01734e5449
Default fuzzy reconcile threshold to 0 and refuse merges when digit runs differ so numbered labels like Bay 311 never bind to Bay 310. Keep edit forms from clearing saved model fields when category filtering hides untyped rows. Includes in-progress computers policy and endpoints command feature work.
407 lines
15 KiB
Python
407 lines
15 KiB
Python
"""CRUD API for Configuration and Business Policies.
|
|
|
|
Registered on computers_bp under /api/computers/policies/... Kept in its own
|
|
module so the whole policy surface can be removed by not importing it - part of
|
|
the exit gate. Every route first checks the computers_configpolicies_enabled
|
|
switch and returns 404 while it is off, so enabling/disabling the feature never
|
|
half-exposes it.
|
|
|
|
Write-time validation lives here (not in the model): scope ASTs go through
|
|
validate_scope, and action names are checked against the endpoints command
|
|
allowlist, so a bad tree or an unknown action never reaches the database.
|
|
"""
|
|
|
|
from flask import request
|
|
from flask_jwt_extended import jwt_required
|
|
|
|
from shopdb.api import (db, AuditLog, success_response, error_response,
|
|
ErrorCodes, require_permission)
|
|
|
|
from .routes import computers_bp
|
|
from ..models import (ConfigurationPolicy, ConfigurationPolicyAction,
|
|
BusinessPolicy, BusinessPolicyItem, POLICY_SOURCE_LOCAL,
|
|
ACTION_MODE_DESIRED, ACTION_MODE_GATE)
|
|
from ..policyflag import policy_flag_enabled
|
|
from ..services.policyscope import validate_scope, ScopeError
|
|
|
|
_MODES = {ACTION_MODE_DESIRED, ACTION_MODE_GATE}
|
|
|
|
|
|
def _feature_gate():
|
|
"""Return a 404 response when the policy feature is off, else None."""
|
|
if not policy_flag_enabled():
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Policy feature is not enabled', http_code=404)
|
|
return None
|
|
|
|
|
|
def _known_actions():
|
|
"""The code-level allowlist of action names a policy may reference."""
|
|
from plugins.endpoints.commands import COMMAND_ALLOWLIST
|
|
return set(COMMAND_ALLOWLIST.keys())
|
|
|
|
|
|
def _configpolicy_dict(policy):
|
|
data = policy.to_dict()
|
|
data['actions'] = [a.to_dict() for a in policy.actions]
|
|
return data
|
|
|
|
|
|
def _businesspolicy_dict(policy):
|
|
data = policy.to_dict()
|
|
data['items'] = [{
|
|
'businesspolicyitemid': it.businesspolicyitemid,
|
|
'configurationpolicyid': it.configurationpolicyid,
|
|
'sortorder': it.sortorder,
|
|
'name': it.configurationpolicy.name if it.configurationpolicy else None,
|
|
} for it in policy.items]
|
|
return data
|
|
|
|
|
|
# =============================================================================
|
|
# Configuration Policies
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/configuration', methods=['GET'])
|
|
@jwt_required(optional=True)
|
|
def list_configuration_policies():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policies = ConfigurationPolicy.query.order_by(ConfigurationPolicy.name).all()
|
|
return success_response([_configpolicy_dict(p) for p in policies])
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['GET'])
|
|
@jwt_required(optional=True)
|
|
def get_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
return success_response(_configpolicy_dict(policy))
|
|
|
|
|
|
def _apply_actions(policy, actions):
|
|
"""Replace a policy's actions from request data, validating each.
|
|
|
|
Returns an error_response on failure, else None.
|
|
"""
|
|
known = _known_actions()
|
|
policy.actions.clear()
|
|
for row in actions or []:
|
|
name = (row.get('action') or '').strip()
|
|
if name not in known:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Unknown action: {name!r}')
|
|
mode = (row.get('mode') or ACTION_MODE_GATE).strip()
|
|
if mode not in _MODES:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Unknown action mode: {mode!r}')
|
|
policy.actions.append(ConfigurationPolicyAction(
|
|
action=name,
|
|
mode=mode,
|
|
desiredstate=row.get('desiredstate'),
|
|
params=row.get('params'),
|
|
intervalminutes=row.get('intervalminutes'),
|
|
sortorder=row.get('sortorder', 0) or 0,
|
|
))
|
|
return None
|
|
|
|
|
|
@computers_bp.route('/policies/configuration', methods=['POST'])
|
|
@jwt_required()
|
|
@require_permission('computers.create')
|
|
def create_configuration_policy():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
data = request.get_json() or {}
|
|
name = (data.get('name') or '').strip()
|
|
if not name:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
|
|
if ConfigurationPolicy.query.filter_by(name=name).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Configuration policy '{name}' already exists",
|
|
http_code=409)
|
|
|
|
scope = data.get('scopejson')
|
|
if scope is not None:
|
|
try:
|
|
validate_scope(scope)
|
|
except ScopeError as exc:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Invalid scope: {exc}')
|
|
|
|
policy = ConfigurationPolicy(
|
|
name=name,
|
|
description=data.get('description'),
|
|
scopejson=scope,
|
|
source=POLICY_SOURCE_LOCAL,
|
|
)
|
|
err = _apply_actions(policy, data.get('actions'))
|
|
if err:
|
|
return err
|
|
|
|
db.session.add(policy)
|
|
AuditLog.log('created', 'ConfigurationPolicy', entityname=name)
|
|
db.session.commit()
|
|
return success_response(_configpolicy_dict(policy),
|
|
message='Configuration policy created',
|
|
http_code=201)
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['PUT'])
|
|
@jwt_required()
|
|
@require_permission('computers.edit')
|
|
def update_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
data = request.get_json() or {}
|
|
|
|
if 'name' in data:
|
|
newname = (data['name'] or '').strip()
|
|
if newname and newname != policy.name:
|
|
if ConfigurationPolicy.query.filter_by(name=newname).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Configuration policy '{newname}' already exists",
|
|
http_code=409)
|
|
policy.name = newname
|
|
if 'description' in data:
|
|
policy.description = data['description']
|
|
if 'isactive' in data:
|
|
policy.isactive = data['isactive']
|
|
if 'scopejson' in data:
|
|
scope = data['scopejson']
|
|
if scope is not None:
|
|
try:
|
|
validate_scope(scope)
|
|
except ScopeError as exc:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Invalid scope: {exc}')
|
|
policy.scopejson = scope
|
|
if 'actions' in data:
|
|
err = _apply_actions(policy, data['actions'])
|
|
if err:
|
|
return err
|
|
|
|
AuditLog.log('updated', 'ConfigurationPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(_configpolicy_dict(policy),
|
|
message='Configuration policy updated')
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['DELETE'])
|
|
@jwt_required()
|
|
@require_permission('computers.delete')
|
|
def delete_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
inuse = BusinessPolicyItem.query.filter_by(
|
|
configurationpolicyid=policy_id).count()
|
|
if inuse:
|
|
return error_response(
|
|
ErrorCodes.CONFLICT,
|
|
f'Cannot delete: used by {inuse} business policy item(s)',
|
|
http_code=409)
|
|
db.session.delete(policy)
|
|
AuditLog.log('deleted', 'ConfigurationPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(None, message='Configuration policy deleted')
|
|
|
|
|
|
# =============================================================================
|
|
# Business Policies
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/business', methods=['GET'])
|
|
@jwt_required(optional=True)
|
|
def list_business_policies():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policies = (BusinessPolicy.query
|
|
.order_by(BusinessPolicy.priority, BusinessPolicy.businesspolicyid)
|
|
.all())
|
|
return success_response([_businesspolicy_dict(p) for p in policies])
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['GET'])
|
|
@jwt_required(optional=True)
|
|
def get_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
return success_response(_businesspolicy_dict(policy))
|
|
|
|
|
|
def _apply_items(policy, items):
|
|
"""Replace a business policy's configuration-policy items, validating each."""
|
|
policy.items.clear()
|
|
seen = set()
|
|
for order, row in enumerate(items or []):
|
|
cpid = row.get('configurationpolicyid')
|
|
if cpid is None:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
'item requires configurationpolicyid')
|
|
if cpid in seen:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'duplicate configuration policy {cpid}')
|
|
if not db.session.get(ConfigurationPolicy, cpid):
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'unknown configuration policy {cpid}')
|
|
seen.add(cpid)
|
|
policy.items.append(BusinessPolicyItem(
|
|
configurationpolicyid=cpid,
|
|
sortorder=row.get('sortorder', order),
|
|
))
|
|
return None
|
|
|
|
|
|
@computers_bp.route('/policies/business', methods=['POST'])
|
|
@jwt_required()
|
|
@require_permission('computers.create')
|
|
def create_business_policy():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
data = request.get_json() or {}
|
|
name = (data.get('name') or '').strip()
|
|
if not name:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
|
|
if BusinessPolicy.query.filter_by(name=name).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Business policy '{name}' already exists",
|
|
http_code=409)
|
|
policy = BusinessPolicy(
|
|
name=name,
|
|
description=data.get('description'),
|
|
priority=data.get('priority', 100),
|
|
source=POLICY_SOURCE_LOCAL,
|
|
)
|
|
err = _apply_items(policy, data.get('items'))
|
|
if err:
|
|
return err
|
|
db.session.add(policy)
|
|
AuditLog.log('created', 'BusinessPolicy', entityname=name)
|
|
db.session.commit()
|
|
return success_response(_businesspolicy_dict(policy),
|
|
message='Business policy created', http_code=201)
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['PUT'])
|
|
@jwt_required()
|
|
@require_permission('computers.edit')
|
|
def update_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
data = request.get_json() or {}
|
|
if 'name' in data:
|
|
newname = (data['name'] or '').strip()
|
|
if newname and newname != policy.name:
|
|
if BusinessPolicy.query.filter_by(name=newname).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Business policy '{newname}' already exists",
|
|
http_code=409)
|
|
policy.name = newname
|
|
if 'description' in data:
|
|
policy.description = data['description']
|
|
if 'priority' in data:
|
|
policy.priority = data['priority']
|
|
if 'isactive' in data:
|
|
policy.isactive = data['isactive']
|
|
if 'items' in data:
|
|
err = _apply_items(policy, data['items'])
|
|
if err:
|
|
return err
|
|
AuditLog.log('updated', 'BusinessPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(_businesspolicy_dict(policy),
|
|
message='Business policy updated')
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['DELETE'])
|
|
@jwt_required()
|
|
@require_permission('computers.delete')
|
|
def delete_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
db.session.delete(policy)
|
|
AuditLog.log('deleted', 'BusinessPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(None, message='Business policy deleted')
|
|
|
|
|
|
# =============================================================================
|
|
# Action catalog (for the UI) and effective-policy preview
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/actions', methods=['GET'])
|
|
@jwt_required(optional=True)
|
|
def list_policy_actions():
|
|
"""The allowlisted action names + labels a policy may reference."""
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
from plugins.endpoints.commands import COMMAND_ALLOWLIST
|
|
return success_response([
|
|
{'action': name, 'label': meta.get('label'),
|
|
'description': meta.get('description')}
|
|
for name, meta in COMMAND_ALLOWLIST.items()
|
|
])
|
|
|
|
|
|
@computers_bp.route('/policies/effective/<int:asset_id>', methods=['GET'])
|
|
@jwt_required(optional=True)
|
|
def get_effective_policy(asset_id: int):
|
|
"""Preview the resolved effective policy for one endpoint (debug/UI)."""
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
from ..services.policyresolver import effective_policy_for
|
|
effective = effective_policy_for(asset_id)
|
|
return success_response(effective.to_dict())
|