8f115ca330
The product shipped one Configuration Policy carrying every shopfloor app monitor, wrapped in a shipped Site Policy that applied it to every endpoint. That bundled two decisions a site cannot separate: which monitors exist, and which endpoints get them. A site that wanted eDNC on one PC type and MTConnect on another had to delete the shipped policy and rebuild both halves. Ship one Configuration Policy per monitor with no PC type attribution, and stop shipping a Site Policy at all. Composition is a site decision; the product now supplies parts, not an assembled opinion. Shipped Configuration Policies become editable and deletable. Provenance stays a source tag rather than a lock, which is safe because seeding is insert-if- absent and no reconciling seeder exists, so a site edit is never stomped. The stale comments claiming shipped rows were read-only and reconciled described behavior the code never had.
623 lines
25 KiB
Python
623 lines
25 KiB
Python
"""CRUD API for Configuration and Business Policies.
|
|
|
|
Registered on computers_bp under /api/computers/policies/... Kept in its own
|
|
module so the whole policy surface can be removed by not importing it - part of
|
|
the exit gate. Every route first checks the computers_configpolicies_enabled
|
|
switch and returns 404 while it is off, so enabling/disabling the feature never
|
|
half-exposes it.
|
|
|
|
Write-time validation lives here (not in the model): scope ASTs go through
|
|
validate_scope, and action names are checked against the endpoints command
|
|
allowlist, so a bad tree or an unknown action never reaches the database.
|
|
"""
|
|
|
|
from flask import request
|
|
|
|
from shopdb.api import (db, AuditLog, success_response, error_response,
|
|
ErrorCodes, require_permission, caller_holds)
|
|
|
|
from .routes import computers_bp
|
|
from ..models import (ConfigurationPolicy, ConfigurationPolicyAction,
|
|
BusinessPolicy, BusinessPolicyItem, POLICY_SOURCE_LOCAL,
|
|
POLICY_SOURCE_AUTOAPP, POLICY_SOURCE_SHIPPED,
|
|
ACTION_MODE_DESIRED, ACTION_MODE_GATE)
|
|
from ..policyflag import policy_flag_enabled
|
|
from ..services.apppolicy import disown_if_generated
|
|
from ..services.policyscope import validate_scope, ScopeError
|
|
|
|
_MODES = {ACTION_MODE_DESIRED, ACTION_MODE_GATE}
|
|
|
|
|
|
def _elevated_denial(actionnames):
|
|
"""Refuse unless the caller may author every elevated action in actionnames.
|
|
|
|
A policy is a deferred instruction to run something. Gating only the enqueue
|
|
route left authoring wide open: computers.edit alone could author a policy
|
|
carrying run_script and let the agent execute it, which is the whole point of
|
|
splitting the big four undone. The permission to CAUSE an action must be the
|
|
same permission required to RUN it.
|
|
|
|
caller_holds, not current_user.haspermission: a scoped personal token is a
|
|
narrower caller than its owner, and asking the owner is the exact bypass
|
|
require_permission exists to prevent.
|
|
"""
|
|
from plugins.endpoints.commands import elevated_permission_for
|
|
|
|
missing = []
|
|
for name in sorted(set(actionnames)):
|
|
elevated = elevated_permission_for(name)
|
|
if elevated and not caller_holds(elevated) and elevated not in missing:
|
|
missing.append(elevated)
|
|
if not missing:
|
|
return None
|
|
return error_response(
|
|
ErrorCodes.FORBIDDEN,
|
|
'This policy carries actions you may not author. Missing: '
|
|
+ ', '.join(missing),
|
|
http_code=403)
|
|
|
|
|
|
def _requested_actionnames(actions):
|
|
return [(row.get('action') or '').strip() for row in actions or []]
|
|
|
|
|
|
def _policy_actionnames(policy):
|
|
return [a.action for a in policy.actions]
|
|
|
|
|
|
def _composed_actionnames(configpolicyids):
|
|
"""Every action reachable through a set of configuration policies.
|
|
|
|
Composition is an authoring act: adding a configuration policy to a business
|
|
policy causes its actions to run on everything the business policy targets,
|
|
without the composer ever naming those actions.
|
|
"""
|
|
names = []
|
|
for cpid in configpolicyids:
|
|
policy = db.session.get(ConfigurationPolicy, cpid)
|
|
if policy:
|
|
names.extend(_policy_actionnames(policy))
|
|
return names
|
|
|
|
|
|
def _changes_effect(data, policy=None):
|
|
"""Whether this payload changes WHAT a policy does, rather than how it reads.
|
|
|
|
Scope widening, reactivation, priority and composition all change the effect
|
|
of an already-authored action without touching the action list, so gating the
|
|
action payload alone would leave every one of them open. Renaming a policy or
|
|
editing its description changes nothing that runs, so it stays ungated.
|
|
"""
|
|
for field in ('actions', 'items', 'scopejson', 'priority'):
|
|
if field in data:
|
|
return True
|
|
if 'isactive' in data:
|
|
# Only reactivation matters. Deactivating a policy cannot widen anything,
|
|
# and refusing it would strand a live policy nobody present can switch off.
|
|
was = getattr(policy, 'isactive', False) if policy is not None else False
|
|
return bool(data['isactive']) and not was
|
|
return False
|
|
|
|
|
|
def _feature_gate():
|
|
"""Return a 404 response when the policy feature is off, else None."""
|
|
if not policy_flag_enabled():
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Policy feature is not enabled', http_code=404)
|
|
return None
|
|
|
|
|
|
def _known_actions():
|
|
"""The code-level allowlist of action names a policy may reference."""
|
|
from plugins.endpoints.commands import COMMAND_ALLOWLIST
|
|
return set(COMMAND_ALLOWLIST.keys())
|
|
|
|
|
|
def _is_valid_action(name):
|
|
"""True when an action name is either an allowlisted command or a monitor
|
|
attachment (monitor:<id>) pointing at an existing monitor definition.
|
|
|
|
Monitor actions are intentionally kept out of the command allowlist so they
|
|
are never enqueued as commands; they are only valid as policy attachments.
|
|
"""
|
|
if name in _known_actions():
|
|
return True
|
|
from plugins.endpoints.commands import monitor_id_from_action
|
|
from plugins.endpoints.models import EndpointMonitor
|
|
monitorid = monitor_id_from_action(name)
|
|
if monitorid is None:
|
|
return False
|
|
return db.session.get(EndpointMonitor, monitorid) is not None
|
|
|
|
|
|
def _configpolicy_dict(policy):
|
|
data = policy.to_dict()
|
|
data['actions'] = [a.to_dict() for a in policy.actions]
|
|
return data
|
|
|
|
|
|
def _businesspolicy_dict(policy):
|
|
data = policy.to_dict()
|
|
data['items'] = [{
|
|
'businesspolicyitemid': it.businesspolicyitemid,
|
|
'configurationpolicyid': it.configurationpolicyid,
|
|
'sortorder': it.sortorder,
|
|
'name': it.configurationpolicy.name if it.configurationpolicy else None,
|
|
} for it in policy.items]
|
|
return data
|
|
|
|
|
|
# =============================================================================
|
|
# Configuration Policies
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/configuration', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_configuration_policies():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policies = ConfigurationPolicy.query.order_by(ConfigurationPolicy.name).all()
|
|
return success_response([_configpolicy_dict(p) for p in policies])
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
return success_response(_configpolicy_dict(policy))
|
|
|
|
|
|
def _apply_actions(policy, actions):
|
|
"""Replace a policy's actions from request data, validating each.
|
|
|
|
Returns an error_response on failure, else None.
|
|
"""
|
|
policy.actions.clear()
|
|
# Flush the deletes before re-appending. The (configurationpolicyid, action)
|
|
# unique constraint collides if SQLAlchemy orders a re-added action's INSERT
|
|
# before the old row's DELETE in the same flush, which surfaces as a generic
|
|
# "value already in use" IntegrityError on an otherwise valid edit.
|
|
db.session.flush()
|
|
for row in actions or []:
|
|
name = (row.get('action') or '').strip()
|
|
if not _is_valid_action(name):
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Unknown action: {name!r}')
|
|
mode = (row.get('mode') or ACTION_MODE_GATE).strip()
|
|
if mode not in _MODES:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Unknown action mode: {mode!r}')
|
|
policy.actions.append(ConfigurationPolicyAction(
|
|
action=name,
|
|
mode=mode,
|
|
desiredstate=row.get('desiredstate'),
|
|
params=row.get('params'),
|
|
intervalminutes=row.get('intervalminutes'),
|
|
sortorder=row.get('sortorder', 0) or 0,
|
|
))
|
|
return None
|
|
|
|
|
|
@computers_bp.route('/policies/configuration', methods=['POST'])
|
|
@require_permission('computers.create')
|
|
def create_configuration_policy():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
data = request.get_json() or {}
|
|
name = (data.get('name') or '').strip()
|
|
if not name:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
|
|
if ConfigurationPolicy.query.filter_by(name=name).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Configuration policy '{name}' already exists",
|
|
http_code=409)
|
|
|
|
scope = data.get('scopejson')
|
|
if scope is not None:
|
|
try:
|
|
validate_scope(scope)
|
|
except ScopeError as exc:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Invalid scope: {exc}')
|
|
|
|
denial = _elevated_denial(_requested_actionnames(data.get('actions')))
|
|
if denial:
|
|
return denial
|
|
|
|
policy = ConfigurationPolicy(
|
|
name=name,
|
|
description=data.get('description'),
|
|
scopejson=scope,
|
|
source=POLICY_SOURCE_LOCAL,
|
|
)
|
|
err = _apply_actions(policy, data.get('actions'))
|
|
if err:
|
|
return err
|
|
|
|
db.session.add(policy)
|
|
AuditLog.log('created', 'ConfigurationPolicy', entityname=name)
|
|
db.session.commit()
|
|
return success_response(_configpolicy_dict(policy),
|
|
message='Configuration policy created',
|
|
http_code=201)
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['PUT'])
|
|
@require_permission('computers.edit')
|
|
def update_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
# An autoapp row is generated from an Application's "Required on all PCs"
|
|
# checkbox and IS editable: editing it is precisely how an admin takes
|
|
# ownership. A shipped row is editable for the same reason - the product
|
|
# ships a starting point, not an opinion about one site's floor - and keeps
|
|
# source='shipped' so provenance survives the edit. Genuinely external
|
|
# sources (a future managed owner) stay read-only.
|
|
if policy.source not in (POLICY_SOURCE_LOCAL, POLICY_SOURCE_AUTOAPP,
|
|
POLICY_SOURCE_SHIPPED):
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
data = request.get_json() or {}
|
|
|
|
# Both sides. The incoming actions are what the caller is asking to cause;
|
|
# the existing ones are what a scope widening or reactivation would newly
|
|
# unleash on machines that were never in range before.
|
|
if _changes_effect(data, policy):
|
|
names = list(_policy_actionnames(policy))
|
|
if 'actions' in data:
|
|
names.extend(_requested_actionnames(data['actions']))
|
|
denial = _elevated_denial(names)
|
|
if denial:
|
|
return denial
|
|
|
|
if 'name' in data:
|
|
newname = (data['name'] or '').strip()
|
|
if newname and newname != policy.name:
|
|
if ConfigurationPolicy.query.filter_by(name=newname).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Configuration policy '{newname}' already exists",
|
|
http_code=409)
|
|
policy.name = newname
|
|
if 'description' in data:
|
|
policy.description = data['description']
|
|
if 'isactive' in data:
|
|
policy.isactive = data['isactive']
|
|
if 'scopejson' in data:
|
|
scope = data['scopejson']
|
|
if scope is not None:
|
|
try:
|
|
validate_scope(scope)
|
|
except ScopeError as exc:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Invalid scope: {exc}')
|
|
policy.scopejson = scope
|
|
if 'actions' in data:
|
|
err = _apply_actions(policy, data['actions'])
|
|
if err:
|
|
return err
|
|
|
|
# Hand-editing a generated policy transfers ownership: from here on the
|
|
# application checkbox will not delete it, it will warn instead.
|
|
disown_if_generated(policy)
|
|
|
|
AuditLog.log('updated', 'ConfigurationPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(_configpolicy_dict(policy),
|
|
message='Configuration policy updated')
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['DELETE'])
|
|
@require_permission('computers.delete')
|
|
def delete_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
# As with update: a generated or shipped row is the site's to remove, an
|
|
# externally managed one is not. A site that does not run MTConnect should
|
|
# be able to delete its monitor policy outright rather than carry it.
|
|
if policy.source not in (POLICY_SOURCE_LOCAL, POLICY_SOURCE_AUTOAPP,
|
|
POLICY_SOURCE_SHIPPED):
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
inuse = BusinessPolicyItem.query.filter_by(
|
|
configurationpolicyid=policy_id).count()
|
|
if inuse:
|
|
return error_response(
|
|
ErrorCodes.CONFLICT,
|
|
f'Cannot delete: used by {inuse} business policy item(s)',
|
|
http_code=409)
|
|
# Deleting a gate policy REMOVES a restriction, so it changes what endpoints
|
|
# will run just as surely as authoring one does.
|
|
denial = _elevated_denial(_policy_actionnames(policy))
|
|
if denial:
|
|
return denial
|
|
db.session.delete(policy)
|
|
AuditLog.log('deleted', 'ConfigurationPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(None, message='Configuration policy deleted')
|
|
|
|
|
|
# =============================================================================
|
|
# Business Policies
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/business', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_business_policies():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policies = (BusinessPolicy.query
|
|
.order_by(BusinessPolicy.priority, BusinessPolicy.businesspolicyid)
|
|
.all())
|
|
return success_response([_businesspolicy_dict(p) for p in policies])
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
return success_response(_businesspolicy_dict(policy))
|
|
|
|
|
|
def _apply_items(policy, items):
|
|
"""Replace a business policy's configuration-policy items, validating each."""
|
|
policy.items.clear()
|
|
# Flush the deletes before re-appending so the (businesspolicyid,
|
|
# configurationpolicyid) unique constraint does not collide with a re-added
|
|
# item whose INSERT would otherwise race ahead of the old row's DELETE.
|
|
db.session.flush()
|
|
seen = set()
|
|
for order, row in enumerate(items or []):
|
|
cpid = row.get('configurationpolicyid')
|
|
if cpid is None:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
'item requires configurationpolicyid')
|
|
if cpid in seen:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'duplicate configuration policy {cpid}')
|
|
if not db.session.get(ConfigurationPolicy, cpid):
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'unknown configuration policy {cpid}')
|
|
seen.add(cpid)
|
|
policy.items.append(BusinessPolicyItem(
|
|
configurationpolicyid=cpid,
|
|
sortorder=row.get('sortorder', order),
|
|
))
|
|
return None
|
|
|
|
|
|
@computers_bp.route('/policies/business', methods=['POST'])
|
|
@require_permission('computers.create')
|
|
def create_business_policy():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
data = request.get_json() or {}
|
|
name = (data.get('name') or '').strip()
|
|
if not name:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
|
|
if BusinessPolicy.query.filter_by(name=name).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Business policy '{name}' already exists",
|
|
http_code=409)
|
|
policy = BusinessPolicy(
|
|
name=name,
|
|
description=data.get('description'),
|
|
priority=data.get('priority', 100),
|
|
source=POLICY_SOURCE_LOCAL,
|
|
)
|
|
requested = [row.get('configurationpolicyid')
|
|
for row in data.get('items') or []]
|
|
denial = _elevated_denial(_composed_actionnames(
|
|
[cpid for cpid in requested if cpid is not None]))
|
|
if denial:
|
|
return denial
|
|
err = _apply_items(policy, data.get('items'))
|
|
if err:
|
|
return err
|
|
db.session.add(policy)
|
|
AuditLog.log('created', 'BusinessPolicy', entityname=name)
|
|
db.session.commit()
|
|
return success_response(_businesspolicy_dict(policy),
|
|
message='Business policy created', http_code=201)
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['PUT'])
|
|
@require_permission('computers.edit')
|
|
def update_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
data = request.get_json() or {}
|
|
|
|
# Composition is the quiet escalation: attaching a configuration policy runs
|
|
# its actions everywhere this business policy reaches, without the composer
|
|
# naming a single one of them.
|
|
if _changes_effect(data, policy):
|
|
cpids = [it.configurationpolicyid for it in policy.items]
|
|
for row in data.get('items') or []:
|
|
cpid = row.get('configurationpolicyid')
|
|
if cpid is not None:
|
|
cpids.append(cpid)
|
|
denial = _elevated_denial(_composed_actionnames(cpids))
|
|
if denial:
|
|
return denial
|
|
|
|
if 'name' in data:
|
|
newname = (data['name'] or '').strip()
|
|
if newname and newname != policy.name:
|
|
if BusinessPolicy.query.filter_by(name=newname).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Business policy '{newname}' already exists",
|
|
http_code=409)
|
|
policy.name = newname
|
|
if 'description' in data:
|
|
policy.description = data['description']
|
|
if 'priority' in data:
|
|
policy.priority = data['priority']
|
|
if 'isactive' in data:
|
|
policy.isactive = data['isactive']
|
|
if 'items' in data:
|
|
err = _apply_items(policy, data['items'])
|
|
if err:
|
|
return err
|
|
AuditLog.log('updated', 'BusinessPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(_businesspolicy_dict(policy),
|
|
message='Business policy updated')
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['DELETE'])
|
|
@require_permission('computers.delete')
|
|
def delete_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
denial = _elevated_denial(_composed_actionnames(
|
|
[it.configurationpolicyid for it in policy.items]))
|
|
if denial:
|
|
return denial
|
|
db.session.delete(policy)
|
|
AuditLog.log('deleted', 'BusinessPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(None, message='Business policy deleted')
|
|
|
|
|
|
# =============================================================================
|
|
# Action catalog (for the UI) and effective-policy preview
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/actions', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_policy_actions():
|
|
"""The allowlisted action names + labels a policy may reference.
|
|
|
|
Returns command actions tagged kind='command'. Monitor attachments are not
|
|
listed here: the UI builds that branch from the endpoints monitor catalog
|
|
(endpointsApi.monitors) so newly created monitors appear without a reload.
|
|
|
|
Actions the caller may not author are marked rather than hidden. Hiding them
|
|
would make the editor look like the capability does not exist; marking them
|
|
says it exists and is not yours, which is the difference between a confusing
|
|
UI and an honest one. The authoring gate is enforced server-side regardless.
|
|
"""
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
from plugins.endpoints.commands import (COMMAND_ALLOWLIST,
|
|
elevated_permission_for)
|
|
catalog = []
|
|
for name, meta in COMMAND_ALLOWLIST.items():
|
|
elevated = elevated_permission_for(name)
|
|
catalog.append({
|
|
'action': name,
|
|
'label': meta.get('label'),
|
|
'description': meta.get('description'),
|
|
'kind': 'command',
|
|
'requiredpermission': elevated,
|
|
'mayauthor': not elevated or caller_holds(elevated),
|
|
})
|
|
return success_response(catalog)
|
|
|
|
|
|
@computers_bp.route('/policies/effective/<int:asset_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_effective_policy(asset_id: int):
|
|
"""Preview the resolved effective policy for one endpoint (debug/UI)."""
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
from ..services.policyresolver import effective_policy_for
|
|
effective = effective_policy_for(asset_id)
|
|
return success_response(effective.to_dict())
|
|
|
|
|
|
@computers_bp.route('/asset/<int:asset_id>/policypanel', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def policy_panel(asset_id: int):
|
|
"""Keyvalue panel: which policy governs this endpoint, and what it allows.
|
|
|
|
Provenance, not a control. It matters because the effective policy already
|
|
narrows the command allowlist, so it is the answer to "why is Start greyed
|
|
out on this PC" - which is otherwise invisible.
|
|
|
|
Returns an EMPTY field list rather than the feature-gate 404 when the
|
|
feature is off. The panel contract hides a card with no fields; an error
|
|
would render a broken card on every site that has not enabled policies,
|
|
which is most of them.
|
|
"""
|
|
if not policy_flag_enabled():
|
|
return success_response({'fields': []})
|
|
|
|
from ..services.policyresolver import effective_policy_for
|
|
effective = effective_policy_for(asset_id)
|
|
actions = effective.to_dict()
|
|
if not actions:
|
|
return success_response({'fields': []})
|
|
|
|
# One endpoint resolves through one winning business policy, but read the
|
|
# ids off the actions rather than assuming: a fold can draw from more than
|
|
# one configuration policy.
|
|
businesspolicyids = {a['businesspolicyid'] for a in actions.values()
|
|
if a.get('businesspolicyid')}
|
|
configpolicyids = {a['configurationpolicyid'] for a in actions.values()
|
|
if a.get('configurationpolicyid')}
|
|
|
|
names = []
|
|
if businesspolicyids:
|
|
names = [p.name for p in BusinessPolicy.query
|
|
.filter(BusinessPolicy.businesspolicyid.in_(businesspolicyids)).all()]
|
|
|
|
gated = sum(1 for a in actions.values() if a.get('mode') == ACTION_MODE_GATE)
|
|
desired = sum(1 for a in actions.values() if a.get('mode') == ACTION_MODE_DESIRED)
|
|
|
|
fields = []
|
|
if names:
|
|
fields.append({'label': 'Policy', 'value': ', '.join(sorted(names))})
|
|
fields.append({'label': 'Configuration policies', 'value': str(len(configpolicyids))})
|
|
fields.append({'label': 'Allowed actions', 'value': str(gated)})
|
|
fields.append({'label': 'Desired state', 'value': str(desired)})
|
|
return success_response({'fields': fields})
|