TenantAtlas/app/Support/OpsUx/SummaryCountsNormalizer.php
ahmido 6a15fe978a feat: Spec 105 — Entra Admin Roles Evidence + Findings (#128)
## Summary

Automated scanning of Entra ID directory roles to surface high-privilege role assignments as trackable findings with alerting support.

## What's included

### Core Services
- **EntraAdminRolesReportService** — Fetches role definitions + assignments via Graph API, builds payload with fingerprint deduplication
- **EntraAdminRolesFindingGenerator** — Creates/resolves/reopens findings based on high-privilege role catalog
- **HighPrivilegeRoleCatalog** — Curated list of high-privilege Entra roles (Global Admin, Privileged Auth Admin, etc.)
- **ScanEntraAdminRolesJob** — Queued job orchestrating scan → report → findings → alerts pipeline

### UI
- **AdminRolesSummaryWidget** — Tenant dashboard card showing last scan time, high-privilege assignment count, scan trigger button
- RBAC-gated: `ENTRA_ROLES_VIEW` for viewing, `ENTRA_ROLES_MANAGE` for scan trigger

### Infrastructure
- Graph contracts for `entraRoleDefinitions` + `entraRoleAssignments`
- `config/entra_permissions.php` — Entra permission registry
- `StoredReport.fingerprint` migration (deduplication support)
- `OperationCatalog` label + duration for `entra.admin_roles.scan`
- Artisan command `entra:scan-admin-roles` for CLI/scheduled use

### Global UX improvement
- **SummaryCountsNormalizer**: Zero values filtered, snake_case keys humanized (e.g. `report_deduped: 1` → `Report deduped: 1`). Affects all operation notifications.

## Test Coverage
- **12 test files**, **79+ tests**, **307+ assertions**
- Report service, finding generator, job orchestration, widget rendering, alert integration, RBAC enforcement, badge mapping

## Spec artifacts
- `specs/105-entra-admin-roles-evidence-findings/tasks.md` — Full task breakdown (38 tasks, all complete)
- `specs/105-entra-admin-roles-evidence-findings/checklists/requirements.md` — All items checked

## Files changed
46 files changed, 3641 insertions(+), 15 deletions(-)

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #128
2026-02-22 02:37:36 +00:00

82 lines
1.8 KiB
PHP

<?php
declare(strict_types=1);
namespace App\Support\OpsUx;
final class SummaryCountsNormalizer
{
/**
* @param array<string, mixed> $summaryCounts
* @return array<string, int>
*/
public static function normalize(array $summaryCounts): array
{
$allowedKeys = array_flip(OperationSummaryKeys::all());
$sanitized = [];
foreach ($summaryCounts as $key => $value) {
$key = trim((string) $key);
if ($key === '' || ! isset($allowedKeys[$key])) {
continue;
}
if (is_int($value)) {
$sanitized[$key] = $value;
continue;
}
if (is_float($value) && is_finite($value)) {
$sanitized[$key] = (int) round($value);
continue;
}
if (is_numeric($value)) {
$sanitized[$key] = (int) $value;
}
}
return $sanitized;
}
/**
* @param array<string, mixed> $summaryCounts
*/
public static function renderSummaryLine(array $summaryCounts): ?string
{
$normalized = self::normalize($summaryCounts);
if ($normalized === []) {
return null;
}
$parts = [];
foreach ($normalized as $key => $value) {
if ($value === 0) {
continue;
}
$parts[] = self::humanizeKey($key).': '.$value;
}
if ($parts === []) {
return null;
}
return implode(' · ', $parts);
}
/**
* Convert a snake_case summary key to a human-readable label.
*/
private static function humanizeKey(string $key): string
{
return ucfirst(str_replace('_', ' ', $key));
}
}