Security hardening, multi-site portability, and a documentation and API-surface sweep

plugins/geenforce/seed_display_scope.py

@@ -84,6 +84,20 @@ def _relaunch_window_targets_comment():
     return pairs
 
 
+def _site_base_url():
+    """This site's public base URL from settings, or '' when it is unset.
+
+    Wrapped because the script builders are also called with no application
+    context (the seed tests build the text and check it compiles), and a
+    settings lookup there raises rather than returning a default.
+    """
+    try:
+        from shopdb.api import Setting
+        return (Setting.get('site_base_url', '') or '').strip().rstrip('/')
+    except Exception:
+        return ''
+
+
 def build_dispatcher_script():
     """Return the inline dispatcher PowerShell as text.
 
@@ -96,6 +110,11 @@ def build_dispatcher_script():
         table_lines.append(f"    '{display_type}' = '{route}'")
     table_body = ';\n'.join(table_lines)
 
+    # Baked in at seed time because the emitted script runs on a kiosk with no
+    # route back to the database. Blank when the site has not set it, and the
+    # dispatcher refuses rather than guessing - see the comment on $KioskBaseUrl.
+    kiosk_base_url = _site_base_url()
+
     return f"""# Invoke-DisplayKioskDispatch.ps1 -- gea-shopfloor-display dispatcher.
 #
 # Reads C:\\Enrollment\\display-type.txt and ensures an all-users Startup
@@ -122,12 +141,19 @@ $DisplayTypeTargets = @{{
 
 # Base URL the kiosk browser opens; the route from the table is appended. Read
 # from HKLM (the value the GE-Enforce client is configured with) so it stays
-# site-agnostic; falls back to the West Jefferson shopdb host.
-$KioskBaseUrl = 'https://tsgwp00525.wjs.geaerospace.net/shopdb'
+# site-agnostic. The fallback is THIS site's site_base_url setting, baked in
+# when the scope was seeded - it used to be one particular plant's host, which
+# meant a kiosk anywhere else with no registry value quietly opened a server it
+# has no business reaching.
+$KioskBaseUrl = '{kiosk_base_url}'
 try {{
     $shopdbConfig = Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\GE\\ShopDB' -Name BaseUrl -ErrorAction Stop
     if ($shopdbConfig.BaseUrl) {{ $KioskBaseUrl = ([string]$shopdbConfig.BaseUrl).TrimEnd('/') }}
 }} catch {{}}
+if (-not $KioskBaseUrl) {{
+    Write-Host 'no ShopDB base URL: set HKLM:\\SOFTWARE\\GE\\ShopDB BaseUrl, or set site_base_url in Settings and re-publish the display scope.'
+    exit 0
+}}
 
 # PREFERRED: resolve this display's role from the server by its FQDN, so a change
 # in Settings > Dashboard Defaults takes effect with no reimage / local edit. The
@@ -136,7 +162,7 @@ try {{
 $path = $null
 $serial = ''
 try {{ $serial = ([string](Get-CimInstance -ClassName Win32_BIOS -ErrorAction Stop).SerialNumber).Trim() }} catch {{}}
-$fqdnDomain = 'device.geaerospace.net'
+$fqdnDomain = 'device.geaerospace.net'  # ADR-015-OK: GE Aerospace-wide domain, and only the DEFAULT of a documented setting every site can override.
 try {{
     $ddom = Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\GE\\ShopDB' -Name DisplayFqdnDomain -ErrorAction Stop
     if ($ddom.DisplayFqdnDomain) {{ $fqdnDomain = ([string]$ddom.DisplayFqdnDomain).Trim().Trim('.') }}
@@ -200,8 +226,15 @@ Get-ChildItem -LiteralPath $startup -Filter '*.lnk' -ErrorAction SilentlyContinu
             # -kiosk matches both '-kiosk' and '--kiosk'. Also catch any browser
             # shortcut pointing at a shopdb kiosk URL (incl. the dead
             # shopfloor-dashboard route + --app variants).
+            # The host comes from $KioskBaseUrl, not from a literal: this used
+            # to name one site's server, so at any other site a legacy shortcut
+            # pointing at that site's own ShopDB was not recognised and never
+            # cleaned up.
+            $kioskHost = ''
+            try {{ $kioskHost = ([uri]$KioskBaseUrl).Host }} catch {{}}
             $kioskArgs = ($existing.Arguments -match '(?i)-kiosk') -or `
-                         ($existing.Arguments -match '(?i)tsgwp00525|/shopdb/|shopfloor-dashboard')
+                         ($kioskHost -and $existing.Arguments -like "*$kioskHost*") -or `
+                         ($existing.Arguments -match '(?i)/shopdb/|shopfloor-dashboard')
             if ($isBrowser -and $kioskArgs) {{ $drop = $true }}
         }} catch {{}}
     }}