ahmido
d90fb0f963
PR Body Implements Spec 065 “Tenant RBAC v1” with capabilities-first RBAC, tenant membership scoping (Option 3), and consistent Filament action semantics. Key decisions / rules Tenancy Option 3: tenant switching is tenantless (ChooseTenant), tenant-scoped routes stay scoped, non-members get 404 (not 403). RBAC model: canonical capability registry + role→capability map + Gates for each capability (no role-string checks in UI logic). UX policy: for tenant members lacking permission → actions are visible but disabled + tooltip (avoid click→403). Security still enforced server-side. What’s included Capabilities foundation: Central capability registry (Capabilities::*) Role→capability mapping (RoleCapabilityMap) Gate registration + resolver/manager updates to support tenant-scoped authorization Filament enforcement hardening across the app: Tenant registration & tenant CRUD properly gated Backup/restore/policy flows aligned to “visible-but-disabled” where applicable Provider operations (health check / inventory sync / compliance snapshot) guarded and normalized Directory groups + inventory sync start surfaces normalized Policy version maintenance actions (archive/restore/prune/force delete) gated SpecKit artifacts for 065: spec.md, plan/tasks updates, checklists, enforcement hitlist Security guarantees Non-member → 404 via tenant scoping/membership guards. Member without capability → 403 on execution, even if UI is disabled. No destructive actions execute without proper authorization checks. Tests Adds/updates Pest coverage for: Tenant scoping & membership denial behavior Role matrix expectations (owner/manager/operator/readonly) Filament surface checks (visible/disabled actions, no side effects) Provider/Inventory/Groups run-start authorization Verified locally with targeted vendor/bin/sail artisan test --compact … Deployment / ops notes No new services required. Safe change: behavior is authorization + UI semantics; no breaking route changes intended. Co-authored-by: Ahmed Darrazi <ahmeddarrazi@MacBookPro.fritz.box> Reviewed-on: #79
357 lines
16 KiB
PHP
357 lines
16 KiB
PHP
<?php
|
|
|
|
namespace App\Filament\Resources\BackupSetResource\RelationManagers;
|
|
|
|
use App\Filament\Resources\PolicyResource;
|
|
use App\Jobs\RemovePoliciesFromBackupSetJob;
|
|
use App\Models\BackupItem;
|
|
use App\Models\Tenant;
|
|
use App\Models\User;
|
|
use App\Services\OperationRunService;
|
|
use App\Support\Auth\Capabilities;
|
|
use App\Support\Badges\BadgeDomain;
|
|
use App\Support\Badges\BadgeRenderer;
|
|
use App\Support\Badges\TagBadgeDomain;
|
|
use App\Support\Badges\TagBadgeRenderer;
|
|
use App\Support\OperationRunLinks;
|
|
use App\Support\OpsUx\OperationUxPresenter;
|
|
use App\Support\OpsUx\OpsUxBrowserEvents;
|
|
use Filament\Actions;
|
|
use Filament\Notifications\Notification;
|
|
use Filament\Resources\RelationManagers\RelationManager;
|
|
use Filament\Tables;
|
|
use Filament\Tables\Table;
|
|
use Illuminate\Contracts\View\View;
|
|
use Illuminate\Database\Eloquent\Builder;
|
|
use Illuminate\Database\Eloquent\Collection;
|
|
use Illuminate\Support\Facades\Gate;
|
|
|
|
class BackupItemsRelationManager extends RelationManager
|
|
{
|
|
protected static string $relationship = 'items';
|
|
|
|
protected $listeners = [
|
|
'backup-set-policy-picker:close' => 'closeAddPoliciesModal',
|
|
];
|
|
|
|
public function closeAddPoliciesModal(): void
|
|
{
|
|
$this->unmountAction();
|
|
}
|
|
|
|
public function table(Table $table): Table
|
|
{
|
|
return $table
|
|
->modifyQueryUsing(fn (Builder $query) => $query->with('policyVersion'))
|
|
->columns([
|
|
Tables\Columns\TextColumn::make('policy.display_name')
|
|
->label('Item')
|
|
->sortable()
|
|
->searchable()
|
|
->getStateUsing(fn (BackupItem $record) => $record->resolvedDisplayName()),
|
|
Tables\Columns\TextColumn::make('policyVersion.version_number')
|
|
->label('Version')
|
|
->badge()
|
|
->default('—')
|
|
->getStateUsing(fn (BackupItem $record): ?int => $record->policyVersion?->version_number),
|
|
Tables\Columns\TextColumn::make('policy_type')
|
|
->label('Type')
|
|
->badge()
|
|
->formatStateUsing(TagBadgeRenderer::label(TagBadgeDomain::PolicyType))
|
|
->color(TagBadgeRenderer::color(TagBadgeDomain::PolicyType)),
|
|
Tables\Columns\TextColumn::make('restore_mode')
|
|
->label('Restore')
|
|
->badge()
|
|
->state(fn (BackupItem $record) => static::typeMeta($record->policy_type)['restore'] ?? 'enabled')
|
|
->formatStateUsing(BadgeRenderer::label(BadgeDomain::PolicyRestoreMode))
|
|
->color(BadgeRenderer::color(BadgeDomain::PolicyRestoreMode))
|
|
->icon(BadgeRenderer::icon(BadgeDomain::PolicyRestoreMode))
|
|
->iconColor(BadgeRenderer::iconColor(BadgeDomain::PolicyRestoreMode)),
|
|
Tables\Columns\TextColumn::make('risk')
|
|
->label('Risk')
|
|
->badge()
|
|
->state(fn (BackupItem $record) => static::typeMeta($record->policy_type)['risk'] ?? 'n/a')
|
|
->formatStateUsing(BadgeRenderer::label(BadgeDomain::PolicyRisk))
|
|
->color(BadgeRenderer::color(BadgeDomain::PolicyRisk))
|
|
->icon(BadgeRenderer::icon(BadgeDomain::PolicyRisk))
|
|
->iconColor(BadgeRenderer::iconColor(BadgeDomain::PolicyRisk)),
|
|
Tables\Columns\TextColumn::make('policy_identifier')
|
|
->label('Policy ID')
|
|
->copyable(),
|
|
Tables\Columns\TextColumn::make('platform')
|
|
->badge()
|
|
->formatStateUsing(TagBadgeRenderer::label(TagBadgeDomain::Platform))
|
|
->color(TagBadgeRenderer::color(TagBadgeDomain::Platform)),
|
|
Tables\Columns\TextColumn::make('assignments')
|
|
->label('Assignments')
|
|
->badge()
|
|
->color('info')
|
|
->getStateUsing(function (BackupItem $record): string {
|
|
$assignments = $record->policyVersion?->assignments ?? $record->assignments;
|
|
|
|
if (is_array($assignments)) {
|
|
return (string) count($assignments);
|
|
}
|
|
|
|
$assignmentsFetched = $record->policyVersion?->metadata['assignments_fetched']
|
|
?? $record->metadata['assignments_fetched']
|
|
?? false;
|
|
|
|
return $assignmentsFetched ? '0' : '—';
|
|
}),
|
|
Tables\Columns\TextColumn::make('scope_tags')
|
|
->label('Scope Tags')
|
|
->default('—')
|
|
->getStateUsing(function (BackupItem $record): array {
|
|
$tags = $record->policyVersion?->scope_tags['names']
|
|
?? $record->metadata['scope_tag_names']
|
|
?? [];
|
|
|
|
return is_array($tags) ? $tags : [];
|
|
})
|
|
->formatStateUsing(function ($state): string {
|
|
if (is_array($state)) {
|
|
return $state === [] ? '—' : implode(', ', $state);
|
|
}
|
|
|
|
if (is_string($state) && $state !== '') {
|
|
return $state;
|
|
}
|
|
|
|
return '—';
|
|
}),
|
|
Tables\Columns\TextColumn::make('captured_at')->dateTime(),
|
|
Tables\Columns\TextColumn::make('created_at')->since(),
|
|
])
|
|
->filters([])
|
|
->headerActions([
|
|
Actions\Action::make('refreshTable')
|
|
->label('Refresh')
|
|
->icon('heroicon-o-arrow-path')
|
|
->action(function (): void {
|
|
$this->resetTable();
|
|
}),
|
|
Actions\Action::make('addPolicies')
|
|
->label('Add Policies')
|
|
->icon('heroicon-o-plus')
|
|
->disabled(fn (): bool => ! (($tenant = Tenant::current()) instanceof Tenant
|
|
&& Gate::allows(Capabilities::TENANT_SYNC, $tenant)))
|
|
->tooltip(fn (): ?string => (($tenant = Tenant::current()) instanceof Tenant
|
|
&& Gate::allows(Capabilities::TENANT_SYNC, $tenant)) ? null : 'You do not have permission to add policies.')
|
|
->modalHeading('Add Policies')
|
|
->modalSubmitAction(false)
|
|
->modalCancelActionLabel('Close')
|
|
->modalContent(function (): View {
|
|
$backupSet = $this->getOwnerRecord();
|
|
|
|
return view('filament.modals.backup-set-policy-picker', [
|
|
'backupSetId' => $backupSet->getKey(),
|
|
]);
|
|
}),
|
|
])
|
|
->actions([
|
|
Actions\ActionGroup::make([
|
|
Actions\ViewAction::make()
|
|
->label('View policy')
|
|
->url(function (BackupItem $record): ?string {
|
|
if (! $record->policy_id) {
|
|
return null;
|
|
}
|
|
|
|
$tenant = $this->getOwnerRecord()->tenant ?? \App\Models\Tenant::current();
|
|
|
|
return PolicyResource::getUrl('view', ['record' => $record->policy_id], tenant: $tenant);
|
|
})
|
|
->hidden(fn (BackupItem $record) => ! $record->policy_id)
|
|
->openUrlInNewTab(true),
|
|
Actions\Action::make('remove')
|
|
->label('Remove')
|
|
->color('danger')
|
|
->icon('heroicon-o-x-mark')
|
|
->requiresConfirmation()
|
|
->action(function (BackupItem $record): void {
|
|
$backupSet = $this->getOwnerRecord();
|
|
|
|
$user = auth()->user();
|
|
if (! $user instanceof User) {
|
|
abort(403);
|
|
}
|
|
|
|
$tenant = $backupSet->tenant ?? Tenant::current();
|
|
|
|
if (! $tenant instanceof Tenant) {
|
|
abort(404);
|
|
}
|
|
|
|
if (! Gate::forUser($user)->allows(Capabilities::TENANT_SYNC, $tenant)) {
|
|
abort(403);
|
|
}
|
|
|
|
if ((int) $tenant->getKey() !== (int) $backupSet->tenant_id) {
|
|
abort(403);
|
|
}
|
|
|
|
$backupItemIds = [(int) $record->getKey()];
|
|
|
|
/** @var OperationRunService $opService */
|
|
$opService = app(OperationRunService::class);
|
|
$opRun = $opService->ensureRun(
|
|
tenant: $tenant,
|
|
type: 'backup_set.remove_policies',
|
|
inputs: [
|
|
'backup_set_id' => (int) $backupSet->getKey(),
|
|
'backup_item_ids' => $backupItemIds,
|
|
],
|
|
initiator: $user,
|
|
);
|
|
|
|
if (! $opRun->wasRecentlyCreated && in_array($opRun->status, ['queued', 'running'], true)) {
|
|
Notification::make()
|
|
->title('Removal already queued')
|
|
->body('A matching remove operation is already queued or running.')
|
|
->info()
|
|
->actions([
|
|
Actions\Action::make('view_run')
|
|
->label('View run')
|
|
->url(OperationRunLinks::view($opRun, $tenant)),
|
|
])
|
|
->send();
|
|
|
|
return;
|
|
}
|
|
|
|
$opService->dispatchOrFail($opRun, function () use ($backupSet, $backupItemIds, $user, $opRun): void {
|
|
RemovePoliciesFromBackupSetJob::dispatch(
|
|
backupSetId: (int) $backupSet->getKey(),
|
|
backupItemIds: $backupItemIds,
|
|
initiatorUserId: (int) $user->getKey(),
|
|
operationRun: $opRun,
|
|
);
|
|
});
|
|
|
|
OpsUxBrowserEvents::dispatchRunEnqueued($this);
|
|
OperationUxPresenter::queuedToast((string) $opRun->type)
|
|
->actions([
|
|
Actions\Action::make('view_run')
|
|
->label('View run')
|
|
->url(OperationRunLinks::view($opRun, $tenant)),
|
|
])
|
|
->send();
|
|
}),
|
|
])->icon('heroicon-o-ellipsis-vertical'),
|
|
])
|
|
->bulkActions([
|
|
Actions\BulkActionGroup::make([
|
|
Actions\BulkAction::make('bulk_remove')
|
|
->label('Remove selected')
|
|
->icon('heroicon-o-x-mark')
|
|
->color('danger')
|
|
->requiresConfirmation()
|
|
->deselectRecordsAfterCompletion()
|
|
->action(function (Collection $records): void {
|
|
if ($records->isEmpty()) {
|
|
return;
|
|
}
|
|
|
|
$backupSet = $this->getOwnerRecord();
|
|
|
|
$user = auth()->user();
|
|
if (! $user instanceof User) {
|
|
abort(403);
|
|
}
|
|
|
|
$tenant = $backupSet->tenant ?? Tenant::current();
|
|
|
|
if (! $tenant instanceof Tenant) {
|
|
abort(404);
|
|
}
|
|
|
|
if (! Gate::forUser($user)->allows(Capabilities::TENANT_SYNC, $tenant)) {
|
|
abort(403);
|
|
}
|
|
|
|
if ((int) $tenant->getKey() !== (int) $backupSet->tenant_id) {
|
|
abort(403);
|
|
}
|
|
|
|
$backupItemIds = $records
|
|
->pluck('id')
|
|
->map(fn (mixed $value): int => (int) $value)
|
|
->filter(fn (int $value): bool => $value > 0)
|
|
->unique()
|
|
->sort()
|
|
->values()
|
|
->all();
|
|
|
|
if ($backupItemIds === []) {
|
|
return;
|
|
}
|
|
|
|
/** @var OperationRunService $opService */
|
|
$opService = app(OperationRunService::class);
|
|
$opRun = $opService->ensureRun(
|
|
tenant: $tenant,
|
|
type: 'backup_set.remove_policies',
|
|
inputs: [
|
|
'backup_set_id' => (int) $backupSet->getKey(),
|
|
'backup_item_ids' => $backupItemIds,
|
|
],
|
|
initiator: $user,
|
|
);
|
|
|
|
if (! $opRun->wasRecentlyCreated && in_array($opRun->status, ['queued', 'running'], true)) {
|
|
Notification::make()
|
|
->title('Removal already queued')
|
|
->body('A matching remove operation is already queued or running.')
|
|
->info()
|
|
->actions([
|
|
Actions\Action::make('view_run')
|
|
->label('View run')
|
|
->url(OperationRunLinks::view($opRun, $tenant)),
|
|
])
|
|
->send();
|
|
|
|
return;
|
|
}
|
|
|
|
$opService->dispatchOrFail($opRun, function () use ($backupSet, $backupItemIds, $user, $opRun): void {
|
|
RemovePoliciesFromBackupSetJob::dispatch(
|
|
backupSetId: (int) $backupSet->getKey(),
|
|
backupItemIds: $backupItemIds,
|
|
initiatorUserId: (int) $user->getKey(),
|
|
operationRun: $opRun,
|
|
);
|
|
});
|
|
|
|
OpsUxBrowserEvents::dispatchRunEnqueued($this);
|
|
OperationUxPresenter::queuedToast((string) $opRun->type)
|
|
->actions([
|
|
Actions\Action::make('view_run')
|
|
->label('View run')
|
|
->url(OperationRunLinks::view($opRun, $tenant)),
|
|
])
|
|
->send();
|
|
}),
|
|
]),
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* @return array{label:?string,category:?string,restore:?string,risk:?string}|array<string,mixed>
|
|
*/
|
|
private static function typeMeta(?string $type): array
|
|
{
|
|
if ($type === null) {
|
|
return [];
|
|
}
|
|
|
|
$types = array_merge(
|
|
config('tenantpilot.supported_policy_types', []),
|
|
config('tenantpilot.foundation_types', [])
|
|
);
|
|
|
|
return collect($types)
|
|
->firstWhere('type', $type) ?? [];
|
|
}
|
|
}
|