feat: add read-only System Info admin page with health checks and module inventory
New page at /admin/system-info with three tabs: - Overview: PHP version, SAPI, environment, 6 health checks (DB, schema, storage, RBAC baseline, admin role, scheduler heartbeat) - Modules: table of active modules with version, dependencies, permission count - Permissions: active/inactive counts and per-source breakdown Gated behind new system_info.view permission assigned to Admin role. No mutations — purely diagnostic/observability. Includes SystemHealthService, SystemInfoService, SystemHealthRepository with interface, DI registration, i18n keys (de+en), idempotent DB update script, and 17 new PHPUnit tests. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
263
lib/Service/System/SystemHealthService.php
Normal file
263
lib/Service/System/SystemHealthService.php
Normal file
@@ -0,0 +1,263 @@
|
||||
<?php
|
||||
|
||||
namespace MintyPHP\Service\System;
|
||||
|
||||
use MintyPHP\Repository\System\SystemHealthRepositoryInterface;
|
||||
use MintyPHP\Service\Access\PermissionService;
|
||||
|
||||
class SystemHealthService
|
||||
{
|
||||
private const REQUIRED_TABLES = [
|
||||
'users',
|
||||
'roles',
|
||||
'permissions',
|
||||
'user_roles',
|
||||
'role_permissions',
|
||||
'tenants',
|
||||
'departments',
|
||||
'settings',
|
||||
'scheduler_runtime_status',
|
||||
];
|
||||
|
||||
private const REQUIRED_PERMISSIONS = [
|
||||
PermissionService::USERS_VIEW,
|
||||
PermissionService::TENANTS_VIEW,
|
||||
PermissionService::DEPARTMENTS_VIEW,
|
||||
PermissionService::ROLES_VIEW,
|
||||
PermissionService::PERMISSIONS_VIEW,
|
||||
PermissionService::SETTINGS_VIEW,
|
||||
];
|
||||
|
||||
private const SCHEDULER_STALE_THRESHOLD_SECONDS = 300;
|
||||
|
||||
public function __construct(
|
||||
private readonly SystemHealthRepositoryInterface $repository
|
||||
) {
|
||||
}
|
||||
|
||||
/**
|
||||
* @return list<array{status: string, name: string, message: string}>
|
||||
*/
|
||||
public function runAll(): array
|
||||
{
|
||||
return [
|
||||
$this->checkDatabase(),
|
||||
$this->checkDatabaseSchema(),
|
||||
$this->checkStorageWriteability(),
|
||||
$this->checkRbacBaseline(),
|
||||
$this->checkAdminRoleAssignment(),
|
||||
$this->checkSchedulerHeartbeat(),
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array{status: string, name: string, message: string}
|
||||
*/
|
||||
public function checkDatabase(): array
|
||||
{
|
||||
try {
|
||||
$ok = $this->repository->checkDatabaseConnectivity();
|
||||
|
||||
return [
|
||||
'status' => $ok ? 'ok' : 'fail',
|
||||
'name' => 'Database connectivity',
|
||||
'message' => $ok ? 'connection established' : 'select 1 did not return expected value',
|
||||
];
|
||||
} catch (\Throwable $e) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'Database connectivity',
|
||||
'message' => 'check failed',
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array{status: string, name: string, message: string}
|
||||
*/
|
||||
public function checkDatabaseSchema(): array
|
||||
{
|
||||
try {
|
||||
$present = $this->repository->listPresentTables(self::REQUIRED_TABLES);
|
||||
sort($present, SORT_STRING);
|
||||
$missing = array_values(array_diff(self::REQUIRED_TABLES, $present));
|
||||
|
||||
if ($missing) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'Database schema',
|
||||
'message' => 'missing tables: ' . implode(', ', $missing),
|
||||
];
|
||||
}
|
||||
|
||||
return [
|
||||
'status' => 'ok',
|
||||
'name' => 'Database schema',
|
||||
'message' => sprintf('%d core tables present', count(self::REQUIRED_TABLES)),
|
||||
];
|
||||
} catch (\Throwable $e) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'Database schema',
|
||||
'message' => 'check failed',
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array{status: string, name: string, message: string}
|
||||
*/
|
||||
public function checkStorageWriteability(): array
|
||||
{
|
||||
try {
|
||||
$storagePath = defined('APP_STORAGE_PATH') && APP_STORAGE_PATH
|
||||
? rtrim((string) APP_STORAGE_PATH, '/')
|
||||
: rtrim(dirname(__DIR__, 3) . '/storage', '/');
|
||||
|
||||
if (!is_dir($storagePath)) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'Storage writeability',
|
||||
'message' => 'storage directory not found',
|
||||
];
|
||||
}
|
||||
if (!is_writable($storagePath)) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'Storage writeability',
|
||||
'message' => 'storage directory not writable',
|
||||
];
|
||||
}
|
||||
|
||||
$probeFile = $storagePath . '/.doctor-write-probe-' . uniqid('', true);
|
||||
$written = @file_put_contents($probeFile, 'ok');
|
||||
if ($written === false) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'Storage writeability',
|
||||
'message' => 'write probe failed',
|
||||
];
|
||||
}
|
||||
@unlink($probeFile);
|
||||
|
||||
return [
|
||||
'status' => 'ok',
|
||||
'name' => 'Storage writeability',
|
||||
'message' => 'storage path is writable',
|
||||
];
|
||||
} catch (\Throwable $e) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'Storage writeability',
|
||||
'message' => 'check failed',
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array{status: string, name: string, message: string}
|
||||
*/
|
||||
public function checkRbacBaseline(): array
|
||||
{
|
||||
try {
|
||||
$present = $this->repository->listActivePermissionKeys(self::REQUIRED_PERMISSIONS);
|
||||
sort($present, SORT_STRING);
|
||||
$missing = array_values(array_diff(self::REQUIRED_PERMISSIONS, $present));
|
||||
|
||||
if ($missing) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'RBAC baseline',
|
||||
'message' => 'missing active permissions: ' . implode(', ', $missing),
|
||||
];
|
||||
}
|
||||
|
||||
return [
|
||||
'status' => 'ok',
|
||||
'name' => 'RBAC baseline',
|
||||
'message' => sprintf('%d baseline permissions active', count(self::REQUIRED_PERMISSIONS)),
|
||||
];
|
||||
} catch (\Throwable $e) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'RBAC baseline',
|
||||
'message' => 'check failed',
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array{status: string, name: string, message: string}
|
||||
*/
|
||||
public function checkAdminRoleAssignment(): array
|
||||
{
|
||||
try {
|
||||
$count = $this->repository->countAdminUsers();
|
||||
|
||||
if ($count <= 0) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'Admin role assignment',
|
||||
'message' => 'no active user assigned to Admin/Administrator role',
|
||||
];
|
||||
}
|
||||
|
||||
return [
|
||||
'status' => 'ok',
|
||||
'name' => 'Admin role assignment',
|
||||
'message' => sprintf('%d admin user(s) assigned', $count),
|
||||
];
|
||||
} catch (\Throwable $e) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'Admin role assignment',
|
||||
'message' => 'check failed',
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array{status: string, name: string, message: string}
|
||||
*/
|
||||
public function checkSchedulerHeartbeat(): array
|
||||
{
|
||||
try {
|
||||
$status = $this->repository->getSchedulerStatus();
|
||||
|
||||
if ($status === null) {
|
||||
return [
|
||||
'status' => 'warn',
|
||||
'name' => 'Scheduler heartbeat',
|
||||
'message' => 'no scheduler runtime status row found yet',
|
||||
];
|
||||
}
|
||||
|
||||
$heartbeat = $status['last_heartbeat_at'];
|
||||
$result = $status['last_result'];
|
||||
$errorCode = $status['last_error_code'];
|
||||
|
||||
if ($heartbeat === '') {
|
||||
return [
|
||||
'status' => 'warn',
|
||||
'name' => 'Scheduler heartbeat',
|
||||
'message' => 'scheduler heartbeat is empty',
|
||||
];
|
||||
}
|
||||
|
||||
$seconds = max(0, time() - strtotime($heartbeat . ' UTC'));
|
||||
$detail = "last heartbeat {$seconds}s ago (result={$result}" . ($errorCode !== '' ? ", error={$errorCode}" : '') . ')';
|
||||
|
||||
return [
|
||||
'status' => $seconds > self::SCHEDULER_STALE_THRESHOLD_SECONDS ? 'warn' : 'ok',
|
||||
'name' => 'Scheduler heartbeat',
|
||||
'message' => $detail,
|
||||
];
|
||||
} catch (\Throwable $e) {
|
||||
return [
|
||||
'status' => 'fail',
|
||||
'name' => 'Scheduler heartbeat',
|
||||
'message' => 'check failed',
|
||||
];
|
||||
}
|
||||
}
|
||||
}
|
||||
121
lib/Service/System/SystemInfoService.php
Normal file
121
lib/Service/System/SystemInfoService.php
Normal file
@@ -0,0 +1,121 @@
|
||||
<?php
|
||||
|
||||
namespace MintyPHP\Service\System;
|
||||
|
||||
use MintyPHP\App\Module\ModuleRegistry;
|
||||
use MintyPHP\Repository\System\SystemHealthRepositoryInterface;
|
||||
|
||||
class SystemInfoService
|
||||
{
|
||||
public function __construct(
|
||||
private readonly SystemHealthService $healthService,
|
||||
private readonly SystemHealthRepositoryInterface $healthRepository,
|
||||
private readonly ?ModuleRegistry $moduleRegistry = null
|
||||
) {
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array<string, mixed>
|
||||
*/
|
||||
public function buildPageData(): array
|
||||
{
|
||||
return [
|
||||
'overview' => $this->buildOverview(),
|
||||
'modules' => $this->buildModuleInventory(),
|
||||
'permissions' => $this->buildPermissionSummary(),
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array<string, mixed>
|
||||
*/
|
||||
private function buildOverview(): array
|
||||
{
|
||||
return [
|
||||
'php_version' => PHP_VERSION,
|
||||
'php_sapi' => PHP_SAPI,
|
||||
'app_environment' => $this->resolveEnvironment(),
|
||||
'health_checks' => $this->healthService->runAll(),
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* @return list<array{id: string, version: string, enabled_by_default: bool, requires: list<string>, permissions_count: int}>
|
||||
*/
|
||||
private function buildModuleInventory(): array
|
||||
{
|
||||
if ($this->moduleRegistry === null) {
|
||||
return [];
|
||||
}
|
||||
|
||||
$modules = [];
|
||||
foreach ($this->moduleRegistry->getModules() as $manifest) {
|
||||
$modules[] = [
|
||||
'id' => $manifest->id,
|
||||
'version' => $manifest->version,
|
||||
'enabled_by_default' => $manifest->enabledByDefault,
|
||||
'requires' => $manifest->requires,
|
||||
'permissions_count' => count($manifest->permissions),
|
||||
];
|
||||
}
|
||||
|
||||
usort($modules, static fn (array $a, array $b): int => strcmp($a['id'], $b['id']));
|
||||
|
||||
return $modules;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array{active_count: int, inactive_count: int, by_source: array<string, int>}
|
||||
*/
|
||||
private function buildPermissionSummary(): array
|
||||
{
|
||||
$activeKeys = $this->healthRepository->listAllActivePermissionKeys();
|
||||
$bySource = $this->derivePermissionsBySource($activeKeys);
|
||||
|
||||
return [
|
||||
'active_count' => $this->healthRepository->countActivePermissions(),
|
||||
'inactive_count' => $this->healthRepository->countInactivePermissions(),
|
||||
'by_source' => $bySource,
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param list<string> $activeKeys
|
||||
* @return array<string, int>
|
||||
*/
|
||||
private function derivePermissionsBySource(array $activeKeys): array
|
||||
{
|
||||
$moduleKeys = [];
|
||||
if ($this->moduleRegistry !== null) {
|
||||
foreach ($this->moduleRegistry->getModules() as $manifest) {
|
||||
foreach ($manifest->permissions as $perm) {
|
||||
$key = $perm['key'] ?? '';
|
||||
if ($key !== '') {
|
||||
$moduleKeys[$key] = $manifest->id;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$counts = [];
|
||||
foreach ($activeKeys as $key) {
|
||||
$source = $moduleKeys[$key] ?? 'core';
|
||||
$counts[$source] = ($counts[$source] ?? 0) + 1;
|
||||
}
|
||||
|
||||
ksort($counts);
|
||||
|
||||
return $counts;
|
||||
}
|
||||
|
||||
private function resolveEnvironment(): string
|
||||
{
|
||||
if (defined('APP_ENV')) {
|
||||
return (string) APP_ENV;
|
||||
}
|
||||
|
||||
$env = getenv('APP_ENV');
|
||||
|
||||
return is_string($env) && $env !== '' ? $env : 'unknown';
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user