Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and update_app), agentless adoption tool and command-queue hardening, with his authorship preserved. Reviewed before promotion. Fixed: the endpoints plugin tests were never collected by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not truncate two columns strict MySQL would reject, and update_app's version branch pinned a digest for a file that route never serves. Agent packaging moved off require_role('admin') onto a new endpoints.agentpackage permission. Contract 0.27.0. Full suite 2231, frontend 314.
2026-08-30 19:41:15 -04:00
parent 8f4fe74dcb
commit 6680c3c5de
59 changed files with 5557 additions and 68 deletions
--- a/plugins/endpoints/frontend/views/AgentKeySettings.vue
+++ b/plugins/endpoints/frontend/views/AgentKeySettings.vue
@@ -14,6 +14,16 @@
         ================================================================= -->
    <section class="settings-section">
      <h3>Key management</h3>
+      <p class="key-warning">
+        STORE YOUR KEY SECURELY. IT IS SHOWN ONLY ONCE AND CANNOT BE RECOVERED.
+      </p>
+      <p class="field-hint">
+        Before you generate a key, open the <strong>ShopDB Secure Send</strong>
+        tool in a second window. As soon as the key appears, paste it into
+        Secure Send, generate a secure link, and send that link to yourself in
+        Teams so the site leader has a one-time, self-destructing backup. Never
+        paste the raw key into a chat message or a plain file.
+      </p>
      <p class="field-hint">
        The endpoint agent reports with a single managed key scoped to endpoint
        telemetry only. It is separate from every other collector, so rotating
@@ -75,8 +85,19 @@
      <div v-if="secret" class="card form-card secret-card">
        <h4>Save this key now</h4>
        <p class="field-hint">
-          It will not be shown again. Configure it as the agent
-          <code>X-API-Key</code> header value.
+          Anyone with this key can report as an endpoint agent for this site.
+          Treat it like a password. If it is lost you must regenerate, which
+          revokes the old key and forces every agent to be reconfigured.
+        </p>
+        <p class="field-hint">
+          <strong>Recommended:</strong> before you leave this page, open the
+          <strong>ShopDB Secure Send</strong> tool in a second window, paste
+          this key, generate a secure link, and send that link to yourself in
+          Teams. That gives the site leader a one-time, self-destructing copy to
+          fall back on instead of pasting the raw key into a chat or a file.
+        </p>
+        <p class="field-hint">
+          Configure it as the agent <code>X-API-Key</code> header value.
        </p>
        <p class="mono secret-value">{{ secret }}</p>
        <button class="btn btn-secondary" @click="copySecret">
@@ -138,6 +159,57 @@
      </div>
    </section>

+    <!-- ====================================================================
+         Adoption tool (spike)
+         ================================================================= -->
+    <section class="settings-section">
+      <h3>Adoption tool</h3>
+      <div class="card form-card">
+        <p class="field-hint">
+          Generate a one-shot, agentless enrollment tool. Run it once on a PC and
+          it creates a ShopDB PC and Endpoint entry using only the collector key -
+          no service, no polling, no ongoing telemetry. Use this for machines you
+          want inventoried without running the full endpoint agent.
+        </p>
+        <p class="field-hint">
+          Paste a collector key below (generate one above first; the secret is
+          only shown once). The key is embedded in the downloaded config and is
+          not stored on the server.
+        </p>
+
+        <label class="field-label" for="adopt-baseurl">Server base URL</label>
+        <input
+          id="adopt-baseurl"
+          v-model="adoptbaseurl"
+          class="form-control"
+          type="text"
+          placeholder="https://shopdb.example"
+        />
+
+        <label class="field-label" for="adopt-key">Collector key</label>
+        <input
+          id="adopt-key"
+          v-model="adoptcollectorkey"
+          class="form-control mono"
+          type="text"
+          placeholder="Paste the endpoint agent key"
+        />
+
+        <div class="button-row">
+          <button
+            class="btn btn-primary"
+            type="button"
+            :disabled="adoptbusy || !adoptbaseurl || !adoptcollectorkey"
+            @click="downloadAdoptionTool"
+          >
+            {{ adoptbusy ? 'Building...' : 'Download adoption tool' }}
+          </button>
+        </div>
+        <p v-if="adoptmessage" class="field-hint">{{ adoptmessage }}</p>
+        <p v-if="adopterror" class="field-error">{{ adopterror }}</p>
+      </div>
+    </section>
+
    <!-- ====================================================================
         Build site agent (placeholder)
         ================================================================= -->
@@ -145,18 +217,92 @@
      <h3>Build site agent</h3>
      <div class="card form-card">
        <p class="field-hint">
-          Produce an instance-locked agent executable stamped with this server's
+          Produce an instance-locked agent package stamped with this server's
          URL, the endpoint agent key, and the reporting cadence, so it deploys
-          with no manual configuration on the client.
+          with no manual configuration on the client. The download includes the
+          agent, a non-secret <code>appsettings.json</code>, and an
+          <code>install.ps1</code> that writes the credentials to the registry
+          (<code>HKLM\SOFTWARE\GE\ShopDB</code>) - the key never lands in
+          appsettings.
        </p>
+        <p v-if="!agentstaged" class="field-hint">
+          <strong>No agent binary is staged on this server.</strong> The package
+          will still build with config and installer, but you must drop
+          <code>shopdbagent.exe</code> beside them before deploying. Stage a
+          prebuilt agent under <code>instance/siteagent/</code> to have it ship
+          in the download.
+        </p>
+
+        <label class="field-label" for="agent-baseurl">Server base URL</label>
+        <input
+          id="agent-baseurl"
+          v-model="agentbaseurl"
+          class="form-control"
+          type="text"
+          placeholder="https://shopdb.example"
+        />
+
+        <label class="field-label" for="agent-key">Endpoint agent key</label>
+        <input
+          id="agent-key"
+          v-model="agentcollectorkey"
+          class="form-control mono"
+          type="text"
+          placeholder="Paste the endpoint agent key generated above"
+        />
+
+        <label class="field-label" for="agent-cadence">
+          Reporting cadence (seconds)
+        </label>
+        <input
+          id="agent-cadence"
+          v-model.number="agentcadenceseconds"
+          class="form-control"
+          type="number"
+          min="60"
+        />
+
+        <label v-if="certavailable" class="checkbox-row">
+          <input v-model="agentbundlecert" type="checkbox" />
+          <span>
+            Bundle this server's TLS certificate and trust it on the endpoint.
+            Enable only for self-signed or internal-CA servers; leave off when
+            the server uses a publicly trusted certificate.
+          </span>
+        </label>
+
+        <label class="field-label" for="agent-cert">
+          Server TLS certificate (optional)
+        </label>
+        <input
+          id="agent-cert"
+          ref="agentcertinput"
+          class="form-control"
+          type="file"
+          accept=".crt,.pem,.cer"
+          @change="onAgentCertChange"
+        />
        <p class="field-hint">
-          <strong>Coming soon.</strong> The build pipeline is not wired up yet -
-          the C# agent runtime is still under development. Generate a key above
-          and configure it manually as the agent <code>X-API-Key</code> for now.
+          For a reverse-proxy or internal-CA server this app cannot see, upload
+          the server's public certificate (or issuing CA) in PEM format. It is
+          validated, bundled with the package, and imported into the endpoint's
+          Trusted Root store by <code>install.ps1</code>. Leave empty when the
+          server uses a publicly trusted certificate. An upload takes precedence
+          over the bundled server certificate above.
        </p>
-        <button class="btn btn-secondary" type="button" disabled>
-          Build agent (coming soon)
-        </button>
+
+        <div class="button-row">
+          <button
+            class="btn btn-primary"
+            type="button"
+            :disabled="agentbusy || !agentbaseurl || !agentcollectorkey"
+            @click="buildSiteAgent"
+          >
+            {{ agentbusy ? 'Building...' : 'Build site agent' }}
+          </button>
+        </div>
+        <p v-if="agentmessage" class="field-hint">{{ agentmessage }}</p>
+        <p v-if="agenterror" class="field-error">{{ agenterror }}</p>
      </div>
    </section>

@@ -197,6 +343,26 @@ const copied = ref(false)
 const message = ref('')
 const error = ref('')

+// Adoption tool (spike): build a one-shot, agentless enrollment download.
+const adoptbaseurl = ref('')
+const adoptcollectorkey = ref('')
+const adoptbusy = ref(false)
+const adoptmessage = ref('')
+const adopterror = ref('')
+
+// Site agent generator: build an instance-locked, resident endpoint agent.
+const agentbaseurl = ref('')
+const agentcollectorkey = ref('')
+const agentcadenceseconds = ref(900)
+const agentstaged = ref(false)
+const certavailable = ref(false)
+const agentbundlecert = ref(false)
+const agentcertinput = ref(null)
+const agentcertfile = ref(null)
+const agentbusy = ref(false)
+const agentmessage = ref('')
+const agenterror = ref('')
+
 function formatDate(value) {
  if (!value) return ''
  const parsed = new Date(value)
@@ -209,6 +375,8 @@ function applyStatus(data) {
 }

 onMounted(async () => {
+  adoptbaseurl.value = window.location.origin
+  agentbaseurl.value = window.location.origin
  try {
    const response = await api.get('/endpoints/agentkey')
    applyStatus(response.data.data || {})
@@ -220,6 +388,15 @@ onMounted(async () => {
  } finally {
    loading.value = false
  }
+  try {
+    const response = await api.get('/endpoints/siteagent')
+    const status = response.data.data || {}
+    agentstaged.value = !!status.agentstaged
+    certavailable.value = !!status.certavailable
+    agentbundlecert.value = !!status.certavailable
+  } catch (statusError) {
+    console.error(statusError)
+  }
 })

 async function regenerate() {
@@ -238,6 +415,10 @@ async function regenerate() {
    const data = response.data.data || {}
    applyStatus(data)
    secret.value = data.secret || ''
+    if (data.secret) {
+      adoptcollectorkey.value = data.secret
+      agentcollectorkey.value = data.secret
+    }
    message.value = 'Endpoint agent key generated.'
  } catch (regenError) {
    error.value = regenError.response?.data?.data?.error?.message
@@ -276,6 +457,89 @@ async function copySecret() {
    console.error(copyError)
  }
 }
+
+async function downloadAdoptionTool() {
+  adoptbusy.value = true
+  adoptmessage.value = ''
+  adopterror.value = ''
+  try {
+    const response = await api.post(
+      '/endpoints/adoptiontool/package',
+      { baseurl: adoptbaseurl.value, collectorkey: adoptcollectorkey.value },
+      { responseType: 'blob' })
+    const url = window.URL.createObjectURL(response.data)
+    const link = document.createElement('a')
+    link.href = url
+    link.download = 'shopdb-adoption-tool.zip'
+    document.body.appendChild(link)
+    link.click()
+    link.remove()
+    window.URL.revokeObjectURL(url)
+    adoptmessage.value = 'Adoption tool downloaded.'
+  } catch (downloadError) {
+    adopterror.value = downloadError.response?.status === 403
+      ? 'Only an administrator can build the adoption tool'
+      : 'Could not build the adoption tool'
+    console.error(downloadError)
+  } finally {
+    adoptbusy.value = false
+  }
+}
+
+function onAgentCertChange(event) {
+  const files = event.target.files
+  agentcertfile.value = files && files.length ? files[0] : null
+}
+
+async function readBlobError(blob) {
+  try {
+    const parsed = JSON.parse(await blob.text())
+    return parsed.data?.error?.message || parsed.message
+      || 'Could not build the site agent'
+  } catch (parseError) {
+    return 'Could not build the site agent'
+  }
+}
+
+async function buildSiteAgent() {
+  agentbusy.value = true
+  agentmessage.value = ''
+  agenterror.value = ''
+  try {
+    const form = new FormData()
+    form.append('baseurl', agentbaseurl.value)
+    form.append('collectorkey', agentcollectorkey.value)
+    form.append('cadenceseconds', agentcadenceseconds.value)
+    form.append('bundlecert', agentbundlecert.value ? 'true' : 'false')
+    if (agentcertfile.value) {
+      form.append('certfile', agentcertfile.value)
+    }
+    const response = await api.post(
+      '/endpoints/siteagent/package',
+      form,
+      { responseType: 'blob' })
+    const url = window.URL.createObjectURL(response.data)
+    const link = document.createElement('a')
+    link.href = url
+    link.download = 'shopdb-endpoint-agent.zip'
+    document.body.appendChild(link)
+    link.click()
+    link.remove()
+    window.URL.revokeObjectURL(url)
+    agentmessage.value = 'Site agent built.'
+  } catch (buildError) {
+    if (buildError.response?.status === 400 && buildError.response?.data) {
+      agenterror.value = await readBlobError(buildError.response.data)
+    } else {
+      agenterror.value = buildError.response?.status === 403
+        ? 'Only an administrator can build the site agent'
+        : 'Could not build the site agent'
+    }
+    console.error(buildError)
+  } finally {
+    agentbusy.value = false
+  }
+}
 </script>

 <style scoped>
@@ -284,7 +548,27 @@ async function copySecret() {
 .form-card h4 { margin-top: 1rem; margin-bottom: 0.25rem; }
 .form-card h4:first-child { margin-top: 0; }
 .button-row { display: flex; gap: 0.5rem; }
+.checkbox-row {
+  display: flex;
+  gap: 0.5rem;
+  align-items: flex-start;
+  margin: 0.75rem 0;
+  font-size: 0.9rem;
+}
+.checkbox-row input { margin-top: 0.2rem; }
 .secret-card { border: 1px solid var(--color-warning, #b8860b); }
+.key-warning {
+  margin: 0 0 0.75rem;
+  padding: 0.6rem 0.75rem;
+  border: 2px solid #ff0000;
+  border-radius: 4px;
+  background: rgba(255, 0, 0, 0.12);
+  color: #ff2d2d;
+  font-size: 1.25rem;
+  font-weight: 800;
+  letter-spacing: 0.02em;
+  text-align: center;
+}
 .secret-value { padding: 0.5rem; background: var(--color-surface-2, #1e1e1e); }
 .settings-section { margin-bottom: 2rem; }
 .settings-section > h3 { margin-bottom: 0.25rem; }