Make main the lean product a site receives
main was 16 days and 259 commits behind the line the product is actually built on, at contract 0.30.0 against 0.35.0, with no per-PC credential code at all. It was neither current nor curated - just stale. This brings it forward and, at the same time, makes it mean something: main is what a receiving site installs, and nothing else. WHAT IT CARRIES. Twelve plugins - backups, computers, endpoints, guides, knowledgebase, machines, network, notifications, printers, slides, tools, warranty - plus applications, which is manifest-less core and always ships. The only manifest dependency inside that set is endpoints on computers, and both are in it, so the closure is self-contained. WHAT IT DOES NOT. employees, geenforce, measuringtools, printedparts and usb stay on the site line. So do the Windows installer tree, the VM rehearsal helpers, the agent tooling config, one site's data loader, the internal audit and findings records, and the planner spreadsheet. 1,135 tracked files against 1,438. A REMOVAL THAT BREAKS THE APP IS NOT A REMOVAL, and two nearly shipped: deploy/site-profile-universal.json still named all seventeen plugins. It is the file docs/DEPLOY.md tells a site to provision from, so a fresh install would have failed at `flask plugin apply-profile` with PluginError - the first thing a receiving site does, broken by the branch meant to serve them. It now names the twelve that exist, and its comment says the two must agree. agent/ was never refreshed. Whoever populated this branch copied shopdb/, plugins/, frontend/ and tests/ from the site line and left the agent tree at its September state: 22 C# and PowerShell sources missing, including AgentCredentials, EnrollmentService, AgentHttpFactory and the fleet-alert client, plus one file the site line had deleted still present. The old tree is internally consistent, so it compiles, and nothing in CI builds it - every gate was green over a server that speaks enrollment and per-PC credentials to a bundled agent source that cannot. Resynced whole. DECISIONS THIS ENCODES, rather than defers: - The plugin-authoring lab builds printedparts, whose manifest depends on employees, so it could not stay. The lab remains on the site line and main ships no build-along tutorial. That is a real loss for an adopting developer and is recorded here rather than discovered later. - Recognition, Training and Recertification notifications are no longer seeded. Each splits one notification into a card per employee and renders a photo, which needs a plugin this branch does not bundle. Seeding them would offer an author a type that cannot resolve anybody. A site that installs employees gets them from that plugin's own seed. - Windows/IIS is documented as the legacy path throughout, and the README leads with Docker, because that is what a receiving site gets. The API description is regenerated for THIS branch - 347 paths and 483 operations, down from 415 and 573 - so the published contract describes what is here rather than what the site line serves. docs/CONFIG.md lost the two measuring-tool label keys the code no longer declares, which two lanes had decided opposite ways. Suite: 3124 passed, 6 skipped. Naming and style gates pass. The docs gates run rather than skip, and every index line count is derived from the file it names.
This commit is contained in:
cproudlock
202
plugins/computers/services/apppolicy.py
Normal file
202
plugins/computers/services/apppolicy.py
Normal file
@@ -0,0 +1,202 @@
|
||||
"""Generate a Configuration Policy from an Application's "Required on all PCs".
|
||||
|
||||
Ticking that box on an application should not merely flag it in the compliance
|
||||
report - it should actually enforce the app onto every PC. This module owns the
|
||||
one policy that represents that intent, so the applications API does not have to
|
||||
know how policies are shaped.
|
||||
|
||||
Ownership and the "untouched" rule
|
||||
----------------------------------
|
||||
A generated policy carries source=POLICY_SOURCE_AUTOAPP, which marks it as ours
|
||||
to manage. Unticking the box removes it - but ONLY while it still carries that
|
||||
source. If an admin edits the policy through the policy CRUD API it flips to
|
||||
'local', and from then on unticking leaves it alone and reports that it was
|
||||
kept. Deleting someone's customised enforcement rule because a checkbox changed
|
||||
on a different screen would be a genuinely destructive surprise, and the box is
|
||||
not a reliable signal that they wanted that.
|
||||
|
||||
Not attached to a Business Policy
|
||||
---------------------------------
|
||||
The generated policy is NOT added to any Business Policy. The resolver only
|
||||
applies Configuration Policies reached through an active Business Policy, so
|
||||
until an admin adds it to one, the generated policy installs nothing. The API
|
||||
response and the acknowledgement text say so rather than promising a fleet
|
||||
install that will not happen.
|
||||
|
||||
Scope
|
||||
-----
|
||||
Generated policies use the `allpcs` node, not `true`: "required on all PCs"
|
||||
means the PCs people work at, and pushing an installer to a server because it
|
||||
appeared in the app catalog is not what the checkbox says. See policyscope.py.
|
||||
"""
|
||||
|
||||
from shopdb.api import db
|
||||
|
||||
from ..models import (
|
||||
ConfigurationPolicy,
|
||||
ConfigurationPolicyAction,
|
||||
POLICY_SOURCE_AUTOAPP,
|
||||
POLICY_SOURCE_LOCAL,
|
||||
ACTION_MODE_DESIRED,
|
||||
)
|
||||
|
||||
# The action a generated policy carries. update_app is the allowlisted verb that
|
||||
# installs a pinned app package on an endpoint (plugins/endpoints/commands.py),
|
||||
# so it is what "this app is required here" reduces to in enforcement terms.
|
||||
REQUIRED_APP_ACTION = 'update_app'
|
||||
|
||||
# Name prefix for generated rows. ConfigurationPolicy.name is unique and NOT
|
||||
# NULL, so generated names must be deterministic (we have to find the row again)
|
||||
# and distinctive enough not to collide with a hand-authored policy.
|
||||
AUTO_POLICY_PREFIX = 'Required app:'
|
||||
|
||||
|
||||
def auto_policy_name(application):
|
||||
"""The deterministic policy name for an application."""
|
||||
return '{} {}'.format(AUTO_POLICY_PREFIX, application.appname)
|
||||
|
||||
|
||||
def _action_appid(action_row):
|
||||
"""The appid an action's params name, or None."""
|
||||
params = action_row.params
|
||||
if not isinstance(params, dict):
|
||||
return None
|
||||
try:
|
||||
return int(params.get('appid'))
|
||||
except (TypeError, ValueError):
|
||||
return None
|
||||
|
||||
|
||||
def policies_referencing_app(appid):
|
||||
"""Every ConfigurationPolicy with an action whose params name this appid.
|
||||
|
||||
Params are a JSON text column (MySQL 5.6 has no JSON type to query), so the
|
||||
match is done in Python over the actions that carry params at all.
|
||||
"""
|
||||
if appid is None:
|
||||
return []
|
||||
found = {}
|
||||
rows = (ConfigurationPolicyAction.query
|
||||
.filter(ConfigurationPolicyAction.params.isnot(None))
|
||||
.all())
|
||||
for action_row in rows:
|
||||
if _action_appid(action_row) == int(appid):
|
||||
policy = action_row.configurationpolicy
|
||||
if policy is not None:
|
||||
found[policy.configurationpolicyid] = policy
|
||||
return [found[key] for key in sorted(found)]
|
||||
|
||||
|
||||
def find_auto_policy(application):
|
||||
"""Return the policy generated for this app, whoever owns it now.
|
||||
|
||||
Keyed on the appid in the generated update_app action's params, not on the
|
||||
name: the name embeds appname, so renaming the application used to orphan
|
||||
its policy (the next untick could not find it, and a re-tick generated a
|
||||
second one). A policy counts as generated when it still carries the autoapp
|
||||
source or the generated name prefix, so a row flipped to 'local' by an edit
|
||||
is still found and callers can tell "customised" from "absent". The name
|
||||
lookup stays as a fallback for a row whose params were edited away.
|
||||
"""
|
||||
candidates = [
|
||||
policy for policy in policies_referencing_app(application.appid)
|
||||
if policy.source == POLICY_SOURCE_AUTOAPP
|
||||
or (policy.name or '').startswith(AUTO_POLICY_PREFIX)
|
||||
]
|
||||
if candidates:
|
||||
candidates.sort(key=lambda policy: (
|
||||
policy.source != POLICY_SOURCE_AUTOAPP,
|
||||
policy.configurationpolicyid))
|
||||
return candidates[0]
|
||||
return ConfigurationPolicy.query.filter_by(
|
||||
name=auto_policy_name(application)
|
||||
).first()
|
||||
|
||||
|
||||
def sync_required_app_policy(application):
|
||||
"""Create or remove the generated policy to match application.isrequired.
|
||||
|
||||
Returns a short status string for the API to surface to the user:
|
||||
'created' - a new policy now enforces this app
|
||||
'removed' - the generated policy was deleted
|
||||
'kept' - a customised policy was left in place deliberately
|
||||
'unchanged' - nothing needed doing
|
||||
"""
|
||||
existing = find_auto_policy(application)
|
||||
|
||||
if application.isrequired:
|
||||
if existing is not None:
|
||||
# Already enforced. Deliberately does NOT rewrite a customised row
|
||||
# back to our defaults; re-ticking a box should not silently revert
|
||||
# an admin's edits. A still-generated row does follow an app rename
|
||||
# so its name keeps describing what it installs.
|
||||
wanted = auto_policy_name(application)
|
||||
if (existing.source == POLICY_SOURCE_AUTOAPP
|
||||
and existing.name != wanted
|
||||
and ConfigurationPolicy.query.filter_by(name=wanted).first() is None):
|
||||
existing.name = wanted
|
||||
return 'unchanged'
|
||||
|
||||
policy = ConfigurationPolicy(
|
||||
name=auto_policy_name(application),
|
||||
description=(
|
||||
'Auto-generated from the "Required on all PCs" checkbox on '
|
||||
'application "{}". Editing this policy makes it yours: it will '
|
||||
'no longer be removed automatically when that box is '
|
||||
'unchecked.'.format(application.appname)
|
||||
),
|
||||
scopejson={'type': 'allpcs'},
|
||||
source=POLICY_SOURCE_AUTOAPP,
|
||||
)
|
||||
db.session.add(policy)
|
||||
db.session.flush()
|
||||
|
||||
db.session.add(ConfigurationPolicyAction(
|
||||
configurationpolicyid=policy.configurationpolicyid,
|
||||
action=REQUIRED_APP_ACTION,
|
||||
mode=ACTION_MODE_DESIRED,
|
||||
desiredstate={'installed': True},
|
||||
params={'appid': application.appid},
|
||||
))
|
||||
return 'created'
|
||||
|
||||
# Not required.
|
||||
if existing is None:
|
||||
return 'unchanged'
|
||||
if existing.source != POLICY_SOURCE_AUTOAPP:
|
||||
# Someone customised it. Theirs now - leave it and say so.
|
||||
return 'kept'
|
||||
|
||||
db.session.delete(existing)
|
||||
return 'removed'
|
||||
|
||||
|
||||
def disown_if_generated(policy):
|
||||
"""Flip a generated policy to 'local' because it is being hand-edited.
|
||||
|
||||
Called from the policy CRUD write paths. After this, the application
|
||||
checkbox no longer owns the row and will not delete it.
|
||||
"""
|
||||
if policy is not None and policy.source == POLICY_SOURCE_AUTOAPP:
|
||||
policy.source = POLICY_SOURCE_LOCAL
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
def deactivate_policies_for_app(appid):
|
||||
"""Deactivate every remaining policy whose actions name a deleted appid.
|
||||
|
||||
Called when an application is deleted, after the generated policy has been
|
||||
withdrawn. What is left is either the customised ('kept') generated policy
|
||||
or a hand-authored one; both would keep trying to install an application
|
||||
that no longer exists. They are deactivated rather than deleted - they are
|
||||
someone's work - and returned so the API can name them.
|
||||
"""
|
||||
deactivated = []
|
||||
for policy in policies_referencing_app(appid):
|
||||
if policy in db.session.deleted:
|
||||
continue
|
||||
if policy.isactive:
|
||||
policy.isactive = False
|
||||
deactivated.append(policy.name)
|
||||
return deactivated
|
||||
@@ -20,7 +20,7 @@ The result is an EffectivePolicy: a flat, resolved map of action name -> decisio
|
||||
and the allowlist need.
|
||||
"""
|
||||
|
||||
from .policyscope import evaluate_scope
|
||||
from .policyscope import SERVER_ICON, evaluate_scope
|
||||
|
||||
|
||||
class EffectiveAction:
|
||||
@@ -57,17 +57,39 @@ class EffectivePolicy:
|
||||
actions maps action name -> EffectiveAction (first-match-wins already
|
||||
applied). Convenience views expose the gate allowlist and desired-state set
|
||||
that enforcement and the endpoints seam consume.
|
||||
|
||||
heldactions are action names under an unexpired break-glass hold. They are
|
||||
withheld from desired_actions (reconciliation stops fighting the admin) but
|
||||
deliberately LEFT IN allowed_actions: a hold suspends drift correction, it
|
||||
does not revoke permission to run the action by hand.
|
||||
"""
|
||||
|
||||
def __init__(self, actions):
|
||||
def __init__(self, actions, heldactions=None):
|
||||
self.actions = actions
|
||||
self.heldactions = set(heldactions or ())
|
||||
|
||||
def allowed_actions(self):
|
||||
"""Set of action names permitted on this endpoint (gate + desired)."""
|
||||
return set(self.actions.keys())
|
||||
|
||||
def desired_actions(self):
|
||||
"""action name -> EffectiveAction for mode == 'desired' only."""
|
||||
"""action name -> EffectiveAction for mode == 'desired' only.
|
||||
|
||||
Held actions are excluded, so the reconciler does not re-enqueue the
|
||||
very change an admin just broke glass to make.
|
||||
"""
|
||||
return {name: eff for name, eff in self.actions.items()
|
||||
if eff.mode == 'desired' and name not in self.heldactions}
|
||||
|
||||
def holdable_actions(self):
|
||||
"""Desired-mode action names, INCLUDING ones already held.
|
||||
|
||||
Deliberately not desired_actions(): that view hides held actions, so
|
||||
building a "what can I hold" picker from it would drop an action the
|
||||
moment it was held and make the current state unreadable. Only
|
||||
desired-mode actions appear, because a hold suspends reconciliation and
|
||||
gate-mode actions have none to suspend.
|
||||
"""
|
||||
return {name: eff for name, eff in self.actions.items()
|
||||
if eff.mode == 'desired'}
|
||||
|
||||
@@ -78,15 +100,21 @@ class EffectivePolicy:
|
||||
def build_endpoint_context(computer):
|
||||
"""Resolve a Computer row into the context the scope evaluator needs.
|
||||
|
||||
Returns {'computertypeid': int|None, 'appids': set[int]}.
|
||||
Returns {'computertypeid': int|None, 'appids': set[int], 'isserver': bool}.
|
||||
"""
|
||||
appids = set()
|
||||
for link in getattr(computer, 'installedapps', None) or ():
|
||||
if getattr(link, 'isactive', True) and link.appid is not None:
|
||||
appids.add(link.appid)
|
||||
# Server designation rides on the computer type's icon slug; policyscope
|
||||
# owns that rule, we just resolve it for the endpoint. An unset type is not
|
||||
# a server.
|
||||
computertype = getattr(computer, 'computertype', None)
|
||||
isserver = getattr(computertype, 'icon', None) == SERVER_ICON
|
||||
return {
|
||||
'computertypeid': getattr(computer, 'computertypeid', None),
|
||||
'appids': appids,
|
||||
'isserver': isserver,
|
||||
}
|
||||
|
||||
|
||||
@@ -165,7 +193,35 @@ def effective_policy_for(assetid):
|
||||
return EffectivePolicy({})
|
||||
|
||||
business_policies = BusinessPolicy.query.filter_by(isactive=True).all()
|
||||
return build_effective_policy(computer, business_policies)
|
||||
effective = build_effective_policy(computer, business_policies)
|
||||
effective.heldactions = _held_actions_for(assetid)
|
||||
return effective
|
||||
|
||||
|
||||
def _held_actions_for(assetid):
|
||||
"""Action names under an unexpired break-glass hold for this endpoint.
|
||||
|
||||
Expiry is compared here, at resolve time, rather than swept by a background
|
||||
job. A sweeper that stalled would silently keep every hold it failed to
|
||||
clear alive, which is reconciliation disabled by accident - so the row's own
|
||||
expiresat is the single authority on whether it still applies.
|
||||
|
||||
A null expiresat is an INDEFINITE hold and is always active. It must be
|
||||
matched explicitly: a bare `expiresat > now` drops null rows, which would
|
||||
resume reconciliation of exactly the actions an admin pinned open-endedly -
|
||||
the reconciler restarting a service someone deliberately stopped.
|
||||
"""
|
||||
from datetime import datetime
|
||||
from sqlalchemy import or_
|
||||
from ..models import PolicyActionHold
|
||||
|
||||
rows = (PolicyActionHold.query
|
||||
.filter(PolicyActionHold.assetid == assetid,
|
||||
PolicyActionHold.isactive.is_(True),
|
||||
or_(PolicyActionHold.expiresat.is_(None),
|
||||
PolicyActionHold.expiresat > datetime.utcnow()))
|
||||
.all())
|
||||
return {row.action for row in rows}
|
||||
|
||||
|
||||
def _monitor_action_ids(effective):
|
||||
|
||||
@@ -11,7 +11,21 @@ Node grammar (all dict nodes carry a "type"):
|
||||
{"type": "not", "node": <node>}
|
||||
{"type": "pctype", "id": <computertypeid:int>}
|
||||
{"type": "app", "id": <appid:int>}
|
||||
{"type": "true"} # matches everything (an unscoped/global policy)
|
||||
{"type": "allpcs"} # every PC EXCEPT those whose type is designated a server
|
||||
{"type": "true"} # matches everything, servers included
|
||||
|
||||
"allpcs" vs "true": authoring an estate-wide policy almost always means "every
|
||||
PC an operator sits at", not "every computer we have a row for". Those differ by
|
||||
the servers, where a reboot or a script push is a materially different event.
|
||||
"true" is retained because a stored scope of None is equivalent to it and older
|
||||
policies were written with it, but the builder offers "All PCs" instead.
|
||||
|
||||
Server designation is read from the computer type's ICON slug ('server'). That
|
||||
field is nominally a UI hint, which is a real wart - it is load-bearing here. It
|
||||
was chosen over matching the type NAME because a site can rename "Server" but a
|
||||
renamed type keeps its icon, and over a new isserver column because that needs a
|
||||
migration this did not warrant. If server designation ever becomes a first-class
|
||||
flag, this is the single place that reads it.
|
||||
|
||||
Kept pure and dependency-free (no db, no Flask) so it is trivially unit-tested
|
||||
and so a future GE-Enforce assembly engine can reuse the exact same evaluator on
|
||||
@@ -22,8 +36,12 @@ the exact same AST when it composes policies.
|
||||
# recursion. Ten levels is far past any policy a human would author.
|
||||
MAX_SCOPE_DEPTH = 10
|
||||
|
||||
# The computer-type icon slug that designates a type as a server. See the module
|
||||
# docstring for why the icon carries this.
|
||||
SERVER_ICON = 'server'
|
||||
|
||||
_LOGICAL = {'and', 'or', 'not'}
|
||||
_LEAF = {'pctype', 'app', 'true'}
|
||||
_LEAF = {'pctype', 'app', 'true', 'allpcs'}
|
||||
|
||||
|
||||
class ScopeError(ValueError):
|
||||
@@ -60,7 +78,7 @@ def validate_scope(node, _depth=0):
|
||||
ident = node.get('id')
|
||||
if not isinstance(ident, int) or isinstance(ident, bool):
|
||||
raise ScopeError(f'{ntype} requires an integer "id"')
|
||||
# 'true' carries no payload.
|
||||
# 'true' and 'allpcs' carry no payload.
|
||||
|
||||
|
||||
def evaluate_scope(node, context):
|
||||
@@ -69,6 +87,7 @@ def evaluate_scope(node, context):
|
||||
context is expected to expose:
|
||||
context['computertypeid'] -> int or None
|
||||
context['appids'] -> set/collection of installed appids
|
||||
context['isserver'] -> bool, whether the type is server-designated
|
||||
|
||||
Returns True when the endpoint falls in scope. An empty/None scope means the
|
||||
policy is unscoped and matches everything (same as {"type": "true"}), which
|
||||
@@ -80,6 +99,10 @@ def evaluate_scope(node, context):
|
||||
ntype = node['type']
|
||||
if ntype == 'true':
|
||||
return True
|
||||
if ntype == 'allpcs':
|
||||
# Absent designation means "not a server": an endpoint with no type set
|
||||
# is an ordinary PC until something says otherwise.
|
||||
return not context.get('isserver', False)
|
||||
if ntype == 'and':
|
||||
return all(evaluate_scope(child, context) for child in node['nodes'])
|
||||
if ntype == 'or':
|
||||
|
||||
Reference in New Issue
Block a user