ge-aerospace/shopdb-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bump plugin contract to 0.32.0 and register new plugin tables

Browse Source 
Exports caller_is_role on the plugin authorization surface. Additive name, so a minor bump. Scoped personal tokens are always refused by it, matching require_role, which stops a plugin from accidentally letting a scoped token inherit role authority from its owner.

Registers the tables added by the endpoint lock and policy hold work (endpointlocks, policyactionholds) plus the endpoint health tables in the alembic template, so plugin migrations see them and the ownership guard does not report them as unclaimed.
This commit is contained in:
benjamin.baker
2026-09-07 12:40:12 -04:00
parent 0d5b9730e3
commit 4c1d96b6ba
6 changed files with 36 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
tests/test_plugin_migrations.py
View File

@@ -48,8 +48,10 @@ EXPECTED_HEAD_REVISION = {plugin: f'{plugin}0001anchor' for plugin in CUTOVER_PL
EXPECTED_HEAD_REVISION['measuringtools'] = 'measuringtools0001baseline'
# computers adds the Entra/Azure device identity columns (azuredeviceid, then
# azureobjectid + azuredevicecategory), then the Configuration/Business policy
# tables, on top of its anchor, so its head is not the f-string default.
EXPECTED_HEAD_REVISION['computers'] = 'computers0004policies'
# tables, then the break-glass policyactionholds table, on top of its anchor, so
# its head is not the f-string default. 0006 widens policyactionholds.expiresat
# to nullable, where null means an indefinite hold that never self-clears.
EXPECTED_HEAD_REVISION['computers'] = 'computers0006holdindefinite'
# backups is also post-cutover: its 0001 really creates backuprevisions, and
# 0002 adds lastseenat - when a config was last CONFIRMED unchanged, which dedup
# otherwise throws away.
@@ -106,7 +108,12 @@ EXPECTED_HEAD_REVISION['warranty'] = 'warranty0002proof'
# 0013 adds the inventory columns.
# 0014 adds endpointstates.diskhealthjson, and 0015 adds the system telemetry
# columns (boot info, reboot reasons, Defender health, NIC link state).
EXPECTED_HEAD_REVISION['endpoints'] = 'endpoints0016dellupdates'
# 0016 adds the Dell update tables.
# 0017 adds the health rollup: endpointhealthstates, endpointhealthtransitions
# and endpointmonitorimpacts.
# 0018 adds endpointlocks: the admin quarantine refusing actions from non-admins
# on one endpoint, a caller-authority axis separate from the policy hold.
EXPECTED_HEAD_REVISION['endpoints'] = 'endpoints0018endpointlocks'
# Plugins built after the cutover: their 0001 baseline really creates tables the
# core chain never owned.