2d09fa3201
ShopDB knew what a bay SHOULD have and nothing about what it DOES. Adding the observed half makes a rollout a review instead of a typing exercise: the floor reports itself in, you look, and you adopt. The collection uses the mechanism that already exists rather than a new one. POST /api/collector/printers dispatches to the printers plugin's apply_collector_payload, the same ADR-006 hook the computers and backups plugins implement. New client script, new plugin-owned table, no new transport and no new credential. OBSERVED AND ASSIGNED STAY APART, and that is the point rather than a detail. A collector report can never write an assignment row: _reconcile_edges is the only function that writes usesprinter/defaultprinter, it has two call sites, and both are authenticated routes a human calls. If a drifted bay's own state were allowed to become what it is told to install, every configuration error would become permanent the next time that PC checked in. Seeding an assignment from observed state is explicit - POST /assignments/seed-from-observed - because a rollout adopts many machines at once. It routes through the same _reconcile_edges as the editor, so there is one write path with two doors, and a queue matching no known printer is REFUSED rather than guessed into an assignment. That last rule is the lesson from the measuring tools: adopting on a weak key produced 43 duplicate instruments. Two fixes on top of what the agents built. The replace deleted a host's previous rows by exact case-folded name while the read path treats a short name and its FQDN as one machine, so a PC that changed spelling appeared to hold every queue twice - which reads as drift that is not there. And the client sent 'reportedat' where the declared schema said 'observedat'. Also here: the legacy loader now imports machines.printerid, the classic system's record of each machine's default printer, which it silently dropped - the production import would have lost every one. And Set-ShopdbPrinters.ps1 finally registers the per-user logon task, staging Apply-ShopdbDefaultPrinter.ps1 to C:\ProgramData first because the share it lives on is mounted only during the enforcement cycle and the task runs at logon when it is gone. VALIDATED ON WINDOWS 11 (build 26200), not just on Linux pwsh, which parses these scripts happily and executes none of the spooler branches. The reporter: posts a correct payload with the X-API-Key header; resolves BaseUrl and CollectorKey from HKLM when given no arguments; suppresses the virtual queues by port; resolves port addresses; and reads the CONSOLE USER's default out of HKU rather than SYSTEM's own, which is a different and usually wrong answer. Two results matter more than the rest. With the spooler stopped, both the cmdlet and the CIM path fail and the script posts NOTHING - verified against a capture server that recorded zero requests, where an empty list would instead have erased that host's observed rows and read as a bay that lost its printers. A genuinely empty host still posts [], because that is a real and different fact. The logon task registers as the Users group at Limited, and falls back to the well-known SID S-1-5-32-545 when the group name will not resolve, as it will not on localised Windows. It was then run with the source directory RENAMED AWAY, to stand in for the share being unmounted, and it still moved the user's default - which is the whole reason the script is staged to C:\ProgramData rather than run from where it lives. The guarantees against damage were re-checked rather than assumed: an empty assignment changes nothing, an unreachable server changes nothing, -WhatIfOnly leaves no queue, no task, no staged file and no registry value behind, and a drifted queue is repointed IN PLACE with Set-Printer so whoever has it as their default keeps it. Not covered by any of this: the driver-staging path, which needs a real vendor package rather than the class drivers a VM ships with.
110 lines
4.3 KiB
Python
110 lines
4.3 KiB
Python
"""What a bay actually HAS: one row per printer queue a PC reported.
|
|
|
|
This is the observed half of the printer loop. The assigned half already exists
|
|
as usesprinter/defaultprinter relationship rows on the machine, and the two are
|
|
kept apart on purpose: the moment a drifted bay's observed state is allowed to
|
|
write assignment rows, enforcement stops meaning anything. Nothing in this table
|
|
is desired state, and no code may promote it to desired state without a person
|
|
asking for that explicitly.
|
|
|
|
Current state, not history. The latest report for a host REPLACES every row that
|
|
host had before, so "what does this bay have" is a plain filter and never a
|
|
question about time. An append-only table would grow with every GE-Enforce cycle
|
|
and answer that question wrong. The audit log already records each ingest, which
|
|
is where the history lives.
|
|
|
|
Rows are keyed by hostname as reported, with assetid as a resolved convenience:
|
|
a bay can report before anyone creates its computer record, and the report must
|
|
still land. Matching an observed queue back to a ShopDB printer asset happens at
|
|
READ time (port address first, then queue name) so a printer added tomorrow
|
|
matches without the bay re-reporting.
|
|
|
|
Replacement is a hard DELETE of the host's rows, not a soft one: the inherited
|
|
isactive flag is not a soft-delete marker here, because a queue that is gone
|
|
from the bay is not observed state that has been retired, it is state that was
|
|
never observed again.
|
|
"""
|
|
|
|
from shopdb.api import db, BaseModel
|
|
|
|
|
|
class PrinterObservedQueue(BaseModel):
|
|
"""One Windows print queue seen on one reporting PC at one point in time."""
|
|
|
|
__tablename__ = 'printerobservedqueues'
|
|
|
|
printerobservedqueueid = db.Column(db.Integer, primary_key=True)
|
|
|
|
# The reporting PC, resolved at ingest. Nullable because an unenrolled bay
|
|
# still gets to report, and no backref: core assets must not grow a
|
|
# dependency on this plugin.
|
|
assetid = db.Column(
|
|
db.Integer,
|
|
db.ForeignKey('assets.assetid', ondelete='CASCADE'),
|
|
nullable=True,
|
|
comment='Reporting PC asset, resolved from hostname at ingest',
|
|
)
|
|
asset = db.relationship('Asset', lazy='select', viewonly=True)
|
|
|
|
# Authoritative identity of the report, stored as sent. assetid can be null
|
|
# or can go stale after a rename; hostname is what the replace keys on.
|
|
hostname = db.Column(
|
|
db.String(255),
|
|
nullable=False,
|
|
comment='Reporting PC hostname, as sent by the collector',
|
|
)
|
|
|
|
queuename = db.Column(
|
|
db.String(255),
|
|
nullable=False,
|
|
comment='Windows printer (queue) name',
|
|
)
|
|
drivername = db.Column(
|
|
db.String(255),
|
|
comment='Windows driver name, verbatim; comparable to printerdrivers.drivername',
|
|
)
|
|
portname = db.Column(
|
|
db.String(255),
|
|
comment='Windows port name, freeform',
|
|
)
|
|
# Primary match key: an IP or FQDN identifies a device unambiguously, where
|
|
# a queue name is only ever a convention. Null for non-TCP/IP ports.
|
|
portaddress = db.Column(
|
|
db.String(255),
|
|
comment='Host address the port points at (IP or FQDN)',
|
|
)
|
|
|
|
isdefault = db.Column(
|
|
db.Boolean,
|
|
nullable=False,
|
|
default=False,
|
|
comment='Was the default queue for the reporting context',
|
|
)
|
|
isshared = db.Column(
|
|
db.Boolean,
|
|
nullable=False,
|
|
default=False,
|
|
comment='Queue is shared off this PC',
|
|
)
|
|
|
|
# Server-stamped once per report, so every row of one report carries the
|
|
# same value and "when did this bay last report" needs no aggregate.
|
|
observedat = db.Column(
|
|
db.DateTime,
|
|
nullable=False,
|
|
comment='When the report that produced this row was ingested',
|
|
)
|
|
|
|
__table_args__ = (
|
|
# Windows queue names are unique per host, so this doubles as the read
|
|
# index for the hostname filter and turns a botched partial replace into
|
|
# an IntegrityError instead of silent duplicate queues.
|
|
db.UniqueConstraint('hostname', 'queuename',
|
|
name='uq_printerobservedqueue_host_queue'),
|
|
db.Index('idx_printerobservedqueues_portaddress', 'portaddress'),
|
|
db.Index('idx_printerobservedqueues_assetid', 'assetid'),
|
|
)
|
|
|
|
def __repr__(self):
|
|
return f"<PrinterObservedQueue {self.hostname}:{self.queuename}>"
|