- GlitchTip über die Sentry-SDKs; Datenschutzfilter (nur User-ID, keine
Request-Bodys, Tokens aus URL/Query/Referer, E-Mails aus Meldungen).
Browser-SDK erst beim ersten Fehler nachgeladen.
- ReportErrorSignals: tote interne Links (404 mit eigenem Referrer), 403/429
für Angemeldete, 419 als gedrosselte Warnung.
- /health (Bearer-Token): DB, Cache, Queue-Rückstau, Scheduler-Herzschlag,
Plattenplatz → 200/503; Scheduler und Plattenplatz auch im Systemstatus.
- OperationalAlert zusätzlich per ntfy (JSON-POST), unabhängig von der Mail.
- Verlauf: login_failed (Grund unbekannt/kein Passwort/falsch),
login_lockout, two_factor_failed; IP nur als gekürzter HMAC.
- Umami: Kundenbereich mit eigenem Schalter und identify('user-<id>'),
nie im Admin/bei Impersonation; Query-Filter auch auf den Webseiten
(signierte Links gingen bisher an Umami).
- queue:prune-failed nach 30 Tagen.
- Versionsnummer: config('app.version') aus APP_VERSION oder Datei RELEASE
(git describe --tags), in GlitchTip, /health, Systemstatus, artisan about.
Plan: dev/betrieb/monitoring-plan.md (Entscheidungen M1–M9).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
126 lines
4.6 KiB
PHP
126 lines
4.6 KiB
PHP
<?php
|
|
|
|
use App\Enums\Portal;
|
|
use App\Models\PressRelease;
|
|
use App\Models\PressReleaseImage;
|
|
use App\Models\User;
|
|
use App\Services\Admin\AdminSystemHealth;
|
|
use Database\Seeders\RolesAndPermissionsSeeder;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Str;
|
|
use Spatie\Permission\Models\Permission;
|
|
use Spatie\Permission\PermissionRegistrar;
|
|
use Tests\TestCase;
|
|
|
|
beforeEach(function () {
|
|
$this->seed(RolesAndPermissionsSeeder::class);
|
|
// In der Testumgebung ist die Queue `sync`; für die Queue-Metriken den
|
|
// Produktions-Treiber (database) verwenden, der die jobs-Tabellen liest.
|
|
config()->set('queue.default', 'database');
|
|
});
|
|
|
|
test('editor cannot open the system health report', function () {
|
|
/** @var TestCase $this */
|
|
$editor = User::factory()->create(['is_active' => true]);
|
|
$editor->assignRole('editor');
|
|
$this->actingAs($editor);
|
|
|
|
$this->get('https://pressekonto.test/admin/reports/system-health')->assertForbidden();
|
|
});
|
|
|
|
test('admin can open the system health report', function () {
|
|
/** @var TestCase $this */
|
|
$admin = User::factory()->create(['is_active' => true]);
|
|
$admin->assignRole('admin');
|
|
$this->actingAs($admin);
|
|
|
|
$this->get('https://pressekonto.test/admin/reports/system-health')
|
|
->assertSuccessful()
|
|
->assertSee('Betriebsüberwachung')
|
|
->assertSee('Queue-Worker');
|
|
});
|
|
|
|
test('the system health report shows the deployed version', function () {
|
|
/** @var TestCase $this */
|
|
config()->set('app.version', 'v1.1.0');
|
|
$admin = User::factory()->create(['is_active' => true]);
|
|
$admin->assignRole('admin');
|
|
$this->actingAs($admin);
|
|
|
|
$this->get('https://pressekonto.test/admin/reports/system-health')
|
|
->assertSuccessful()
|
|
->assertSee('Version: v1.1.0');
|
|
});
|
|
|
|
test('snapshot reports an ok queue when there are no waiting jobs', function () {
|
|
/** @var TestCase $this */
|
|
$snapshot = app(AdminSystemHealth::class)->snapshot();
|
|
|
|
expect($snapshot['queue']['pending'])->toBe(0)
|
|
->and($snapshot['queue']['worker_running'])->toBeTrue()
|
|
->and($snapshot['queue']['status'])->toBe('ok');
|
|
});
|
|
|
|
test('snapshot flags a stalled worker when a job has waited too long', function () {
|
|
/** @var TestCase $this */
|
|
DB::table('jobs')->insert([
|
|
'queue' => 'default',
|
|
'payload' => json_encode(['displayName' => 'App\\Jobs\\Example']),
|
|
'attempts' => 0,
|
|
'reserved_at' => null,
|
|
'available_at' => now()->subMinutes(10)->getTimestamp(),
|
|
'created_at' => now()->subMinutes(10)->getTimestamp(),
|
|
]);
|
|
|
|
$snapshot = app(AdminSystemHealth::class)->snapshot();
|
|
|
|
expect($snapshot['queue']['status'])->toBe('critical')
|
|
->and($snapshot['queue']['worker_running'])->toBeFalse()
|
|
->and($snapshot['overall'])->toBe('critical');
|
|
});
|
|
|
|
test('snapshot surfaces recent failed jobs', function () {
|
|
/** @var TestCase $this */
|
|
DB::table('failed_jobs')->insert([
|
|
'uuid' => (string) Str::uuid(),
|
|
'connection' => 'database',
|
|
'queue' => 'default',
|
|
'payload' => json_encode(['displayName' => 'App\\Jobs\\Broken']),
|
|
'exception' => "RuntimeException: boom\nStack trace...",
|
|
'failed_at' => now(),
|
|
]);
|
|
|
|
$snapshot = app(AdminSystemHealth::class)->snapshot();
|
|
|
|
expect($snapshot['queue']['failed_recent'])->toBe(1)
|
|
->and($snapshot['queue']['recent_failures'][0]['job'])->toBe('App\\Jobs\\Broken')
|
|
->and($snapshot['queue']['recent_failures'][0]['error'])->toContain('boom')
|
|
->and($snapshot['queue']['status'])->toBe('warn');
|
|
});
|
|
|
|
test('snapshot flags missing permissions as critical', function () {
|
|
/** @var TestCase $this */
|
|
Permission::query()->where('name', 'billing:manage')->delete();
|
|
app(PermissionRegistrar::class)->forgetCachedPermissions();
|
|
|
|
$checks = collect(app(AdminSystemHealth::class)->snapshot()['checks'])
|
|
->keyBy('key');
|
|
|
|
expect($checks['permissions']['status'])->toBe('critical')
|
|
->and($checks['permissions']['detail'])->toContain('billing:manage');
|
|
});
|
|
|
|
test('snapshot flags pending media privatization', function () {
|
|
/** @var TestCase $this */
|
|
$pr = PressRelease::factory()->forPortal(Portal::Presseecho)->create();
|
|
PressReleaseImage::query()->create([
|
|
'press_release_id' => $pr->id,
|
|
'disk' => 'public',
|
|
'path' => 'press-releases/'.$pr->id.'/images/legacy.jpg',
|
|
]);
|
|
|
|
$checks = collect(app(AdminSystemHealth::class)->snapshot()['checks'])->keyBy('key');
|
|
|
|
expect($checks['media_privatization']['status'])->toBe('warn')
|
|
->and($checks['media_privatization']['detail'])->toContain('1');
|
|
});
|