TenantAtlas/tests/Feature/RestoreGroupMappingTest.php

<?php

use App\Filament\Resources\RestoreRunResource\Pages\CreateRestoreRun;
use App\Models\BackupItem;
use App\Models\BackupSet;
use App\Models\Policy;
use App\Models\RestoreRun;
use App\Models\Tenant;
use App\Models\User;
use App\Services\Graph\GroupResolver;
use App\Support\RestoreSafety\RestoreScopeFingerprint;
use Filament\Facades\Filament;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Livewire\Livewire;
use Mockery\MockInterface;

uses(RefreshDatabase::class);

beforeEach(function () {
    putenv('INTUNE_TENANT_ID');
    unset($_ENV['INTUNE_TENANT_ID'], $_SERVER['INTUNE_TENANT_ID']);
});

test('restore wizard shows group mapping for unresolved groups', function () {
    $tenant = Tenant::create([
        'tenant_id' => 'tenant-1',
        'name' => 'Tenant One',
        'metadata' => [],
        'rbac_status' => 'ok',
        'rbac_last_checked_at' => now(),
    ]);

    $tenant->makeCurrent();

    $policy = Policy::create([
        'tenant_id' => $tenant->id,
        'external_id' => 'policy-1',
        'policy_type' => 'settingsCatalogPolicy',
        'display_name' => 'Settings Catalog',
        'platform' => 'windows',
    ]);

    $backupSet = BackupSet::create([
        'tenant_id' => $tenant->id,
        'name' => 'Backup',
        'status' => 'completed',
        'item_count' => 1,
    ]);

    $backupItem = BackupItem::create([
        'tenant_id' => $tenant->id,
        'backup_set_id' => $backupSet->id,
        'policy_id' => $policy->id,
        'policy_identifier' => $policy->external_id,
        'policy_type' => $policy->policy_type,
        'platform' => $policy->platform,
        'payload' => ['id' => $policy->external_id],
        'assignments' => [[
            'target' => [
                '@odata.type' => '#microsoft.graph.groupAssignmentTarget',
                'groupId' => 'source-group-1',
                'group_display_name' => 'Source Group',
            ],
            'intent' => 'apply',
        ]],
    ]);

    $this->mock(GroupResolver::class, function (MockInterface $mock) {
        $mock->shouldReceive('resolveGroupIds')
            ->andReturnUsing(function (array $groupIds): array {
                return collect($groupIds)
                    ->mapWithKeys(fn (string $id) => [$id => [
                        'id' => $id,
                        'displayName' => null,
                        'orphaned' => true,
                    ]])
                    ->all();
            });
    });

    $user = User::factory()->create();
    $this->actingAs($user);
    $user->tenants()->syncWithoutDetaching([
        $tenant->getKey() => ['role' => 'owner'],
    ]);

    Filament::setTenant($tenant, true);

    $component = Livewire::test(CreateRestoreRun::class)
        ->fillForm([
            'backup_set_id' => $backupSet->id,
        ])
        ->goToNextWizardStep()
        ->fillForm([
            'scope_mode' => 'selected',
            'backup_item_ids' => [$backupItem->id],
        ]);

    $mapping = $component->get('data.group_mapping');

    expect($mapping)->toBeArray();
    expect(array_key_exists('source-group-1', $mapping))->toBeTrue();
    expect($mapping['source-group-1'])->toBeNull();

    $component->assertFormFieldVisible('group_mapping.source-group-1');
});

test('restore wizard persists group mapping selections', function () {
    $tenant = Tenant::create([
        'tenant_id' => 'tenant-1',
        'name' => 'Tenant One',
        'metadata' => [],
        'rbac_status' => 'ok',
        'rbac_last_checked_at' => now(),
    ]);

    $tenant->makeCurrent();

    $policy = Policy::create([
        'tenant_id' => $tenant->id,
        'external_id' => 'policy-1',
        'policy_type' => 'settingsCatalogPolicy',
        'display_name' => 'Settings Catalog',
        'platform' => 'windows',
    ]);

    $backupSet = BackupSet::create([
        'tenant_id' => $tenant->id,
        'name' => 'Backup',
        'status' => 'completed',
        'item_count' => 1,
    ]);

    $backupItem = BackupItem::create([
        'tenant_id' => $tenant->id,
        'backup_set_id' => $backupSet->id,
        'policy_id' => $policy->id,
        'policy_identifier' => $policy->external_id,
        'policy_type' => $policy->policy_type,
        'platform' => $policy->platform,
        'payload' => ['id' => $policy->external_id],
        'assignments' => [[
            'target' => [
                '@odata.type' => '#microsoft.graph.groupAssignmentTarget',
                'groupId' => 'source-group-1',
                'group_display_name' => 'Source Group',
            ],
            'intent' => 'apply',
        ]],
    ]);

    $targetGroupId = fake()->uuid();

    $this->mock(GroupResolver::class, function (MockInterface $mock) {
        $mock->shouldReceive('resolveGroupIds')
            ->andReturnUsing(function (array $groupIds): array {
                return collect($groupIds)
                    ->mapWithKeys(function (string $id) {
                        $resolved = $id === $targetGroupId;

                        return [$id => [
                            'id' => $id,
                            'displayName' => $resolved ? 'Target Group' : null,
                            'orphaned' => ! $resolved,
                        ]];
                    })
                    ->all();
            });
    });

    $user = User::factory()->create();
    $this->actingAs($user);
    $user->tenants()->syncWithoutDetaching([
        $tenant->getKey() => ['role' => 'owner'],
    ]);

    Filament::setTenant($tenant, true);

    Livewire::test(CreateRestoreRun::class)
        ->fillForm([
            'backup_set_id' => $backupSet->id,
        ])
        ->goToNextWizardStep()
        ->fillForm([
            'scope_mode' => 'selected',
            'backup_item_ids' => [$backupItem->id],
            'group_mapping' => [
                'source-group-1' => $targetGroupId,
            ],
        ])
        ->goToNextWizardStep()
        ->goToNextWizardStep()
        ->callFormComponentAction('preview_diffs', 'run_restore_preview')
        ->goToNextWizardStep()
        ->call('create')
        ->assertHasNoFormErrors();

    $run = RestoreRun::first();

    expect($run)->not->toBeNull();
    expect($run->group_mapping)->toBe([
        'source-group-1' => $targetGroupId,
    ]);

    $this->assertDatabaseHas('audit_logs', [
        'tenant_id' => $tenant->id,
        'action' => 'restore.group_mapping.applied',
    ]);
});

test('restore wizard can fill a group mapping entry from directory cache picker', function () {
    $tenant = Tenant::create([
        'tenant_id' => 'tenant-1',
        'name' => 'Tenant One',
        'metadata' => [],
        'rbac_status' => 'ok',
        'rbac_last_checked_at' => now(),
    ]);

    $tenant->makeCurrent();

    $user = User::factory()->create();
    $this->actingAs($user);
    $user->tenants()->syncWithoutDetaching([
        $tenant->getKey() => ['role' => 'owner'],
    ]);

    Filament::setTenant($tenant, true);

    $sourceGroupId = fake()->uuid();
    $targetGroupId = fake()->uuid();
    $existingCheckSummary = [
        'blocking' => 0,
        'warning' => 0,
        'safe' => 1,
    ];
    $existingCheckResults = [[
        'code' => 'safe',
        'severity' => 'safe',
    ]];
    $oldGroupMapping = [
        $sourceGroupId => 'old',
    ];
    $oldScopeFingerprint = RestoreScopeFingerprint::fromInputs(
        backupSetId: 10,
        scopeMode: 'all',
        selectedItemIds: [],
        groupMapping: $oldGroupMapping,
    );

    $component = Livewire::test(CreateRestoreRun::class)
        ->set('data.backup_set_id', 10)
        ->set('data.scope_mode', 'all')
        ->set('data.group_mapping', $oldGroupMapping)
        ->set('data.check_summary', $existingCheckSummary)
        ->set('data.check_results', $existingCheckResults)
        ->set('data.check_basis', [
            'fingerprint' => $oldScopeFingerprint->fingerprint,
            'ran_at' => now('UTC')->toIso8601String(),
            'blocking_count' => 0,
            'warning_count' => 0,
            'result_codes' => ['safe'],
        ])
        ->call('applyEntraGroupCachePick', sourceGroupId: $sourceGroupId, entraId: $targetGroupId)
        ->assertSet("data.group_mapping.{$sourceGroupId}", $targetGroupId)
        ->assertSet('data.is_dry_run', true)
        ->assertSet('data.acknowledged_impact', false)
        ->assertSet('data.tenant_confirm', null);

    expect($component->get('data.check_summary'))->toBe($existingCheckSummary)
        ->and($component->get('data.check_results'))->toBe($existingCheckResults)
        ->and($component->get('data.check_invalidation_reasons'))->toContain('scope_mismatch');
});