ahmido
da1adbdeb5
Implements Spec 119 (Drift Golden Master Cutover): - Baseline Compare is the only drift writer (`source = baseline.compare`). - Drift findings now store diff-compatible `evidence_jsonb` (summary.kind, baseline/current policy_version_id refs, fidelity + provenance). - Findings UI renders one-sided diffs for `missing_policy`/`unexpected_policy` when a single ref exists; otherwise shows explicit “diff unavailable”. - Removes legacy drift generator runtime (jobs/services/UI) and related tests. - Adds one-time migration to delete legacy drift findings (`finding_type=drift` where source is null or != baseline.compare). - Scopes baseline capture & landing duplicate warnings to latest completed inventory sync. - Canonicalizes compliance `scheduledActionsForRule` drift signal and keeps legacy snapshots comparable. Tests: - `vendor/bin/sail artisan test --compact` (full suite per tasks) - Focused pack: BaselinePolicyVersionResolverTest, BaselineCompareDriftEvidenceContractTest, DriftFindingDiffUnavailableTest, LegacyDriftFindingsCleanupMigrationTest, ComplianceNoncomplianceActionsDriftTest Notes: - Livewire v4+ / Filament v5 compatible (no legacy APIs). - No new external dependencies. Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #144
91 lines
3.1 KiB
PHP
91 lines
3.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\Policy;
|
|
use App\Models\PolicyVersion;
|
|
use App\Services\Drift\DriftHasher;
|
|
use App\Services\Drift\Normalizers\AssignmentsNormalizer;
|
|
use App\Services\Drift\Normalizers\ScopeTagsNormalizer;
|
|
use App\Services\Drift\Normalizers\SettingsNormalizer;
|
|
use App\Services\Intune\VersionService;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
it('redacts secrets before persisting snapshots and hashing content', function (): void {
|
|
[$user, $tenant] = createUserWithTenant(role: 'owner');
|
|
|
|
$policy = Policy::factory()->create([
|
|
'tenant_id' => (int) $tenant->getKey(),
|
|
'policy_type' => 'settingsCatalogPolicy',
|
|
'platform' => 'windows10',
|
|
]);
|
|
|
|
/** @var VersionService $service */
|
|
$service = app(VersionService::class);
|
|
|
|
$version1 = $service->captureVersion(
|
|
policy: $policy,
|
|
payload: [
|
|
'wifi' => [
|
|
'ssid' => 'Corp',
|
|
'password' => 'super-secret-1',
|
|
],
|
|
'settings' => [
|
|
'example' => true,
|
|
],
|
|
],
|
|
createdBy: $user->email,
|
|
);
|
|
|
|
$version2 = $service->captureVersion(
|
|
policy: $policy,
|
|
payload: [
|
|
'wifi' => [
|
|
'ssid' => 'Corp',
|
|
'password' => 'super-secret-2',
|
|
],
|
|
'settings' => [
|
|
'example' => true,
|
|
],
|
|
],
|
|
createdBy: $user->email,
|
|
);
|
|
|
|
$fresh1 = PolicyVersion::query()->findOrFail((int) $version1->getKey());
|
|
$fresh2 = PolicyVersion::query()->findOrFail((int) $version2->getKey());
|
|
|
|
expect($fresh1->snapshot['wifi']['password'])->toBe('[REDACTED]');
|
|
expect($fresh2->snapshot['wifi']['password'])->toBe('[REDACTED]');
|
|
expect($fresh1->snapshot['wifi']['ssid'])->toBe('Corp');
|
|
expect($fresh2->snapshot['wifi']['ssid'])->toBe('Corp');
|
|
|
|
$settingsNormalizer = app(SettingsNormalizer::class);
|
|
$assignmentsNormalizer = app(AssignmentsNormalizer::class);
|
|
$scopeTagsNormalizer = app(ScopeTagsNormalizer::class);
|
|
$hasher = app(DriftHasher::class);
|
|
|
|
$hash1 = $hasher->hashNormalized([
|
|
'settings' => $settingsNormalizer->normalizeForDiff(
|
|
snapshot: $fresh1->snapshot,
|
|
policyType: (string) $fresh1->policy_type,
|
|
platform: is_string($fresh1->platform) ? (string) $fresh1->platform : null,
|
|
),
|
|
'assignments' => $assignmentsNormalizer->normalizeForDiff($fresh1->assignments ?? []),
|
|
'scope_tag_ids' => $scopeTagsNormalizer->normalizeIds($fresh1->scope_tags ?? []),
|
|
]);
|
|
|
|
$hash2 = $hasher->hashNormalized([
|
|
'settings' => $settingsNormalizer->normalizeForDiff(
|
|
snapshot: $fresh2->snapshot,
|
|
policyType: (string) $fresh2->policy_type,
|
|
platform: is_string($fresh2->platform) ? (string) $fresh2->platform : null,
|
|
),
|
|
'assignments' => $assignmentsNormalizer->normalizeForDiff($fresh2->assignments ?? []),
|
|
'scope_tag_ids' => $scopeTagsNormalizer->normalizeIds($fresh2->scope_tags ?? []),
|
|
]);
|
|
|
|
expect($hash1)->toBe($hash2);
|
|
});
|