ahmido/TenantAtlas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity
d4cbe7b722
TenantAtlas/app/Jobs
History
ahmido 6a15fe978a feat: Spec 105 — Entra Admin Roles Evidence + Findings (#128) 
## Summary

Automated scanning of Entra ID directory roles to surface high-privilege role assignments as trackable findings with alerting support.

## What's included

### Core Services
- **EntraAdminRolesReportService** — Fetches role definitions + assignments via Graph API, builds payload with fingerprint deduplication
- **EntraAdminRolesFindingGenerator** — Creates/resolves/reopens findings based on high-privilege role catalog
- **HighPrivilegeRoleCatalog** — Curated list of high-privilege Entra roles (Global Admin, Privileged Auth Admin, etc.)
- **ScanEntraAdminRolesJob** — Queued job orchestrating scan → report → findings → alerts pipeline

### UI
- **AdminRolesSummaryWidget** — Tenant dashboard card showing last scan time, high-privilege assignment count, scan trigger button
- RBAC-gated: `ENTRA_ROLES_VIEW` for viewing, `ENTRA_ROLES_MANAGE` for scan trigger

### Infrastructure
- Graph contracts for `entraRoleDefinitions` + `entraRoleAssignments`
- `config/entra_permissions.php` — Entra permission registry
- `StoredReport.fingerprint` migration (deduplication support)
- `OperationCatalog` label + duration for `entra.admin_roles.scan`
- Artisan command `entra:scan-admin-roles` for CLI/scheduled use

### Global UX improvement
- **SummaryCountsNormalizer**: Zero values filtered, snake_case keys humanized (e.g. `report_deduped: 1` → `Report deduped: 1`). Affects all operation notifications.

## Test Coverage
- **12 test files**, **79+ tests**, **307+ assertions**
- Report service, finding generator, job orchestration, widget rendering, alert integration, RBAC enforcement, badge mapping

## Spec artifacts
- `specs/105-entra-admin-roles-evidence-findings/tasks.md` — Full task breakdown (38 tasks, all complete)
- `specs/105-entra-admin-roles-evidence-findings/checklists/requirements.md` — All items checked

## Files changed
46 files changed, 3641 insertions(+), 15 deletions(-)

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #128
2026-02-22 02:37:36 +00:00
..
Alerts feat: Spec 105 — Entra Admin Roles Evidence + Findings (#128) 2026-02-22 02:37:36 +00:00
Middleware 054-unify-runs-suitewide (#63) 2026-01-17 22:25:00 +00:00
Operations 065-tenant-rbac-v1 (#79) 2026-01-28 21:09:47 +00:00
AddPoliciesToBackupSetJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
ApplyBackupScheduleRetentionJob.php feat: Workspace settings slices v1 (backup, drift, operations) (#120) 2026-02-16 03:18:33 +00:00
BackfillWorkspaceIdsJob.php SCOPE-001: DB-level workspace isolation via workspace_id (#112) 2026-02-14 22:34:02 +00:00
BulkBackupSetDeleteJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkBackupSetForceDeleteJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkBackupSetRestoreJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkPolicyDeleteJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkPolicyExportJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkPolicySyncJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkPolicyUnignoreJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkPolicyVersionForceDeleteJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkPolicyVersionPruneJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkPolicyVersionRestoreJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkRestoreRunDeleteJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkRestoreRunForceDeleteJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkRestoreRunRestoreJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
BulkTenantSyncJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
CaptureBaselineSnapshotJob.php Baseline governance UX polish + view Infolist (#123) 2026-02-19 23:56:09 +00:00
CapturePolicySnapshotJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
CompareBaselineToTenantJob.php Baseline governance UX polish + view Infolist (#123) 2026-02-19 23:56:09 +00:00
EntraGroupSyncJob.php feat(spec-087): remove legacy runs (#106) 2026-02-12 12:40:51 +00:00
ExecuteRestoreRunJob.php 085-tenant-operate-hub (#103) 2026-02-11 13:02:03 +00:00
FetchAssignmentsJob.php Spec 096: Ops polish (assignment summaries + dedupe + reconcile tracking + seed DX) (#115) 2026-02-15 20:49:38 +00:00
GenerateDriftFindingsJob.php feat(spec-087): remove legacy runs (#106) 2026-02-12 12:40:51 +00:00
GeneratePermissionPostureFindingsJob.php feat(104): Provider Permission Posture (#127) 2026-02-21 22:32:52 +00:00
ProviderComplianceSnapshotJob.php feat: unify provider connection actions and notifications (#73) 2026-01-25 01:01:37 +00:00
ProviderConnectionHealthCheckJob.php feat(104): Provider Permission Posture (#127) 2026-02-21 22:32:52 +00:00
ProviderInventorySyncJob.php feat: unify provider connection actions and notifications (#73) 2026-01-25 01:01:37 +00:00
PruneOldOperationRunsJob.php feat: Workspace settings slices v1 (backup, drift, operations) (#120) 2026-02-16 03:18:33 +00:00
ReconcileAdapterRunsJob.php Spec 096: Ops polish (assignment summaries + dedupe + reconcile tracking + seed DX) (#115) 2026-02-15 20:49:38 +00:00
RemovePoliciesFromBackupSetJob.php 056-remove-legacy-bulkops (#65) 2026-01-19 23:27:52 +00:00
RestoreAssignmentsJob.php Spec 096: Ops polish (assignment summaries + dedupe + reconcile tracking + seed DX) (#115) 2026-02-15 20:49:38 +00:00
RunBackupScheduleJob.php Spec 092: Legacy Purge (runs/routes/UI/test shims) (#110) 2026-02-14 18:43:56 +00:00
RunInventorySyncJob.php feat(spec-087): remove legacy runs (#106) 2026-02-12 12:40:51 +00:00
ScanEntraAdminRolesJob.php feat: Spec 105 — Entra Admin Roles Evidence + Findings (#128) 2026-02-22 02:37:36 +00:00
SyncPoliciesJob.php 085-tenant-operate-hub (#103) 2026-02-11 13:02:03 +00:00
SyncRoleDefinitionsJob.php 085-tenant-operate-hub (#103) 2026-02-11 13:02:03 +00:00