ahmido
d6e7de597a
Implements Spec 087: Legacy Runs Removal (rigorous). ### What changed - Canonicalized run history: **`operation_runs` is the only run system** for inventory sync, Entra group sync, backup schedule execution/retention/purge. - Removed legacy UI surfaces (Filament Resources / relation managers) for legacy run models. - Legacy run URLs now return **404** (no redirects), with RBAC semantics preserved (404 vs 403 as specified). - Canonicalized affected `operation_runs.type` values (dotted → underscore) via migration. - Drift + inventory references now point to canonical operation runs; includes backfills and then drops legacy FK columns. - Drops legacy run tables after cutover. - Added regression guards to prevent reintroducing legacy run tokens or “backfilling” canonical runs from legacy tables. ### Migrations - `2026_02_12_000001..000006_*` canonicalize types, add/backfill operation_run_id references, drop legacy columns, and drop legacy run tables. ### Tests Focused pack for this spec passed: - `tests/Feature/Guards/NoLegacyRunsTest.php` - `tests/Feature/Guards/NoLegacyRunBackfillTest.php` - `tests/Feature/Operations/LegacyRunRoutesNotFoundTest.php` - `tests/Feature/Monitoring/MonitoringOperationsTest.php` - `tests/Feature/Jobs/RunInventorySyncJobTest.php` ### Notes / impact - Destructive cleanup is handled via migrations (drops legacy tables) after code cutover; deploy should run migrations in the same release. Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #106
80 lines
3.3 KiB
PHP
80 lines
3.3 KiB
PHP
<?php
|
|
|
|
use App\Models\Finding;
|
|
use App\Models\Policy;
|
|
use App\Models\PolicyVersion;
|
|
use App\Services\Drift\DriftFindingGenerator;
|
|
|
|
test('drift generation is tenant isolated', function () {
|
|
[$userA, $tenantA] = createUserWithTenant(role: 'manager');
|
|
[$userB, $tenantB] = createUserWithTenant(role: 'manager');
|
|
|
|
$scopeKey = hash('sha256', 'scope-tenant');
|
|
|
|
$baselineA = createInventorySyncOperationRun($tenantA, [
|
|
'selection_hash' => $scopeKey,
|
|
'selection_payload' => ['policy_types' => ['settingsCatalogPolicy']],
|
|
'status' => 'success',
|
|
'finished_at' => now()->subDays(2),
|
|
]);
|
|
|
|
$currentA = createInventorySyncOperationRun($tenantA, [
|
|
'selection_hash' => $scopeKey,
|
|
'selection_payload' => ['policy_types' => ['settingsCatalogPolicy']],
|
|
'status' => 'success',
|
|
'finished_at' => now()->subDay(),
|
|
]);
|
|
|
|
$policyA = Policy::factory()->for($tenantA)->create([
|
|
'policy_type' => 'settingsCatalogPolicy',
|
|
]);
|
|
|
|
$baselineAssignments = [['target' => ['groupId' => 'group-a'], '@odata.type' => '#microsoft.graph.groupAssignmentTarget']];
|
|
$currentAssignments = [['target' => ['groupId' => 'group-b'], '@odata.type' => '#microsoft.graph.groupAssignmentTarget']];
|
|
|
|
PolicyVersion::factory()->for($tenantA)->for($policyA)->create([
|
|
'version_number' => 1,
|
|
'policy_type' => $policyA->policy_type,
|
|
'captured_at' => $baselineA->finished_at->copy()->subMinute(),
|
|
'assignments' => $baselineAssignments,
|
|
'assignments_hash' => hash('sha256', json_encode($baselineAssignments)),
|
|
]);
|
|
|
|
PolicyVersion::factory()->for($tenantA)->for($policyA)->create([
|
|
'version_number' => 2,
|
|
'policy_type' => $policyA->policy_type,
|
|
'captured_at' => $currentA->finished_at->copy()->subMinute(),
|
|
'assignments' => $currentAssignments,
|
|
'assignments_hash' => hash('sha256', json_encode($currentAssignments)),
|
|
]);
|
|
|
|
$policyB = Policy::factory()->for($tenantB)->create([
|
|
'policy_type' => 'settingsCatalogPolicy',
|
|
]);
|
|
|
|
$baselineAssignmentsB = [['target' => ['groupId' => 'group-x'], '@odata.type' => '#microsoft.graph.groupAssignmentTarget']];
|
|
$currentAssignmentsB = [['target' => ['groupId' => 'group-y'], '@odata.type' => '#microsoft.graph.groupAssignmentTarget']];
|
|
|
|
PolicyVersion::factory()->for($tenantB)->for($policyB)->create([
|
|
'version_number' => 1,
|
|
'policy_type' => $policyB->policy_type,
|
|
'captured_at' => now()->subDays(2)->subMinute(),
|
|
'assignments' => $baselineAssignmentsB,
|
|
'assignments_hash' => hash('sha256', json_encode($baselineAssignmentsB)),
|
|
]);
|
|
|
|
PolicyVersion::factory()->for($tenantB)->for($policyB)->create([
|
|
'version_number' => 2,
|
|
'policy_type' => $policyB->policy_type,
|
|
'captured_at' => now()->subDay()->subMinute(),
|
|
'assignments' => $currentAssignmentsB,
|
|
'assignments_hash' => hash('sha256', json_encode($currentAssignmentsB)),
|
|
]);
|
|
|
|
$generator = app(DriftFindingGenerator::class);
|
|
$generator->generate($tenantA, $baselineA, $currentA, $scopeKey);
|
|
|
|
expect(Finding::query()->where('tenant_id', $tenantA->getKey())->count())->toBe(1);
|
|
expect(Finding::query()->where('tenant_id', $tenantB->getKey())->count())->toBe(0);
|
|
});
|