ahmido
da18d3cb14
Dieses PR liefert den Inventory Dependencies Graph end-to-end: Abhängigkeiten (Edges) werden aus Inventory-Sync-Daten extrahiert, tenant-sicher gespeichert und in der Inventory Item Detailansicht angezeigt. Ziel: Admins können Prerequisites + Blast Radius (direct) schnell erkennen, ohne Snapshot/Restore anzufassen. ⸻ Was ist drin? Dependency Graph (Edges) • inventory_links Schema + Indizes + idempotentes Upsert (Unique Key) • Relationship Types (u.a.): • assigned_to_include, assigned_to_exclude • uses_assignment_filter • scoped_by_scope_tag • UI: Inventory Item → Dependencies Section • Direction Filter: All / Inbound / Outbound • Relationship Filter: All + spezifische Relationship Types • Missing-Badge + sicheres Tooltip (safe subset) Safety / Observability • Unknown/unsupported Shapes erzeugen keine Edges, sondern: • Warning in InventorySyncRun.error_context.warnings[] • optional info-log (ohne Secrets) • Limit-only Semantik (MVP): bis zu 50 Edges pro Richtung (max 100 bei “All”) • Blast Radius in MVP = direct only (kein depth>1 traversal) Name Resolution (lokal, ohne Entra Calls) • Resolver/DTO Layer für deterministische Labels (kein “Unknown” mehr) • Auflösung aus lokaler DB nur für Foundations, wenn vorhanden: • scope_tag → roleScopeTag • assignment_filter → assignmentFilter • aad_group bleibt bewusst external ref: “Group (external): …” (keine Graph/Entra Lookups im UI) • Zentraler FoundationTypeMap als Source-of-Truth (keine Hardcodings) ⸻ Out of Scope / Follow-up • Entra Group Name Resolution (braucht eigenes “Group Inventory” Modul + Permissions) • Foundations als Inventory Items / Coverage Tab (Scope Tags / Assignment Filters sichtbar & syncbar) → folgt als separater PR (Inventory Core/UI), damit 042 sauber “Edges-only” bleibt. ⸻ Tests / Verifikation • Targeted Pest Tests (Unit + Feature + UI smoke) für: • deterministische Edge-Erzeugung + idempotent upsert • tenant isolation (UI/Query) • warnings auf Run Record • resolver/name rendering + links (wo möglich) • pint --dirty ausgeführt ⸻ Manual QA (UI) 1. Inventory Sync Run mit include_dependencies=true starten 2. Inventory Item öffnen → Dependencies prüfen: • include/exclude + filter + scoped_by sichtbar (wenn vorhanden) • Relationship/Direction Filter funktionieren • keine “Unknown” Labels mehr, sondern deterministische Labels Co-authored-by: Ahmed Darrazi <ahmeddarrazi@adsmac.local> Reviewed-on: #50
261 lines
8.7 KiB
PHP
261 lines
8.7 KiB
PHP
<?php
|
|
|
|
use App\Filament\Resources\InventoryItemResource;
|
|
use App\Models\InventoryItem;
|
|
use App\Models\InventoryLink;
|
|
use App\Models\Tenant;
|
|
use Illuminate\Support\Str;
|
|
|
|
it('shows zero-state when no dependencies and shows missing badge when applicable', function () {
|
|
[$user, $tenant] = createUserWithTenant();
|
|
$this->actingAs($user);
|
|
|
|
/** @var InventoryItem $item */
|
|
$item = InventoryItem::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'external_id' => (string) Str::uuid(),
|
|
]);
|
|
|
|
// Zero state
|
|
$url = InventoryItemResource::getUrl('view', ['record' => $item], tenant: $tenant);
|
|
$this->get($url)->assertOk()->assertSee('No dependencies found');
|
|
|
|
// Create a missing edge and assert badge appears
|
|
InventoryLink::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'source_type' => 'inventory_item',
|
|
'source_id' => $item->external_id,
|
|
'target_type' => 'missing',
|
|
'target_id' => null,
|
|
'relationship_type' => 'assigned_to',
|
|
'metadata' => [
|
|
'last_known_name' => 'Ghost Target',
|
|
'raw_ref' => ['example' => 'ref'],
|
|
],
|
|
]);
|
|
|
|
$this->get($url)
|
|
->assertOk()
|
|
->assertSee('Missing')
|
|
->assertSee('Last known: Ghost Target');
|
|
});
|
|
|
|
it('direction filter limits to outbound or inbound', function () {
|
|
[$user, $tenant] = createUserWithTenant();
|
|
$this->actingAs($user);
|
|
|
|
/** @var InventoryItem $item */
|
|
$item = InventoryItem::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'external_id' => (string) Str::uuid(),
|
|
]);
|
|
|
|
// Outbound only
|
|
InventoryLink::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'source_type' => 'inventory_item',
|
|
'source_id' => $item->external_id,
|
|
'target_type' => 'foundation_object',
|
|
'target_id' => (string) Str::uuid(),
|
|
'relationship_type' => 'assigned_to',
|
|
]);
|
|
|
|
// Inbound only
|
|
InventoryLink::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'source_type' => 'inventory_item',
|
|
'source_id' => (string) Str::uuid(),
|
|
'target_type' => 'inventory_item',
|
|
'target_id' => $item->external_id,
|
|
'relationship_type' => 'depends_on',
|
|
]);
|
|
|
|
$urlOutbound = InventoryItemResource::getUrl('view', ['record' => $item], tenant: $tenant).'?direction=outbound';
|
|
$this->get($urlOutbound)->assertOk()->assertDontSee('No dependencies found');
|
|
|
|
$urlInbound = InventoryItemResource::getUrl('view', ['record' => $item], tenant: $tenant).'?direction=inbound';
|
|
$this->get($urlInbound)->assertOk()->assertDontSee('No dependencies found');
|
|
});
|
|
|
|
it('relationship filter limits edges by type', function () {
|
|
[$user, $tenant] = createUserWithTenant();
|
|
$this->actingAs($user);
|
|
|
|
/** @var InventoryItem $item */
|
|
$item = InventoryItem::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'external_id' => (string) Str::uuid(),
|
|
]);
|
|
|
|
// Two outbound edges with different relationship types.
|
|
InventoryLink::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'source_type' => 'inventory_item',
|
|
'source_id' => $item->external_id,
|
|
'target_type' => 'missing',
|
|
'target_id' => null,
|
|
'relationship_type' => 'assigned_to',
|
|
'metadata' => ['last_known_name' => 'Assigned Target'],
|
|
]);
|
|
|
|
InventoryLink::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'source_type' => 'inventory_item',
|
|
'source_id' => $item->external_id,
|
|
'target_type' => 'missing',
|
|
'target_id' => null,
|
|
'relationship_type' => 'scoped_by',
|
|
'metadata' => ['last_known_name' => 'Scoped Target'],
|
|
]);
|
|
|
|
$url = InventoryItemResource::getUrl('view', ['record' => $item], tenant: $tenant)
|
|
.'?direction=outbound&relationship_type=scoped_by';
|
|
|
|
$this->get($url)
|
|
->assertOk()
|
|
->assertSee('Scoped Target')
|
|
->assertDontSee('Assigned Target');
|
|
});
|
|
|
|
it('does not show edges from other tenants (tenant isolation)', function () {
|
|
[$user, $tenant] = createUserWithTenant();
|
|
$this->actingAs($user);
|
|
|
|
/** @var InventoryItem $item */
|
|
$item = InventoryItem::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'external_id' => (string) Str::uuid(),
|
|
]);
|
|
|
|
$otherTenant = Tenant::factory()->create();
|
|
|
|
// Same source_id, but different tenant_id: must not be rendered.
|
|
InventoryLink::factory()->create([
|
|
'tenant_id' => $otherTenant->getKey(),
|
|
'source_type' => 'inventory_item',
|
|
'source_id' => $item->external_id,
|
|
'target_type' => 'missing',
|
|
'target_id' => null,
|
|
'relationship_type' => 'assigned_to',
|
|
'metadata' => ['last_known_name' => 'Other Tenant Edge'],
|
|
]);
|
|
|
|
$url = InventoryItemResource::getUrl('view', ['record' => $item], tenant: $tenant);
|
|
$this->get($url)
|
|
->assertOk()
|
|
->assertDontSee('Other Tenant Edge');
|
|
});
|
|
|
|
it('shows masked identifier when last known name is missing', function () {
|
|
[$user, $tenant] = createUserWithTenant();
|
|
$this->actingAs($user);
|
|
|
|
/** @var InventoryItem $item */
|
|
$item = InventoryItem::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'external_id' => (string) Str::uuid(),
|
|
]);
|
|
|
|
InventoryLink::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'source_type' => 'inventory_item',
|
|
'source_id' => $item->external_id,
|
|
'target_type' => 'foundation_object',
|
|
'target_id' => '12345678-1234-1234-1234-123456789012',
|
|
'relationship_type' => 'assigned_to',
|
|
'metadata' => [
|
|
'last_known_name' => null,
|
|
'foundation_type' => 'aad_group',
|
|
],
|
|
]);
|
|
|
|
$url = InventoryItemResource::getUrl('view', ['record' => $item], tenant: $tenant);
|
|
$this->get($url)
|
|
->assertOk()
|
|
->assertSee('Group (external): 123456…');
|
|
});
|
|
|
|
it('resolves scope tag and assignment filter names from local inventory when available and labels groups as external', function () {
|
|
[$user, $tenant] = createUserWithTenant();
|
|
$this->actingAs($user);
|
|
|
|
/** @var InventoryItem $item */
|
|
$item = InventoryItem::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'external_id' => (string) Str::uuid(),
|
|
]);
|
|
|
|
$scopeTag = InventoryItem::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'policy_type' => 'roleScopeTag',
|
|
'external_id' => '6',
|
|
'display_name' => 'Finance',
|
|
]);
|
|
|
|
$assignmentFilter = InventoryItem::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'policy_type' => 'assignmentFilter',
|
|
'external_id' => '62fb77f0-0000-0000-0000-000000000000',
|
|
'display_name' => 'VIP Devices',
|
|
]);
|
|
|
|
InventoryLink::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'source_type' => 'inventory_item',
|
|
'source_id' => $item->external_id,
|
|
'target_type' => 'foundation_object',
|
|
'target_id' => $scopeTag->external_id,
|
|
'relationship_type' => 'scoped_by',
|
|
'metadata' => [
|
|
'last_known_name' => null,
|
|
'foundation_type' => 'scope_tag',
|
|
],
|
|
]);
|
|
|
|
InventoryLink::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'source_type' => 'inventory_item',
|
|
'source_id' => $item->external_id,
|
|
'target_type' => 'foundation_object',
|
|
'target_id' => $assignmentFilter->external_id,
|
|
'relationship_type' => 'uses_assignment_filter',
|
|
'metadata' => [
|
|
'last_known_name' => null,
|
|
'foundation_type' => 'assignment_filter',
|
|
],
|
|
]);
|
|
|
|
InventoryLink::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'source_type' => 'inventory_item',
|
|
'source_id' => $item->external_id,
|
|
'target_type' => 'foundation_object',
|
|
'target_id' => '428f24c0-0000-0000-0000-000000000000',
|
|
'relationship_type' => 'assigned_to_include',
|
|
'metadata' => [
|
|
'last_known_name' => null,
|
|
'foundation_type' => 'aad_group',
|
|
],
|
|
]);
|
|
|
|
$url = InventoryItemResource::getUrl('view', ['record' => $item], tenant: $tenant);
|
|
$this->get($url)
|
|
->assertOk()
|
|
->assertSee('Scope Tag: Finance (6…)')
|
|
->assertSee('Assignment Filter: VIP Devices (62fb77…)')
|
|
->assertSee('Group (external): 428f24…');
|
|
});
|
|
|
|
it('blocks guest access to inventory item dependencies view', function () {
|
|
$tenant = Tenant::factory()->create();
|
|
|
|
/** @var InventoryItem $item */
|
|
$item = InventoryItem::factory()->create([
|
|
'tenant_id' => $tenant->getKey(),
|
|
'external_id' => (string) Str::uuid(),
|
|
]);
|
|
|
|
$url = InventoryItemResource::getUrl('view', ['record' => $item], tenant: $tenant);
|
|
$this->get($url)->assertRedirect();
|
|
});
|