Security hardening, multi-site portability, and a documentation and API-surface sweep

plugins/geenforce/api/routes.py

@@ -352,6 +352,8 @@ def list_scopes():
             'scopename': scope.scopename,
             'phase': scope.phase,
             'manifestversion': scope.manifestversion,
+        'minlibversion': scope.minlibversion,
+            'minlibversion': scope.minlibversion,
             'computertypeid': scope.computertypeid,
             'measuringtooltypeid': scope.measuringtooltypeid,
             'iscommon': scope.iscommon,
@@ -462,6 +464,7 @@ def create_scope():
     scope = ManifestScope(
         scopename=scopename, phase=phase,
         manifestversion=str(payload.get('manifestversion', '1.0')),
+        minlibversion=(payload.get('minlibversion') or None),
         description=payload.get('description'),
         computertypeid=payload.get('computertypeid'),
         measuringtooltypeid=payload.get('measuringtooltypeid'),
@@ -496,6 +499,10 @@ def update_scope(scopeid):
             setattr(scope, field, payload[field])
     if 'manifestversion' in payload:
         scope.manifestversion = str(payload['manifestversion'])
+    if 'minlibversion' in payload:
+        # Blank clears it, which returns the scope to a derived floor rather
+        # than pinning it at the empty string.
+        scope.minlibversion = (payload['minlibversion'] or None)
     if 'iscommon' in payload:
         scope.iscommon = bool(payload['iscommon'])
     db.session.commit()
@@ -764,9 +771,9 @@ def publish_preflight(scopeid):
     if not scope:
         return error_response(ErrorCodes.NOT_FOUND, 'No such scope', http_code=404)
     hosts, floor = service.hosts_below_libversion(
-        scope.scopename, scope.phase, scope.manifestversion)
+        scope.scopename, scope.phase, service.required_libversion(scope))
     return success_response({
-        'required': scope.manifestversion,
+        'required': service.required_libversion(scope),
         'floor': floor,
         'hostsbehind': hosts,
         'canpublish': not hosts,