Bring the collector script into the repo, with no site in it

Report-AssetToShopDB.ps1 lived on one site's imaging share and was, per the adoption guide, "provided on request" - which is not a distribution mechanism for a product meant to be adopted. It now lives in plugins/computers/client/, beside the collector contract it implements (ADR-006), so the two version together. Three things named West Jefferson and no longer do (ADR-015): - The server. It resolves from HKLM:\SOFTWARE\GE\ShopDB BaseUrl - the value Install-GEEnforce.ps1 already writes and the enforcement client cannot run without - or from -ApiUrl. With neither it logs and exits 0 rather than posting somewhere wrong. Any bay running this script runs the enforcement client, so the value is present wherever it is deployed. - The corporate VLANs. Two hardcoded CIDRs decided which NIC's address was reported, with a comment reading "update if site re-VLANs". A site may now name its ranges (-AllowedRanges, or a CollectorRanges registry value); with none configured the NIC carrying the DEFAULT ROUTE is used, which expresses "the routable NIC, not the controller NIC" without knowing any site's addressing. VERIFIED IN THE WINDOWS VM, not by reading it - and the VM earned its keep. The local array was called $allowedRanges, which is the SAME VARIABLE as the [string] parameter $AllowedRanges because PowerShell names are case-insensitive; the array was silently coerced to an empty string, and .Count on a scalar string is 1. The script therefore believed a range was configured, skipped the default-route fallback, and reported no IP at all. Linux pwsh parsed it happily. Renamed to $rangeList, and the four paths were then confirmed on Windows: no config skips cleanly, BaseUrl resolves from the registry, an unconfigured site picks the default-route NIC, a configured range selects or excludes as asked.
2026-08-18 09:59:51 -04:00
parent f34b9ca710
commit 96f127f8c8
2 changed files with 329 additions and 1 deletions
--- a/docs/ADOPTING-AT-ANOTHER-SITE.md
+++ b/docs/ADOPTING-AT-ANOTHER-SITE.md
@@ -22,7 +22,7 @@ at all yet.
 | Artifact | Where it is today |
 |---|---|
 | GE-Enforce client (`Install-GEEnforce.ps1`, `Invoke-ShopdbEnforce.ps1`, `ShopdbEnforceClient.psm1`) | This repository, `plugins/geenforce/client/`. Present on any installed server under the install directory. |
-| `Report-AssetToShopDB.ps1` | **Not in this repository.** It lives on the reference site's imaging share and is provided on request. It is planned to move to `plugins/computers/client/` so it versions with the collector contract it implements. |
+| `Report-AssetToShopDB.ps1` | `plugins/computers/client/`, so it versions with the collector contract it implements. It names no site: the server comes from `HKLM:\SOFTWARE\GE\ShopDB` `BaseUrl` (which Install-GEEnforce.ps1 writes) or `-ApiUrl`, and the NIC it reports is the one carrying the default route unless the site names its ranges via `-AllowedRanges` or the `CollectorRanges` registry value. |
 | EventSaver (`EventSaver.scr`, `EventSaver.ini`, `EventSaver.cs`) | **Not in this repository.** Provided on request; the source is a single C# file that builds with the in-box .NET Framework compiler, so a site can rebuild it rather than trust a binary. See [EVENTSAVER.md](EVENTSAVER.md). |

 Ask the maintainers for the two that are not here. A site that would rather not
--- a/plugins/computers/client/Report-AssetToShopDB.ps1
+++ b/plugins/computers/client/Report-AssetToShopDB.ps1
@@ -0,0 +1,328 @@
+# Report-AssetToShopDB.ps1
+#
+# Reports a PC's identity to ShopDB (Flask) so the computers/machines record
+# stays current with whatever the PC actually is right now: hostname, BIOS
+# serial, pc-type, logged-in user, DNC machine number (2001, 2002, ... when
+# present) and its corp/AESFMA IPv4 address.
+#
+# TARGET: the ADR-006 collector API.
+#     POST <shopdb>/api/collector/computers
+# The server is NOT baked in. It comes from HKLM:\SOFTWARE\GE\ShopDB BaseUrl,
+# which Install-GEEnforce.ps1 provisions and the enforcement client already
+# needs, or from -ApiUrl in the manifest entry's Args. ADR-015: a site name in
+# product code is a defect, and this script ships to every site.
+# The computers plugin's apply_collector_payload upserts idempotently by
+# hostname (create if missing, patch-style update if present - only the fields
+# posted here change, so it never clobbers model/VNC/WinRM). Machine number maps
+# to Asset.assetnumber; the placeholder 9999 is skipped server-side.
+#
+# AUTH: the collector API does NOT honor the GE-Enforce IP allowlist (that only
+# covers the geenforce fetch/report endpoints). It needs a collector.ingest key,
+# sent as the X-API-Key header. The key is read from HKLM:\SOFTWARE\GE\ShopDB
+# CollectorKey (same secret store the GE-Enforce client uses; provisioned at
+# imaging), or overridden via the manifest entry's Args -ApiKey. Never bake the
+# key into the manifest JSON on the share.
+#
+# Deployed in common\ (runs on EVERY shopfloor pc-type). Non-DNC bays report
+# identity with no machineNo, so no PC-to-machine link is built - by design.
+# Runs every GE-Enforce cycle as a Type=PS1 / DetectionMethod=Always entry under
+# the SYSTEM task. Always exits 0 so "last run result" stays clean; failures are
+# logged, never thrown.
+#
+# WHY ONE NIC ONLY:
+#   Some bays carry two NICs - a private controller NIC and the routable
+#   corporate NIC. Only the routable one belongs in ShopDB. A site may name its
+#   corporate ranges (-AllowedRanges, or the CollectorRanges registry value); with
+#   none configured the NIC carrying the DEFAULT ROUTE is used, which expresses
+#   the same intent without knowing any site's addressing.
+
+param(
+    # Flask collector endpoint for the computers plugin. Empty resolves from
+    # HKLM:\SOFTWARE\GE\ShopDB BaseUrl; override here if the path ever moves.
+    [string]$ApiUrl = '',
+
+    # Comma-separated CIDRs naming this site's routable ranges, e.g.
+    # '10.20.0.0/23,10.21.4.0/26'. Empty uses the default-route NIC instead.
+    [string]$AllowedRanges = '',
+
+    # collector.ingest key (X-API-Key). Default: read from the GE-Enforce secret
+    # store in the registry. Override with -ApiKey via Args for testing.
+    [string]$ApiKey = '',
+
+    [int]$TimeoutSec = 30
+)
+
+$ErrorActionPreference = 'Continue'
+
+# Force TLS 1.2 - older images default to SystemDefault which may negotiate a
+# protocol the site rejects; the collector POST is HTTPS.
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+$logDir = 'C:\Logs\Shopfloor'
+if (-not (Test-Path $logDir)) {
+    New-Item -ItemType Directory -Path $logDir -Force -ErrorAction SilentlyContinue | Out-Null
+}
+$logFile = Join-Path $logDir ('report-asset-{0}.log' -f (Get-Date -Format 'yyyyMMdd'))
+
+function Log([string]$msg) {
+    $ts = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
+    "$ts $msg" | Tee-Object -FilePath $logFile -Append | Out-Null
+}
+
+# Server from the GE-Enforce config hive when not passed via Args. Any site
+# running this script is running the enforcement client, which cannot work
+# without BaseUrl, so it is present wherever this is deployed.
+if (-not $ApiUrl) {
+    foreach ($regPath in @('HKLM:\SOFTWARE\GE\ShopDB', 'HKLM:\SOFTWARE\WOW6432Node\GE\ShopDB')) {
+        try {
+            if (Test-Path $regPath) {
+                $base = [string](Get-ItemProperty -Path $regPath -Name BaseUrl -ErrorAction Stop).BaseUrl
+                if ($base -and $base.Trim()) {
+                    $ApiUrl = $base.Trim().TrimEnd('/') + '/api/collector/computers'
+                    break
+                }
+            }
+        } catch {}
+    }
+}
+if (-not $ApiUrl) {
+    Log 'ERROR no ShopDB URL (HKLM:\SOFTWARE\GE\ShopDB BaseUrl or -ApiUrl). Skipping.'
+    exit 0
+}
+
+# A site may name its routable ranges rather than rely on the default route.
+if (-not $AllowedRanges) {
+    foreach ($regPath in @('HKLM:\SOFTWARE\GE\ShopDB', 'HKLM:\SOFTWARE\WOW6432Node\GE\ShopDB')) {
+        try {
+            if (Test-Path $regPath) {
+                $v = [string](Get-ItemProperty -Path $regPath -Name CollectorRanges -ErrorAction Stop).CollectorRanges
+                if ($v -and $v.Trim()) { $AllowedRanges = $v.Trim(); break }
+            }
+        } catch {}
+    }
+}
+
+# collector key from the GE-Enforce secret store when not passed via Args.
+if (-not $ApiKey) {
+    foreach ($regPath in @('HKLM:\SOFTWARE\GE\ShopDB', 'HKLM:\SOFTWARE\WOW6432Node\GE\ShopDB')) {
+        try {
+            if (Test-Path $regPath) {
+                $v = [string](Get-ItemProperty -Path $regPath -Name CollectorKey -ErrorAction Stop).CollectorKey
+                if ($v -and $v.Trim()) { $ApiKey = $v.Trim(); break }
+            }
+        } catch {}
+    }
+}
+if (-not $ApiKey) {
+    Log 'ERROR no collector key (HKLM:\SOFTWARE\GE\ShopDB CollectorKey or -ApiKey). Skipping.'
+    exit 0
+}
+
+# Routable ranges, if this site named any. NO SITE ADDRESSING IS BAKED IN: an
+# unconfigured site falls through to the default-route NIC below (ADR-015).
+#
+# NOT named $allowedRanges: PowerShell variable names are case-insensitive, so
+# that collides with the [string] parameter above and the array is silently
+# COERCED to a string. .Count on a string is 1, so the script then believes a
+# range is configured and never falls back to the default route.
+$rangeList = @()
+foreach ($cidr in ($AllowedRanges -split ',')) {
+    $cidr = $cidr.Trim()
+    if (-not $cidr) { continue }
+    $parts = $cidr -split '/'
+    if ($parts.Count -ne 2) { Log "WARN ignoring malformed range '$cidr'"; continue }
+    $rangeList += @{ Network = $parts[0].Trim(); PrefixLen = [int]$parts[1] }
+}
+
+function ConvertTo-Uint32([string]$ip) {
+    $bytes = ([System.Net.IPAddress]::Parse($ip)).GetAddressBytes()
+    [Array]::Reverse($bytes)
+    return [BitConverter]::ToUInt32($bytes, 0)
+}
+
+function Test-InAllowedRange([string]$ip) {
+    try {
+        $ipInt = ConvertTo-Uint32 $ip
+        foreach ($r in $rangeList) {
+            $netInt = ConvertTo-Uint32 $r.Network
+            $mask   = [uint32]([math]::Pow(2, 32) - [math]::Pow(2, 32 - $r.PrefixLen))
+            if (($ipInt -band $mask) -eq ($netInt -band $mask)) { return $true }
+        }
+    } catch {}
+    return $false
+}
+
+Log '=== Report asset to ShopDB (collector) ==='
+
+# hostname - the collector identity field. required.
+$hostname = $env:COMPUTERNAME
+
+# BIOS serial - optional now (collector keys on hostname). Sent when present.
+$serialNumber = ''
+try {
+    $serialNumber = (Get-CimInstance -ClassName Win32_BIOS -ErrorAction Stop).SerialNumber
+    if ($serialNumber) { $serialNumber = $serialNumber.Trim() }
+} catch {
+    Log "WARN could not read BIOS serial: $($_.Exception.Message)"
+}
+
+# Machine identifier - optional, sent only if found. Maps to Asset.assetnumber
+# server-side (9999 placeholder skipped there and here).
+#   1. eDNC registry (WOW6432Node, then native) - DNC/collections bays (2001...).
+#   2. C:\Enrollment\cmm\cmmid.txt - CMM bay id (e.g. CMM3).
+#   3. C:\Enrollment\machine-number.txt - imaging value.
+# keyence / genspect / part-marker have no per-bay id -> no machineNo sent.
+$machineNo = ''
+foreach ($regPath in @(
+    'HKLM:\SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General',
+    'HKLM:\SOFTWARE\GE Aircraft Engines\DNC\General'
+)) {
+    if ($machineNo) { break }
+    try {
+        if (Test-Path $regPath) {
+            $v = [string](Get-ItemProperty -Path $regPath -Name MachineNo -ErrorAction Stop).MachineNo
+            if ($v -and $v.Trim() -ne '9999') { $machineNo = $v.Trim() }
+        }
+    } catch {
+        Log "WARN could not read MachineNo from ${regPath}: $($_.Exception.Message)"
+    }
+}
+if (-not $machineNo) {
+    $cmmFile = 'C:\Enrollment\cmm\cmmid.txt'
+    if (Test-Path -LiteralPath $cmmFile) {
+        try {
+            $v = ([string](Get-Content -LiteralPath $cmmFile -First 1 -ErrorAction Stop)).Trim()
+            if ($v -and $v -ne '9999') { $machineNo = $v; Log "machineNo from $cmmFile (CMM bay id): $machineNo" }
+        } catch { Log "WARN could not read ${cmmFile}: $($_.Exception.Message)" }
+    }
+}
+if (-not $machineNo) {
+    $mnFile = 'C:\Enrollment\machine-number.txt'
+    if (Test-Path -LiteralPath $mnFile) {
+        try {
+            $v = ([string](Get-Content -LiteralPath $mnFile -First 1 -ErrorAction Stop)).Trim()
+            if ($v -and $v -ne '9999') { $machineNo = $v; Log "machineNo from $mnFile (imaging value): $machineNo" }
+        } catch { Log "WARN could not read ${mnFile}: $($_.Exception.Message)" }
+    }
+}
+
+# OS name string (caption + feature-update + build), e.g.
+# "Microsoft Windows 11 Enterprise 23H2 (build 22631)". Server upserts each
+# distinct string into operatingsystems.
+$osVersion = ''
+$lastBootTime = ''
+try {
+    $os = Get-CimInstance -ClassName Win32_OperatingSystem -ErrorAction Stop
+    $osVersion = "$($os.Caption)".Trim()
+    $displayVersion = ''
+    try {
+        $displayVersion = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name DisplayVersion -ErrorAction Stop).DisplayVersion
+    } catch {}
+    if ($displayVersion)  { $osVersion += " $displayVersion" }
+    if ($os.BuildNumber)  { $osVersion += " (build $($os.BuildNumber))" }
+    $osVersion = $osVersion.Trim()
+    # ISO 8601 - collector parses via datetime.fromisoformat.
+    try { $lastBootTime = $os.LastBootUpTime.ToString('yyyy-MM-ddTHH:mm:ss') } catch {}
+} catch {}
+
+# interactive console user. runs as SYSTEM, so use Win32_ComputerSystem.UserName
+# (console session owner). empty when nobody logged on -> omitted so an
+# unattended bay does not blank the last-known user.
+$loggedInUser = ''
+try {
+    $loggedInUser = (Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop).UserName
+    if ($loggedInUser) { $loggedInUser = ($loggedInUser -split '\\')[-1].Trim() }
+} catch {
+    Log "WARN could not read logged-in user: $($_.Exception.Message)"
+}
+
+# imaging pc-type (gea-shopfloor-*), read from the enrollment file. Sent only
+# when present; absent -> server leaves existing pctype untouched (a bare report
+# never re-types a PC). Unmapped values return a warning, not an error.
+$pcType = ''
+$ptFile = 'C:\Enrollment\pc-type.txt'
+if (Test-Path -LiteralPath $ptFile) {
+    try {
+        $pcType = (Get-Content -LiteralPath $ptFile -First 1 -ErrorAction Stop).Trim()
+    } catch { Log "WARN could not read ${ptFile}: $($_.Exception.Message)" }
+}
+
+# PC make/model from WMI. Server resolves/creates vendor + model. Sent only when
+# present so a WMI read failure does not blank the model.
+$manufacturer = ''
+$model = ''
+try {
+    $cs = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop
+    $manufacturer = "$($cs.Manufacturer)".Trim()
+    $model        = "$($cs.Model)".Trim()
+} catch {
+    Log "WARN could not read make/model: $($_.Exception.Message)"
+}
+
+# The routable IPv4 - a physical, connected NIC. The collector schema takes a
+# single ipaddress string, so report the corporate NIC and drop any
+# controller/machine-LAN NIC. With ranges configured the IP must be in one;
+# with none, the NIC carrying the default route is the routable one by
+# definition, which needs no knowledge of a site's addressing.
+$corpIp = ''
+$defaultRouteIfIndexes = @()
+if ($rangeList.Count -eq 0) {
+    try {
+        $defaultRouteIfIndexes = @(Get-NetRoute -DestinationPrefix '0.0.0.0/0' -ErrorAction Stop |
+                                   Sort-Object RouteMetric |
+                                   Select-Object -ExpandProperty InterfaceIndex -Unique)
+    } catch {
+        Log "WARN could not read the route table: $($_.Exception.Message)"
+    }
+}
+try {
+    $ipObjs = Get-NetIPAddress -AddressFamily IPv4 -ErrorAction Stop |
+              Where-Object { $_.IPAddress -notmatch '^169\.254' -and $_.IPAddress -ne '127.0.0.1' }
+    foreach ($ipo in $ipObjs) {
+        if ($corpIp) { break }
+        $adapter = $null
+        try { $adapter = Get-NetAdapter -InterfaceIndex $ipo.InterfaceIndex -ErrorAction Stop } catch {}
+        if (-not $adapter) { continue }
+        if (-not $adapter.HardwareInterface) { continue }
+        if ($adapter.Status -ne 'Up') { continue }
+        if ($rangeList.Count -gt 0) {
+            if (Test-InAllowedRange $ipo.IPAddress) { $corpIp = $ipo.IPAddress }
+        } elseif ($defaultRouteIfIndexes -contains $ipo.InterfaceIndex) {
+            $corpIp = $ipo.IPAddress
+        }
+    }
+} catch {
+    Log "WARN interface enumeration failed: $($_.Exception.Message)"
+}
+if (-not $corpIp) { Log 'WARN no routable IPv4 NIC found; posting identity without ipaddress.' }
+
+# collector schema fields (lowercase concatenated). hostname is required; the
+# rest are sent only when present so a partial read never blanks a good value.
+$body = @{ hostname = $hostname }
+if ($serialNumber) { $body['serialnumber'] = $serialNumber }
+if ($machineNo)    { $body['machinenumber'] = $machineNo }
+if ($pcType)       { $body['pctype']        = $pcType }
+if ($manufacturer) { $body['vendorname']    = $manufacturer }
+if ($model)        { $body['modelnumber']   = $model }
+if ($osVersion)    { $body['osname']        = $osVersion }
+if ($lastBootTime) { $body['lastboottime']  = $lastBootTime }
+if ($loggedInUser) { $body['loggedinuser']  = $loggedInUser }
+if ($corpIp)       { $body['ipaddress']     = $corpIp }
+$body['lastcheckin'] = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss')
+
+$json = $body | ConvertTo-Json -Compress -Depth 4
+
+Log ("POST {0} host={1} serial={2} pcType={3} make={4} model={5} os={6} boot={7} machineNo={8} user={9} ip={10}" -f `
+    $ApiUrl, $hostname, $serialNumber, $pcType, $manufacturer, $model, $osVersion, $lastBootTime, $machineNo, $loggedInUser, $corpIp)
+
+try {
+    $resp = Invoke-RestMethod -Uri $ApiUrl -Method Post -Body $json `
+        -ContentType 'application/json' `
+        -Headers @{ 'X-API-Key' = $ApiKey } `
+        -TimeoutSec $TimeoutSec -ErrorAction Stop
+    Log ("RESPONSE {0}" -f ($resp | ConvertTo-Json -Compress -Depth 4))
+} catch {
+    Log "ERROR POST failed: $($_.Exception.Message)"
+}
+
+exit 0