ahmido bc846d7c5c 051-entra-group-directory-cache (#57 )

Summary

Adds a tenant-scoped Entra Groups “Directory Cache” to enable DB-only group name resolution across the app (no render-time Graph calls), plus sync runs + observability.

What’s included
• Entra Groups cache
• New entra_groups storage (tenant-scoped) for group metadata (no memberships).
• Retention semantics: groups become stale / retained per spec (no hard delete on first miss).
• Group Sync Runs
• New “Group Sync Runs” UI (list + detail) with tenant isolation (403 on cross-tenant access).
• Manual “Sync Groups” action: creates/reuses a run, dispatches job, DB notification with “View run” link.
• Scheduled dispatcher command wired in console.php.
• DB-only label resolution (US3)
• Shared EntraGroupLabelResolver with safe fallback Unresolved (…last8) and UUID guarding.
• Refactors to prefer cached names (no typeahead / no live Graph) in:
• Tenant RBAC group selects
• Policy version assignments widget
• Restore results + restore wizard group mapping labels

Safety / Guardrails
• No render-time Graph calls: fail-hard guard test verifies UI paths don’t call GraphClientInterface during page render.
• Tenant isolation & authorization: policies + scoped queries enforced (cross-tenant access returns 403, not 404).
• Data minimization: only group metadata is cached (no membership/owners).

Tests / Verification
• Added/updated tests under tests/Feature/DirectoryGroups and tests/Unit/DirectoryGroups:
• Start sync → run record + job dispatch + upserts
• Retention purge semantics
• Scheduled dispatch wiring
• Render-time Graph guard
• UI/resource access isolation
• Ran:
• ./vendor/bin/pint --dirty
• ./vendor/bin/sail artisan test tests/Feature/DirectoryGroups
• ./vendor/bin/sail artisan test tests/Unit/DirectoryGroups

Notes / Follow-ups
• UI polish remains (picker/lookup UX, consistent progress widget/toasts across modules, navigation grouping).
• pr-gate checklist still has non-blocking open items (mostly UX/ops polish); requirements gate is green.

Co-authored-by: Ahmed Darrazi <ahmeddarrazi@adsmac.local>
Reviewed-on: #57

2026-01-11 23:24:12 +00:00

1.9 KiB

Raw Blame History

Data Model: Entra Group Directory Cache (Groups v1)

Entities

EntraGroup

Represents a cached directory group for a single tenant (metadata only).

Fields (conceptual)

id (internal)
tenant_id (FK)
entra_group_id (GUID/string; external stable identifier)
display_name (string)
group_type (enum/string, derived; e.g., Security, Microsoft365, Unknown)
security_enabled (bool, nullable)
mail_enabled (bool, nullable)
group_types (array/JSONB, nullable)
last_seen_at (timestamp)
last_seen_run_id (FK to sync run, optional)
created_at, updated_at

Constraints & indexes

Unique: (tenant_id, entra_group_id)
Index: (tenant_id, display_name) for search
Index: (tenant_id, last_seen_at) for stale/retention filtering

EntraGroupSyncRun

Append-only record for one sync attempt.