policy-Snapshots, Assignments und Scope Tags zwischen Baseline- und Current-Runs. Deterministische Fingerprints verhindern Duplikate. Findings UI: Neue Filament Resource für Findings mit Listen- und Detail-Ansicht. DB-only Diffs (keine Graph-Calls zur Laufzeit). Bulk Acknowledge: "Acknowledge selected" (Bulk-Action auf der Liste) "Acknowledge all matching" (Header-Action, respektiert aktuelle Filter; Type-to-Confirm bei >100 Findings) Scope Tag Fix: Behebt False Positives bei Legacy-Daten ohne scope_tags.ids (inferiert Default-Werte). Authorization: Tenant-isoliert, Rollen-basiert (Owner/Manager/Operator können acknowledge). Tests: Vollständige Pest-Coverage (28 Tests, 347 Assertions) für Drift-Logik, UI und Bulk-Actions. Warum diese Änderungen? Problem: Keine automatisierte Drift-Erkennung; manuelle Triage bei vielen Findings ist mühsam. Lösung: Async Drift-Generierung mit persistenter Findings-Tabelle. Safe Bulk-Tools für Massen-Triage ohne Deletes. Konformität: Folgt AGENTS.md Workflow, Spec-Kit (Tasks + Checklists abgehakt), Laravel/Filament Best Practices. Technische Details Neue Dateien: ~40 (Models, Services, Tests, Views, Migrations) Änderungen: Filament Resources, Jobs, Policies DB: Neue findings Tabelle (JSONB für Evidence, Indexes für Performance) Tests: ./vendor/bin/sail artisan test tests/Feature/Drift --parallel → 28 passed Migration: ./vendor/bin/sail artisan migrate (neue Tabelle + Indexes) Screenshots / Links Spec: spec.md Tasks: tasks.md (alle abgehakt) UI: Findings-Liste mit Bulk-Actions; Detail-View mit Diffs Checklist Tests passieren (parallel + serial) Code formatiert (./vendor/bin/pint --dirty) Migration reversibel Tenant-Isolation enforced No Graph-Calls in Views Authorization checks Spec + Tasks aligned Deployment Notes Neue Migration: create_findings_table Neue Permissions: drift.view, drift.acknowledge Queue-Job: GenerateDriftFindingsJob (async, deduped)
168 lines
4.0 KiB
YAML
168 lines
4.0 KiB
YAML
openapi: 3.0.3
|
|
info:
|
|
title: Admin Findings API (Internal)
|
|
version: 0.1.0
|
|
description: |
|
|
Internal contracts for the generic Findings pipeline.
|
|
Drift MVP is the first generator (finding_type=drift).
|
|
|
|
servers:
|
|
- url: /admin/api
|
|
|
|
paths:
|
|
/findings:
|
|
get:
|
|
summary: List findings
|
|
parameters:
|
|
- in: query
|
|
name: finding_type
|
|
schema:
|
|
type: string
|
|
enum: [drift, audit, compare]
|
|
- in: query
|
|
name: status
|
|
schema:
|
|
type: string
|
|
enum: [new, acknowledged]
|
|
- in: query
|
|
name: scope_key
|
|
schema:
|
|
type: string
|
|
- in: query
|
|
name: current_run_id
|
|
schema:
|
|
type: integer
|
|
responses:
|
|
'200':
|
|
description: OK
|
|
content:
|
|
application/json:
|
|
schema:
|
|
type: object
|
|
properties:
|
|
data:
|
|
type: array
|
|
items:
|
|
$ref: '#/components/schemas/Finding'
|
|
|
|
/findings/{id}:
|
|
get:
|
|
summary: Get finding detail
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
required: true
|
|
schema:
|
|
type: integer
|
|
responses:
|
|
'200':
|
|
description: OK
|
|
content:
|
|
application/json:
|
|
schema:
|
|
type: object
|
|
properties:
|
|
data:
|
|
$ref: '#/components/schemas/Finding'
|
|
|
|
/findings/{id}/acknowledge:
|
|
post:
|
|
summary: Acknowledge a finding
|
|
parameters:
|
|
- in: path
|
|
name: id
|
|
required: true
|
|
schema:
|
|
type: integer
|
|
responses:
|
|
'200':
|
|
description: OK
|
|
content:
|
|
application/json:
|
|
schema:
|
|
type: object
|
|
properties:
|
|
data:
|
|
$ref: '#/components/schemas/Finding'
|
|
|
|
/drift/generate:
|
|
post:
|
|
summary: Generate drift findings (async)
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
type: object
|
|
properties:
|
|
scope_key:
|
|
type: string
|
|
description: Inventory selection hash
|
|
required: [scope_key]
|
|
responses:
|
|
'202':
|
|
description: Accepted
|
|
content:
|
|
application/json:
|
|
schema:
|
|
type: object
|
|
properties:
|
|
data:
|
|
$ref: '#/components/schemas/DriftGenerateAccepted'
|
|
|
|
components:
|
|
schemas:
|
|
DriftGenerateAccepted:
|
|
type: object
|
|
properties:
|
|
bulk_operation_run_id:
|
|
type: integer
|
|
description: Canonical async run record (status/errors/idempotency)
|
|
scope_key:
|
|
type: string
|
|
baseline_run_id:
|
|
type: integer
|
|
current_run_id:
|
|
type: integer
|
|
required: [bulk_operation_run_id, scope_key, baseline_run_id, current_run_id]
|
|
|
|
Finding:
|
|
type: object
|
|
properties:
|
|
id:
|
|
type: integer
|
|
finding_type:
|
|
type: string
|
|
enum: [drift, audit, compare]
|
|
tenant_id:
|
|
type: integer
|
|
scope_key:
|
|
type: string
|
|
baseline_run_id:
|
|
type: integer
|
|
nullable: true
|
|
current_run_id:
|
|
type: integer
|
|
nullable: true
|
|
fingerprint:
|
|
type: string
|
|
subject_type:
|
|
type: string
|
|
subject_external_id:
|
|
type: string
|
|
severity:
|
|
type: string
|
|
enum: [low, medium, high]
|
|
status:
|
|
type: string
|
|
enum: [new, acknowledged]
|
|
acknowledged_at:
|
|
type: string
|
|
nullable: true
|
|
acknowledged_by_user_id:
|
|
type: integer
|
|
nullable: true
|
|
evidence_jsonb:
|
|
type: object
|
|
additionalProperties: true
|