Security hardening, multi-site portability, and a documentation and API-surface sweep

plugins/geenforce/migrations/versions/0003_report_subtype.py

@@ -19,10 +19,28 @@ branch_labels = None
 depends_on = None
 
 
+def _columns(bind):
+    insp = sa.inspect(bind)
+    if 'manifestenforcementreports' not in insp.get_table_names():
+        return None
+    return {c['name'] for c in insp.get_columns('manifestenforcementreports')}
+
+
 def upgrade():
+    # Guarded, like network0003prefix. On a FRESH database the table is built
+    # from the SQLAlchemy models, which already declare this column, so an
+    # unconditional add fails with "duplicate column name" - and this chain has
+    # been re-running its head on MySQL (see the missing commit in
+    # shopdb/plugins/alembic_template.py), so a redeploy hit the same wall.
+    columns = _columns(op.get_bind())
+    if columns is None or 'subtype' in columns:
+        return
     op.add_column('manifestenforcementreports',
                   sa.Column('subtype', sa.String(length=50), nullable=True))
 
 
 def downgrade():
+    columns = _columns(op.get_bind())
+    if columns is None or 'subtype' not in columns:
+        return
     op.drop_column('manifestenforcementreports', 'subtype')

plugins/geenforce/migrations/versions/0004_scope_minlibversion.py

@@ -0,0 +1,49 @@
+"""A scope declares the client library it needs, separately from its own version.
+
+The publish gate exists to refuse a manifest the fleet's GE-Enforce library
+cannot read correctly. It was comparing reported library versions against
+`manifestversion` - the manifest's own 'Version' field, which for a share
+imported manifest happens to share the library's numbering but for a
+code-authored scope is whatever the author chose (seed_display_scope writes
+'2.0'). Every kiosk runs something newer than that, so the gate passed on the
+one scope most in need of it.
+
+`minlibversion` says the thing the gate actually wants to know. NULL means
+derive it from what the manifest uses, so existing scopes need no edit.
+
+Revision ID: geenforce0004minlib
+Revises: geenforce0003subtype
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = 'geenforce0004minlib'
+down_revision = 'geenforce0003subtype'
+branch_labels = None
+depends_on = None
+
+TABLE = 'manifestscopes'
+
+
+def _columns(bind):
+    insp = sa.inspect(bind)
+    if TABLE not in insp.get_table_names():
+        return None
+    return {c['name'] for c in insp.get_columns(TABLE)}
+
+
+def upgrade():
+    # Guarded like geenforce0003subtype and network0003prefix: on a fresh
+    # database the table is built from the models, which already declare this.
+    columns = _columns(op.get_bind())
+    if columns is None or 'minlibversion' in columns:
+        return
+    op.add_column(TABLE, sa.Column('minlibversion', sa.String(length=16),
+                                   nullable=True))
+
+
+def downgrade():
+    columns = _columns(op.get_bind())
+    if columns is None or 'minlibversion' not in columns:
+        return
+    op.drop_column(TABLE, 'minlibversion')