0baed4cc80
Four things the mockup showed and the first cut did not have.
FLEET
- A 'with critical events' tile, from the stability route that existed and
nothing called. Clicking it narrows to rows whose health is not ok - client
side, because the health rollup is assembled per row after pagination, so
it narrows the PAGE rather than the fleet. Worth knowing before the count
is read as fleet-wide.
- PC type and Location filters. The list route already accepted both; there
was simply no control. Both use listAll, not list: perpage is clamped to
100 server-side, so a long location list would lose its tail in a dropdown
while still looking complete.
- The machine cell shows number and name together where they differ, so
'3105 Okuma' rather than a bare number.
PC DETAIL
- A Policy card, contributed by the computers plugin. It matters because the
effective policy already narrows the command allowlist, so without it the
reason a control is unavailable on a given PC is written down nowhere.
Provenance, so it sits in the reference column, not the triage band.
Its route returns an EMPTY field list rather than the feature-gate 404 when
policies are disabled. The panel contract hides a card with no fields, so
it disappears on sites that have not enabled the feature - a 404 would have
rendered a broken card on most of them. That was flagged in the design
review as a snag; this is the fix.
- Refresh Status and Restart Computer moved out of the page header into the
triage band. They act on the MACHINE; Print Label, Edit, Retire and Back to
List act on the RECORD, and mixing them put the most consequential button
on the page - it halts whatever machine the PC serves - between printing a
sticker and editing a form. In the band it sits beside the liveness chip
and the machine it would take down.
The band takes them through an 'actions' slot rather than knowing about PC
verbs, so a measuring tool can put 'Calibrate' there without the core
component learning anything about computers.
Full suite 2124 passed, vitest 260 passed, gates green, spec at 333 paths.
448 lines
17 KiB
Python
448 lines
17 KiB
Python
"""CRUD API for Configuration and Business Policies.
|
|
|
|
Registered on computers_bp under /api/computers/policies/... Kept in its own
|
|
module so the whole policy surface can be removed by not importing it - part of
|
|
the exit gate. Every route first checks the computers_configpolicies_enabled
|
|
switch and returns 404 while it is off, so enabling/disabling the feature never
|
|
half-exposes it.
|
|
|
|
Write-time validation lives here (not in the model): scope ASTs go through
|
|
validate_scope, and action names are checked against the endpoints command
|
|
allowlist, so a bad tree or an unknown action never reaches the database.
|
|
"""
|
|
|
|
from flask import request
|
|
|
|
from shopdb.api import (db, AuditLog, success_response, error_response,
|
|
ErrorCodes, require_permission)
|
|
|
|
from .routes import computers_bp
|
|
from ..models import (ConfigurationPolicy, ConfigurationPolicyAction,
|
|
BusinessPolicy, BusinessPolicyItem, POLICY_SOURCE_LOCAL,
|
|
ACTION_MODE_DESIRED, ACTION_MODE_GATE)
|
|
from ..policyflag import policy_flag_enabled
|
|
from ..services.policyscope import validate_scope, ScopeError
|
|
|
|
_MODES = {ACTION_MODE_DESIRED, ACTION_MODE_GATE}
|
|
|
|
|
|
def _feature_gate():
|
|
"""Return a 404 response when the policy feature is off, else None."""
|
|
if not policy_flag_enabled():
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Policy feature is not enabled', http_code=404)
|
|
return None
|
|
|
|
|
|
def _known_actions():
|
|
"""The code-level allowlist of action names a policy may reference."""
|
|
from plugins.endpoints.commands import COMMAND_ALLOWLIST
|
|
return set(COMMAND_ALLOWLIST.keys())
|
|
|
|
|
|
def _configpolicy_dict(policy):
|
|
data = policy.to_dict()
|
|
data['actions'] = [a.to_dict() for a in policy.actions]
|
|
return data
|
|
|
|
|
|
def _businesspolicy_dict(policy):
|
|
data = policy.to_dict()
|
|
data['items'] = [{
|
|
'businesspolicyitemid': it.businesspolicyitemid,
|
|
'configurationpolicyid': it.configurationpolicyid,
|
|
'sortorder': it.sortorder,
|
|
'name': it.configurationpolicy.name if it.configurationpolicy else None,
|
|
} for it in policy.items]
|
|
return data
|
|
|
|
|
|
# =============================================================================
|
|
# Configuration Policies
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/configuration', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_configuration_policies():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policies = ConfigurationPolicy.query.order_by(ConfigurationPolicy.name).all()
|
|
return success_response([_configpolicy_dict(p) for p in policies])
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
return success_response(_configpolicy_dict(policy))
|
|
|
|
|
|
def _apply_actions(policy, actions):
|
|
"""Replace a policy's actions from request data, validating each.
|
|
|
|
Returns an error_response on failure, else None.
|
|
"""
|
|
known = _known_actions()
|
|
policy.actions.clear()
|
|
for row in actions or []:
|
|
name = (row.get('action') or '').strip()
|
|
if name not in known:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Unknown action: {name!r}')
|
|
mode = (row.get('mode') or ACTION_MODE_GATE).strip()
|
|
if mode not in _MODES:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Unknown action mode: {mode!r}')
|
|
policy.actions.append(ConfigurationPolicyAction(
|
|
action=name,
|
|
mode=mode,
|
|
desiredstate=row.get('desiredstate'),
|
|
params=row.get('params'),
|
|
intervalminutes=row.get('intervalminutes'),
|
|
sortorder=row.get('sortorder', 0) or 0,
|
|
))
|
|
return None
|
|
|
|
|
|
@computers_bp.route('/policies/configuration', methods=['POST'])
|
|
@require_permission('computers.create')
|
|
def create_configuration_policy():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
data = request.get_json() or {}
|
|
name = (data.get('name') or '').strip()
|
|
if not name:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
|
|
if ConfigurationPolicy.query.filter_by(name=name).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Configuration policy '{name}' already exists",
|
|
http_code=409)
|
|
|
|
scope = data.get('scopejson')
|
|
if scope is not None:
|
|
try:
|
|
validate_scope(scope)
|
|
except ScopeError as exc:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Invalid scope: {exc}')
|
|
|
|
policy = ConfigurationPolicy(
|
|
name=name,
|
|
description=data.get('description'),
|
|
scopejson=scope,
|
|
source=POLICY_SOURCE_LOCAL,
|
|
)
|
|
err = _apply_actions(policy, data.get('actions'))
|
|
if err:
|
|
return err
|
|
|
|
db.session.add(policy)
|
|
AuditLog.log('created', 'ConfigurationPolicy', entityname=name)
|
|
db.session.commit()
|
|
return success_response(_configpolicy_dict(policy),
|
|
message='Configuration policy created',
|
|
http_code=201)
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['PUT'])
|
|
@require_permission('computers.edit')
|
|
def update_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
data = request.get_json() or {}
|
|
|
|
if 'name' in data:
|
|
newname = (data['name'] or '').strip()
|
|
if newname and newname != policy.name:
|
|
if ConfigurationPolicy.query.filter_by(name=newname).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Configuration policy '{newname}' already exists",
|
|
http_code=409)
|
|
policy.name = newname
|
|
if 'description' in data:
|
|
policy.description = data['description']
|
|
if 'isactive' in data:
|
|
policy.isactive = data['isactive']
|
|
if 'scopejson' in data:
|
|
scope = data['scopejson']
|
|
if scope is not None:
|
|
try:
|
|
validate_scope(scope)
|
|
except ScopeError as exc:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Invalid scope: {exc}')
|
|
policy.scopejson = scope
|
|
if 'actions' in data:
|
|
err = _apply_actions(policy, data['actions'])
|
|
if err:
|
|
return err
|
|
|
|
AuditLog.log('updated', 'ConfigurationPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(_configpolicy_dict(policy),
|
|
message='Configuration policy updated')
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['DELETE'])
|
|
@require_permission('computers.delete')
|
|
def delete_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
inuse = BusinessPolicyItem.query.filter_by(
|
|
configurationpolicyid=policy_id).count()
|
|
if inuse:
|
|
return error_response(
|
|
ErrorCodes.CONFLICT,
|
|
f'Cannot delete: used by {inuse} business policy item(s)',
|
|
http_code=409)
|
|
db.session.delete(policy)
|
|
AuditLog.log('deleted', 'ConfigurationPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(None, message='Configuration policy deleted')
|
|
|
|
|
|
# =============================================================================
|
|
# Business Policies
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/business', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_business_policies():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policies = (BusinessPolicy.query
|
|
.order_by(BusinessPolicy.priority, BusinessPolicy.businesspolicyid)
|
|
.all())
|
|
return success_response([_businesspolicy_dict(p) for p in policies])
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
return success_response(_businesspolicy_dict(policy))
|
|
|
|
|
|
def _apply_items(policy, items):
|
|
"""Replace a business policy's configuration-policy items, validating each."""
|
|
policy.items.clear()
|
|
seen = set()
|
|
for order, row in enumerate(items or []):
|
|
cpid = row.get('configurationpolicyid')
|
|
if cpid is None:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
'item requires configurationpolicyid')
|
|
if cpid in seen:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'duplicate configuration policy {cpid}')
|
|
if not db.session.get(ConfigurationPolicy, cpid):
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'unknown configuration policy {cpid}')
|
|
seen.add(cpid)
|
|
policy.items.append(BusinessPolicyItem(
|
|
configurationpolicyid=cpid,
|
|
sortorder=row.get('sortorder', order),
|
|
))
|
|
return None
|
|
|
|
|
|
@computers_bp.route('/policies/business', methods=['POST'])
|
|
@require_permission('computers.create')
|
|
def create_business_policy():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
data = request.get_json() or {}
|
|
name = (data.get('name') or '').strip()
|
|
if not name:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
|
|
if BusinessPolicy.query.filter_by(name=name).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Business policy '{name}' already exists",
|
|
http_code=409)
|
|
policy = BusinessPolicy(
|
|
name=name,
|
|
description=data.get('description'),
|
|
priority=data.get('priority', 100),
|
|
source=POLICY_SOURCE_LOCAL,
|
|
)
|
|
err = _apply_items(policy, data.get('items'))
|
|
if err:
|
|
return err
|
|
db.session.add(policy)
|
|
AuditLog.log('created', 'BusinessPolicy', entityname=name)
|
|
db.session.commit()
|
|
return success_response(_businesspolicy_dict(policy),
|
|
message='Business policy created', http_code=201)
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['PUT'])
|
|
@require_permission('computers.edit')
|
|
def update_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
data = request.get_json() or {}
|
|
if 'name' in data:
|
|
newname = (data['name'] or '').strip()
|
|
if newname and newname != policy.name:
|
|
if BusinessPolicy.query.filter_by(name=newname).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Business policy '{newname}' already exists",
|
|
http_code=409)
|
|
policy.name = newname
|
|
if 'description' in data:
|
|
policy.description = data['description']
|
|
if 'priority' in data:
|
|
policy.priority = data['priority']
|
|
if 'isactive' in data:
|
|
policy.isactive = data['isactive']
|
|
if 'items' in data:
|
|
err = _apply_items(policy, data['items'])
|
|
if err:
|
|
return err
|
|
AuditLog.log('updated', 'BusinessPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(_businesspolicy_dict(policy),
|
|
message='Business policy updated')
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['DELETE'])
|
|
@require_permission('computers.delete')
|
|
def delete_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
db.session.delete(policy)
|
|
AuditLog.log('deleted', 'BusinessPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(None, message='Business policy deleted')
|
|
|
|
|
|
# =============================================================================
|
|
# Action catalog (for the UI) and effective-policy preview
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/actions', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_policy_actions():
|
|
"""The allowlisted action names + labels a policy may reference."""
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
from plugins.endpoints.commands import COMMAND_ALLOWLIST
|
|
return success_response([
|
|
{'action': name, 'label': meta.get('label'),
|
|
'description': meta.get('description')}
|
|
for name, meta in COMMAND_ALLOWLIST.items()
|
|
])
|
|
|
|
|
|
@computers_bp.route('/policies/effective/<int:asset_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_effective_policy(asset_id: int):
|
|
"""Preview the resolved effective policy for one endpoint (debug/UI)."""
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
from ..services.policyresolver import effective_policy_for
|
|
effective = effective_policy_for(asset_id)
|
|
return success_response(effective.to_dict())
|
|
|
|
|
|
@computers_bp.route('/asset/<int:asset_id>/policypanel', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def policy_panel(asset_id: int):
|
|
"""Keyvalue panel: which policy governs this endpoint, and what it allows.
|
|
|
|
Provenance, not a control. It matters because the effective policy already
|
|
narrows the command allowlist, so it is the answer to "why is Start greyed
|
|
out on this PC" - which is otherwise invisible.
|
|
|
|
Returns an EMPTY field list rather than the feature-gate 404 when the
|
|
feature is off. The panel contract hides a card with no fields; an error
|
|
would render a broken card on every site that has not enabled policies,
|
|
which is most of them.
|
|
"""
|
|
if not policy_flag_enabled():
|
|
return success_response({'fields': []})
|
|
|
|
from ..services.policyresolver import effective_policy_for
|
|
effective = effective_policy_for(asset_id)
|
|
actions = effective.to_dict()
|
|
if not actions:
|
|
return success_response({'fields': []})
|
|
|
|
# One endpoint resolves through one winning business policy, but read the
|
|
# ids off the actions rather than assuming: a fold can draw from more than
|
|
# one configuration policy.
|
|
businesspolicyids = {a['businesspolicyid'] for a in actions.values()
|
|
if a.get('businesspolicyid')}
|
|
configpolicyids = {a['configurationpolicyid'] for a in actions.values()
|
|
if a.get('configurationpolicyid')}
|
|
|
|
names = []
|
|
if businesspolicyids:
|
|
names = [p.name for p in BusinessPolicy.query
|
|
.filter(BusinessPolicy.businesspolicyid.in_(businesspolicyids)).all()]
|
|
|
|
gated = sum(1 for a in actions.values() if a.get('mode') == ACTION_MODE_GATE)
|
|
desired = sum(1 for a in actions.values() if a.get('mode') == ACTION_MODE_DESIRED)
|
|
|
|
fields = []
|
|
if names:
|
|
fields.append({'label': 'Policy', 'value': ', '.join(sorted(names))})
|
|
fields.append({'label': 'Configuration policies', 'value': str(len(configpolicyids))})
|
|
fields.append({'label': 'Allowed actions', 'value': str(gated)})
|
|
fields.append({'label': 'Desired state', 'value': str(desired)})
|
|
return success_response({'fields': fields})
|