54f0857e13
Twelve endpoints routes shared one permission, which made a reasonable policy impossible to express. A site that wants signed-out visitors to see live status on a PC page had to hand them the entire fleet - including every logged-in username on the floor - because the per-asset panels and the fleet-wide list were gated on the same string. endpoints.fleet now gates the list and the three dashboard routes. endpoints.view keeps the per-asset reads: status, services, processes, interfaces, events, command history. The name is load-bearing. guest_grantable_permissions() opens any '.view' or '.read' permission to the guest role, so calling this one 'endpoints.fleet' rather than 'endpoints.fleetview' is what keeps the roster off the public surface while per-asset telemetry stays grantable. Verified both ways. Also: the services panel emitted Start/Stop row actions to every reader, because row_actions_for() never consulted the caller. Clicking was always refused server-side, so nothing was exploitable, but showing a read-only viewer controls over a shop-floor PC is the wrong signal - and it stops being cosmetic the moment a site grants that panel to guests. That needed a contract addition rather than a local check: caller_holds() on shopdb.api answers whether THIS caller holds a permission without refusing the request, which is the complement to require_permission for a surface that serves everyone but should only offer what the caller can act on. Guests are included, since a signed-out visitor holds whatever the guest role was granted. Reaching into shopdb.utils.authz instead would repeat the ADR-002 violation the contract gate caught earlier in this branch. Contract 0.24.0 -> 0.25.0. DEPLOYMENT: endpoints.fleet is a new permission. Run 'flask seed permissions' and grant it to the roles that should keep seeing the Fleet page. Until then that page is admin-only, since admins bypass every check - a safe direction, but not an automatic one. Full suite 2124 passed, naming and contract gates green, map and spec regenerated.
96 lines
4.4 KiB
Markdown
96 lines
4.4 KiB
Markdown
<!-- GENERATED by scripts/gen_project_map.py - do not edit by hand.
|
|
Regenerate with: venv/bin/python scripts/gen_project_map.py -->
|
|
|
|
# Project map
|
|
|
|
Derived from the code on every regeneration. If something here is wrong, the
|
|
code changed and the map was not regenerated - fix it by running the generator,
|
|
never by editing this file.
|
|
|
|
## Versions
|
|
|
|
| series | value | governed by |
|
|
|---|---|---|
|
|
| product `__version__` | `0.12.0` | ADR-007 |
|
|
| plugin contract `__contract_version__` | `0.25.0` | ADR-002 |
|
|
|
|
They move independently. A contract bump is not a release.
|
|
|
|
## Alembic chains (ADR-008)
|
|
|
|
Core runs with `flask db upgrade`; every plugin chain runs
|
|
with `flask plugin upgrade-all`. Both are needed on a deploy.
|
|
|
|
| chain | head |
|
|
|---|---|
|
|
| core | `7d34_singular_relationship_types` |
|
|
| backups | `backups0003clearlastseen` |
|
|
| computers | `computers0004policies` |
|
|
| employees | `employees0002photo` |
|
|
| endpoints | `endpoints0003cmdtarget` |
|
|
| geenforce | `geenforce0004minlib` |
|
|
| guides | `guides0001baseline` |
|
|
| knowledgebase | `knowledgebase0001anchor` |
|
|
| machines | `machines0002rename` |
|
|
| measuringtools | `measuringtools0001baseline` |
|
|
| network | `network0003prefix` |
|
|
| notifications | `notifications0005boardorder` |
|
|
| printedparts | `printedparts0004txnrev` |
|
|
| printers | `printers0005observedqueues` |
|
|
| slides | `slides0001anchor` |
|
|
| tools | `tools0001securesend` |
|
|
| usb | `usb0002dropmachineid` |
|
|
| warranty | `warranty0002proof` |
|
|
|
|
## Bundled plugins (17)
|
|
|
|
| plugin | version | core_version | owns migrations |
|
|
|---|---|---|---|
|
|
| backups | 1.0.0 | >=0.16.0,<1.0.0 | yes |
|
|
| computers | 1.0.0 | >=0.20.0,<1.0.0 | yes |
|
|
| employees | 1.0.0 | >=0.1.0,<1.0.0 | yes |
|
|
| endpoints | 0.1.0 | >=0.20.0,<1.0.0 | yes |
|
|
| geenforce | 0.1.0 | >=0.18.0,<1.0.0 | yes |
|
|
| guides | 1.0.0 | >=0.1.0,<1.0.0 | yes |
|
|
| knowledgebase | 1.0.0 | >=0.1.0,<1.0.0 | yes |
|
|
| machines | 1.0.0 | >=0.20.0,<1.0.0 | yes |
|
|
| measuringtools | 1.0.0 | >=0.20.0,<1.0.0 | yes |
|
|
| network | 1.0.0 | >=0.20.0,<1.0.0 | yes |
|
|
| notifications | 1.0.0 | >=0.1.0,<1.0.0 | yes |
|
|
| printedparts | 0.1.0 | >=0.16.0,<1.0.0 | yes |
|
|
| printers | 1.0.0 | >=0.20.0,<1.0.0 | yes |
|
|
| slides | 2.0.0 | >=0.2.0,<1.0.0 | yes |
|
|
| tools | 1.0.0 | >=0.16.0,<1.0.0 | yes |
|
|
| usb | 1.0.0 | >=0.1.0,<1.0.0 | yes |
|
|
| warranty | 1.0.0 | >=0.2.0,<1.0.0 | yes |
|
|
|
|
Manifest-less directories under `plugins/` are core frontend surface and always ship: `applications`.
|
|
|
|
## Architecture decisions
|
|
|
|
| ADR | title | status |
|
|
|---|---|---|
|
|
| ADR-001-asset-as-platform-contract.md | ADR-001: Asset model is the platform contract | ACCEPTED |
|
|
| ADR-002-plugin-versioning.md | ADR-002: Plugin contract versioning | ACCEPTED |
|
|
| ADR-003-plugin-distribution.md | ADR-003: Plugin distribution model | ACCEPTED |
|
|
| ADR-004-deployment-topology.md | ADR-004: Deployment topology (per-site instances) | ACCEPTED |
|
|
| ADR-005-equipment-vs-measuringtools.md | ADR-005: Equipment plugin scope vs measuringtools plugin | ACCEPTED |
|
|
| ADR-006-collector-contract.md | ADR-006: Plugin collector contract pattern | ACCEPTED |
|
|
| ADR-007-product-versioning-and-releases.md | ADR-007: Product versioning and releases | ACCEPTED |
|
|
| ADR-008-plugin-migration-ownership.md | ADR-008: Plugin migration ownership (per-plugin chains from the cutover) | ACCEPTED |
|
|
| ADR-009-frontend-plugin-gating.md | ADR-009: Frontend plugin gating | ACCEPTED |
|
|
| ADR-010-frontend-plugin-hooks.md | ADR-010: Frontend plugin hook contract | ACCEPTED |
|
|
| ADR-011-machines-rename.md | ADR-011: Rename the equipment domain to machines; retype the models catalog with modeltypes | ACCEPTED |
|
|
| ADR-012-geenforce-manifest-ownership.md | ADR-012: GE-Enforce manifest ownership in shopdb | ACCEPTED |
|
|
| ADR-013-plugin-catalog-and-lean-builds.md | ADR-013: Plugin Catalog, Curated Shelf, and Lean Per-Site Builds | ACCEPTED |
|
|
| ADR-014-schema-lean-per-site.md | ADR-014: Schema-lean per-site builds (retire cross-plugin FKs, lift plugin tables) | ACCEPTED |
|
|
| ADR-015-site-specific-configuration.md | ADR-015: Where a site's own data is allowed to live | ACCEPTED |
|
|
| ADR-016-credential-delivery.md | ADR-016: Credential delivery to the fleet | ACCEPTED (decided; NOT yet implemented - |
|
|
| ADR-017-buildings-and-levels.md | ADR-017: Buildings and levels as the map model | ACCEPTED |
|
|
|
|
## Size
|
|
|
|
- test functions defined: **1449** (parametrised cases collect higher)
|
|
- documented API paths: **331** (`docs/openapi.json`, regenerate with `scripts/gen_openapi.py`)
|
|
|