Publish gate: refuse a manifest the fleet's enforcer lib cannot read

plugins/geenforce/api/routes.py

@@ -726,17 +726,49 @@ def publish_scope_route(scopeid):
     if not scope:
         return error_response(ErrorCodes.NOT_FOUND, 'No such scope', http_code=404)
     from flask_jwt_extended import get_jwt_identity
-    notes = (request.get_json(silent=True) or {}).get('notes')
+    body = request.get_json(silent=True) or {}
+    notes = body.get('notes')
     try:
         publishedby = int(get_jwt_identity())
     except (TypeError, ValueError):
         publishedby = None
-    version = service.publish_scope(scope.scopename, scope.phase,
-                                    notes=notes, publishedby=publishedby)
+    try:
+        version = service.publish_scope(
+            scope.scopename, scope.phase, notes=notes,
+            publishedby=publishedby, force=bool(body.get('force')))
+    except service.LibVersionTooOldError as error:
+        # 409, not 500: the request is well-formed, the fleet is not ready. The
+        # hosts come back so the caller can act without going hunting.
+        return error_response(
+            ErrorCodes.CONFLICT, str(error), http_code=409,
+            details={'required': error.required, 'floor': error.floor,
+                     'hosts': error.hosts})
     db.session.commit()
     return success_response({'versionnumber': version}, http_code=201)
 
 
+@geenforce_bp.route('/scopes/<int:scopeid>/publish-preflight', methods=['GET'])
+@jwt_required()
+@require_permission('geenforce.manage')
+def publish_preflight(scopeid):
+    """Would publishing this scope outrun the fleet's enforcer lib?
+
+    Lets the UI warn BEFORE someone clicks publish, rather than only refusing
+    afterwards.
+    """
+    scope = db.session.get(ManifestScope, scopeid)
+    if not scope:
+        return error_response(ErrorCodes.NOT_FOUND, 'No such scope', http_code=404)
+    hosts, floor = service.hosts_below_libversion(
+        scope.scopename, scope.phase, scope.manifestversion)
+    return success_response({
+        'required': scope.manifestversion,
+        'floor': floor,
+        'hostsbehind': hosts,
+        'canpublish': not hosts,
+    })
+
+
 @geenforce_bp.route('/scopes/<int:scopeid>/versions', methods=['GET'])
 @jwt_required()
 @require_permission('geenforce.manage')