75627d4398
Applied on top ofaf13337so nothing already on wilm is rewritten. AUTHORIZATION. The six new policy GETs were @jwt_required(optional=True) with no permission at all, so an anonymous caller could list configuration and business policies - gated only by a feature flag that 404s while off. They now require computers.view. The six policy write routes stacked @jwt_required() above @require_permission, the same pattern removed from nine endpoints routes in this very push: the outer decorator answers an anonymous request 401 before require_permission can consult the guest role, so a grant to guests silently does nothing. Removed, and the now-unused import with them. tests/test_core/test_public_read_surface.py failed ataf13337with seven ungated GETs. It passes now. The seventh, endpoints.claim_next_command, is genuinely agent-facing - authenticated in the handler by the endpoints collector key, because a bay has no user session - so it joins PUBLIC_ENDPOINTS with its reason written down, exactly as report_command_result already does in test_authz.py. Note which half is public: claiming a queued command is the agent's business, while ENQUEUEING one is the real authority and stays gated on endpoints.command. INSTALLER. -BaseUrl and -CollectorKey are now mandatory with no defaults, and https is enforced unless -AllowInsecureHttp is passed for a local test box. The defaults were a real hostname (ADR-015) and a live collector key: a key in source is a key in git history, and that key is also the command channel's kill switch. Removing it here does not undo the disclosure - it must be rotated on the server, and purged fromaf13337- but it stops the next clone carrying it. IMPORT. A committed import wrote thousands of rows and left no audit trail; it now writes one AuditLog row inside the same transaction, so it cannot survive a rollback or go missing from a commit. The computer-type dropdown asked for per_page: 200, which the API ignores in favour of perpage and clamps to 100 anyway - it uses a new computersApi.types.listAll(), the pattern already applied to the other selectors. And the comment claiming the template example rows are "emitted as commented rows the engine skips" was the opposite of the truth: they import as live data, the emitted instructions say so, and a test depends on it. Not fixed here, deliberately: rotating the leaked key, purging it from history, and the endpoint agent's own hardening (per-host credentials, a protected process denylist so stop cannot kill security tooling, signing before the PowerShell runner is enabled, registry ACLs, and the 25-second long poll that will pin a worker thread per bay).
400 lines
15 KiB
Python
400 lines
15 KiB
Python
"""CRUD API for Configuration and Business Policies.
|
|
|
|
Registered on computers_bp under /api/computers/policies/... Kept in its own
|
|
module so the whole policy surface can be removed by not importing it - part of
|
|
the exit gate. Every route first checks the computers_configpolicies_enabled
|
|
switch and returns 404 while it is off, so enabling/disabling the feature never
|
|
half-exposes it.
|
|
|
|
Write-time validation lives here (not in the model): scope ASTs go through
|
|
validate_scope, and action names are checked against the endpoints command
|
|
allowlist, so a bad tree or an unknown action never reaches the database.
|
|
"""
|
|
|
|
from flask import request
|
|
|
|
from shopdb.api import (db, AuditLog, success_response, error_response,
|
|
ErrorCodes, require_permission)
|
|
|
|
from .routes import computers_bp
|
|
from ..models import (ConfigurationPolicy, ConfigurationPolicyAction,
|
|
BusinessPolicy, BusinessPolicyItem, POLICY_SOURCE_LOCAL,
|
|
ACTION_MODE_DESIRED, ACTION_MODE_GATE)
|
|
from ..policyflag import policy_flag_enabled
|
|
from ..services.policyscope import validate_scope, ScopeError
|
|
|
|
_MODES = {ACTION_MODE_DESIRED, ACTION_MODE_GATE}
|
|
|
|
|
|
def _feature_gate():
|
|
"""Return a 404 response when the policy feature is off, else None."""
|
|
if not policy_flag_enabled():
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Policy feature is not enabled', http_code=404)
|
|
return None
|
|
|
|
|
|
def _known_actions():
|
|
"""The code-level allowlist of action names a policy may reference."""
|
|
from plugins.endpoints.commands import COMMAND_ALLOWLIST
|
|
return set(COMMAND_ALLOWLIST.keys())
|
|
|
|
|
|
def _configpolicy_dict(policy):
|
|
data = policy.to_dict()
|
|
data['actions'] = [a.to_dict() for a in policy.actions]
|
|
return data
|
|
|
|
|
|
def _businesspolicy_dict(policy):
|
|
data = policy.to_dict()
|
|
data['items'] = [{
|
|
'businesspolicyitemid': it.businesspolicyitemid,
|
|
'configurationpolicyid': it.configurationpolicyid,
|
|
'sortorder': it.sortorder,
|
|
'name': it.configurationpolicy.name if it.configurationpolicy else None,
|
|
} for it in policy.items]
|
|
return data
|
|
|
|
|
|
# =============================================================================
|
|
# Configuration Policies
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/configuration', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_configuration_policies():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policies = ConfigurationPolicy.query.order_by(ConfigurationPolicy.name).all()
|
|
return success_response([_configpolicy_dict(p) for p in policies])
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
return success_response(_configpolicy_dict(policy))
|
|
|
|
|
|
def _apply_actions(policy, actions):
|
|
"""Replace a policy's actions from request data, validating each.
|
|
|
|
Returns an error_response on failure, else None.
|
|
"""
|
|
known = _known_actions()
|
|
policy.actions.clear()
|
|
for row in actions or []:
|
|
name = (row.get('action') or '').strip()
|
|
if name not in known:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Unknown action: {name!r}')
|
|
mode = (row.get('mode') or ACTION_MODE_GATE).strip()
|
|
if mode not in _MODES:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Unknown action mode: {mode!r}')
|
|
policy.actions.append(ConfigurationPolicyAction(
|
|
action=name,
|
|
mode=mode,
|
|
desiredstate=row.get('desiredstate'),
|
|
params=row.get('params'),
|
|
intervalminutes=row.get('intervalminutes'),
|
|
sortorder=row.get('sortorder', 0) or 0,
|
|
))
|
|
return None
|
|
|
|
|
|
@computers_bp.route('/policies/configuration', methods=['POST'])
|
|
@require_permission('computers.create')
|
|
def create_configuration_policy():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
data = request.get_json() or {}
|
|
name = (data.get('name') or '').strip()
|
|
if not name:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
|
|
if ConfigurationPolicy.query.filter_by(name=name).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Configuration policy '{name}' already exists",
|
|
http_code=409)
|
|
|
|
scope = data.get('scopejson')
|
|
if scope is not None:
|
|
try:
|
|
validate_scope(scope)
|
|
except ScopeError as exc:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Invalid scope: {exc}')
|
|
|
|
policy = ConfigurationPolicy(
|
|
name=name,
|
|
description=data.get('description'),
|
|
scopejson=scope,
|
|
source=POLICY_SOURCE_LOCAL,
|
|
)
|
|
err = _apply_actions(policy, data.get('actions'))
|
|
if err:
|
|
return err
|
|
|
|
db.session.add(policy)
|
|
AuditLog.log('created', 'ConfigurationPolicy', entityname=name)
|
|
db.session.commit()
|
|
return success_response(_configpolicy_dict(policy),
|
|
message='Configuration policy created',
|
|
http_code=201)
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['PUT'])
|
|
@require_permission('computers.edit')
|
|
def update_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
data = request.get_json() or {}
|
|
|
|
if 'name' in data:
|
|
newname = (data['name'] or '').strip()
|
|
if newname and newname != policy.name:
|
|
if ConfigurationPolicy.query.filter_by(name=newname).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Configuration policy '{newname}' already exists",
|
|
http_code=409)
|
|
policy.name = newname
|
|
if 'description' in data:
|
|
policy.description = data['description']
|
|
if 'isactive' in data:
|
|
policy.isactive = data['isactive']
|
|
if 'scopejson' in data:
|
|
scope = data['scopejson']
|
|
if scope is not None:
|
|
try:
|
|
validate_scope(scope)
|
|
except ScopeError as exc:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Invalid scope: {exc}')
|
|
policy.scopejson = scope
|
|
if 'actions' in data:
|
|
err = _apply_actions(policy, data['actions'])
|
|
if err:
|
|
return err
|
|
|
|
AuditLog.log('updated', 'ConfigurationPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(_configpolicy_dict(policy),
|
|
message='Configuration policy updated')
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['DELETE'])
|
|
@require_permission('computers.delete')
|
|
def delete_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
inuse = BusinessPolicyItem.query.filter_by(
|
|
configurationpolicyid=policy_id).count()
|
|
if inuse:
|
|
return error_response(
|
|
ErrorCodes.CONFLICT,
|
|
f'Cannot delete: used by {inuse} business policy item(s)',
|
|
http_code=409)
|
|
db.session.delete(policy)
|
|
AuditLog.log('deleted', 'ConfigurationPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(None, message='Configuration policy deleted')
|
|
|
|
|
|
# =============================================================================
|
|
# Business Policies
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/business', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_business_policies():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policies = (BusinessPolicy.query
|
|
.order_by(BusinessPolicy.priority, BusinessPolicy.businesspolicyid)
|
|
.all())
|
|
return success_response([_businesspolicy_dict(p) for p in policies])
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
return success_response(_businesspolicy_dict(policy))
|
|
|
|
|
|
def _apply_items(policy, items):
|
|
"""Replace a business policy's configuration-policy items, validating each."""
|
|
policy.items.clear()
|
|
seen = set()
|
|
for order, row in enumerate(items or []):
|
|
cpid = row.get('configurationpolicyid')
|
|
if cpid is None:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
'item requires configurationpolicyid')
|
|
if cpid in seen:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'duplicate configuration policy {cpid}')
|
|
if not db.session.get(ConfigurationPolicy, cpid):
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'unknown configuration policy {cpid}')
|
|
seen.add(cpid)
|
|
policy.items.append(BusinessPolicyItem(
|
|
configurationpolicyid=cpid,
|
|
sortorder=row.get('sortorder', order),
|
|
))
|
|
return None
|
|
|
|
|
|
@computers_bp.route('/policies/business', methods=['POST'])
|
|
@require_permission('computers.create')
|
|
def create_business_policy():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
data = request.get_json() or {}
|
|
name = (data.get('name') or '').strip()
|
|
if not name:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
|
|
if BusinessPolicy.query.filter_by(name=name).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Business policy '{name}' already exists",
|
|
http_code=409)
|
|
policy = BusinessPolicy(
|
|
name=name,
|
|
description=data.get('description'),
|
|
priority=data.get('priority', 100),
|
|
source=POLICY_SOURCE_LOCAL,
|
|
)
|
|
err = _apply_items(policy, data.get('items'))
|
|
if err:
|
|
return err
|
|
db.session.add(policy)
|
|
AuditLog.log('created', 'BusinessPolicy', entityname=name)
|
|
db.session.commit()
|
|
return success_response(_businesspolicy_dict(policy),
|
|
message='Business policy created', http_code=201)
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['PUT'])
|
|
@require_permission('computers.edit')
|
|
def update_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
data = request.get_json() or {}
|
|
if 'name' in data:
|
|
newname = (data['name'] or '').strip()
|
|
if newname and newname != policy.name:
|
|
if BusinessPolicy.query.filter_by(name=newname).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Business policy '{newname}' already exists",
|
|
http_code=409)
|
|
policy.name = newname
|
|
if 'description' in data:
|
|
policy.description = data['description']
|
|
if 'priority' in data:
|
|
policy.priority = data['priority']
|
|
if 'isactive' in data:
|
|
policy.isactive = data['isactive']
|
|
if 'items' in data:
|
|
err = _apply_items(policy, data['items'])
|
|
if err:
|
|
return err
|
|
AuditLog.log('updated', 'BusinessPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(_businesspolicy_dict(policy),
|
|
message='Business policy updated')
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['DELETE'])
|
|
@require_permission('computers.delete')
|
|
def delete_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
db.session.delete(policy)
|
|
AuditLog.log('deleted', 'BusinessPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(None, message='Business policy deleted')
|
|
|
|
|
|
# =============================================================================
|
|
# Action catalog (for the UI) and effective-policy preview
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/actions', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_policy_actions():
|
|
"""The allowlisted action names + labels a policy may reference."""
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
from plugins.endpoints.commands import COMMAND_ALLOWLIST
|
|
return success_response([
|
|
{'action': name, 'label': meta.get('label'),
|
|
'description': meta.get('description')}
|
|
for name, meta in COMMAND_ALLOWLIST.items()
|
|
])
|
|
|
|
|
|
@computers_bp.route('/policies/effective/<int:asset_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_effective_policy(asset_id: int):
|
|
"""Preview the resolved effective policy for one endpoint (debug/UI)."""
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
from ..services.policyresolver import effective_policy_for
|
|
effective = effective_policy_for(asset_id)
|
|
return success_response(effective.to_dict())
|