ahmido
a30be84084
Summary: - Baseline Compare landing: enterprise UI (stats grid, critical drift banner, better actions), navigation grouping under Governance, and Action Surface Contract declaration. - Baseline Profile view page: switches from disabled form fields to proper Infolist entries for a clean read-only view. - Fixes tenant name column usages (`display_name` → `name`) in baseline assignment flows. - Dashboard: improved baseline governance widget with severity breakdown + last compared. Notes: - Filament v5 / Livewire v4 compatible. - Destructive actions remain confirmed (`->requiresConfirmation()`). Tests: - `vendor/bin/sail artisan test --compact tests/Feature/Baselines` - `vendor/bin/sail artisan test --compact tests/Feature/Guards/ActionSurfaceContractTest.php` Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #123
115 lines
4.5 KiB
PHP
115 lines
4.5 KiB
PHP
<?php
|
|
|
|
namespace App\Services\Auth;
|
|
|
|
use App\Support\Auth\Capabilities;
|
|
use App\Support\Auth\WorkspaceRole;
|
|
|
|
/**
|
|
* Workspace Role to Capability Mapping (Single Source of Truth)
|
|
*
|
|
* This class defines which capabilities each workspace role has.
|
|
* All capability strings MUST be references from the Capabilities registry.
|
|
*/
|
|
class WorkspaceRoleCapabilityMap
|
|
{
|
|
/**
|
|
* @var array<string, array<int, string>>
|
|
*/
|
|
private static array $roleCapabilities = [
|
|
WorkspaceRole::Owner->value => [
|
|
Capabilities::WORKSPACE_VIEW,
|
|
Capabilities::WORKSPACE_MANAGE,
|
|
Capabilities::WORKSPACE_ARCHIVE,
|
|
Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
|
|
Capabilities::WORKSPACE_MEMBERSHIP_MANAGE,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_MANAGE,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_ACTIVATE,
|
|
Capabilities::WORKSPACE_SETTINGS_VIEW,
|
|
Capabilities::WORKSPACE_SETTINGS_MANAGE,
|
|
Capabilities::ALERTS_VIEW,
|
|
Capabilities::ALERTS_MANAGE,
|
|
Capabilities::WORKSPACE_BASELINES_VIEW,
|
|
Capabilities::WORKSPACE_BASELINES_MANAGE,
|
|
],
|
|
|
|
WorkspaceRole::Manager->value => [
|
|
Capabilities::WORKSPACE_VIEW,
|
|
Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
|
|
Capabilities::WORKSPACE_MEMBERSHIP_MANAGE,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_MANAGE,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP,
|
|
Capabilities::WORKSPACE_SETTINGS_VIEW,
|
|
Capabilities::WORKSPACE_SETTINGS_MANAGE,
|
|
Capabilities::ALERTS_VIEW,
|
|
Capabilities::ALERTS_MANAGE,
|
|
Capabilities::WORKSPACE_BASELINES_VIEW,
|
|
Capabilities::WORKSPACE_BASELINES_MANAGE,
|
|
],
|
|
|
|
WorkspaceRole::Operator->value => [
|
|
Capabilities::WORKSPACE_VIEW,
|
|
Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP,
|
|
Capabilities::WORKSPACE_SETTINGS_VIEW,
|
|
Capabilities::ALERTS_VIEW,
|
|
Capabilities::WORKSPACE_BASELINES_VIEW,
|
|
],
|
|
|
|
WorkspaceRole::Readonly->value => [
|
|
Capabilities::WORKSPACE_VIEW,
|
|
Capabilities::WORKSPACE_SETTINGS_VIEW,
|
|
Capabilities::ALERTS_VIEW,
|
|
Capabilities::WORKSPACE_BASELINES_VIEW,
|
|
],
|
|
];
|
|
|
|
/**
|
|
* @return array<string>
|
|
*/
|
|
public static function getCapabilities(WorkspaceRole|string $role): array
|
|
{
|
|
$roleValue = $role instanceof WorkspaceRole ? $role->value : $role;
|
|
|
|
return self::$roleCapabilities[$roleValue] ?? [];
|
|
}
|
|
|
|
/**
|
|
* @return array<string>
|
|
*/
|
|
public static function rolesWithCapability(string $capability): array
|
|
{
|
|
$roles = [];
|
|
|
|
foreach (self::$roleCapabilities as $role => $capabilities) {
|
|
if (in_array($capability, $capabilities, true)) {
|
|
$roles[] = $role;
|
|
}
|
|
}
|
|
|
|
return $roles;
|
|
}
|
|
|
|
public static function hasCapability(WorkspaceRole|string $role, string $capability): bool
|
|
{
|
|
return in_array($capability, self::getCapabilities($role), true);
|
|
}
|
|
}
|