cd705563d0
Corporate Tools tab on PC Details, gated by endpoints.deploy and liveness. Starts already-registered scheduled tasks; the agent's ScheduledTaskPolicy allowlist remains the authority on what may actually run. Dell Command | Update split into two actions (Scan, Apply Updates) because they have very different consequences. Apply Updates carries a persistent breakglass warning in the card naming Tanium as the primary update utility, rendered between the row title and description so it is visible at all times rather than only in the confirm dialog. Destructive actions keep the typed RUN confirmation. Fix scheduledtask_run being stripped by Configuration Policy: the intersection in ALLOWED_ACTIONS_FOR dropped it on any endpoint whose effective policy was non-empty, so every Corporate Tools click failed with "not permitted by policy" regardless of the caller's role. Corporate tools are role-gated only, via POLICY_EXEMPT_ACTIONS; policy keeps authority over monitors and service/process primitives. Fix blank PC Details page: watch(detailtabs) evaluates its source during setup and read canDeploy before its const declaration, throwing a TDZ ReferenceError that aborted setup with no API request made. Mapped-drive refresh moves to the tray. SYSTEM cannot probe user-scoped drives, so the service requests a re-probe over a named event and waits for the spool collectedat stamp to advance before collecting. The probe task is registered as a ShopFloor user principal; the Users-group principal remains only as a degraded fallback since a group member cannot start it.
52 lines
1.6 KiB
Python
52 lines
1.6 KiB
Python
"""Add dellupdatesjson to endpointstates.
|
|
|
|
Stores the pending Dell Command | Update summary reported by the
|
|
shopdb-dellupdates agent utility. MEDIUMTEXT for consistency with the other
|
|
snapshot columns on this table.
|
|
|
|
Nullable with no backfill. Null means the endpoint has never reported a Dell
|
|
scan result, which is deliberately distinct from a stored payload whose status
|
|
is 'ok' with an empty list (scanned, nothing pending). The status card renders
|
|
those two states differently, so defaulting this to an empty summary would
|
|
assert every pre-existing endpoint had been scanned and found clean.
|
|
|
|
Idempotent: the column-add checks the live schema first, so a re-run and a
|
|
db.create_all() site both stay clean on strict MySQL 8.
|
|
"""
|
|
from alembic import op
|
|
|
|
import sqlalchemy as sa
|
|
|
|
|
|
# revision identifiers, used by Alembic.
|
|
revision = 'endpoints0016dellupdates'
|
|
down_revision = 'endpoints0015systemtelemetry'
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
TABLE_NAME = 'endpointstates'
|
|
|
|
COLUMN_NAME = 'dellupdatesjson'
|
|
|
|
|
|
def _has_column(table_name, column_name):
|
|
from sqlalchemy import inspect
|
|
|
|
inspector = inspect(op.get_bind())
|
|
if not inspector.has_table(table_name):
|
|
return False
|
|
return any(col['name'] == column_name
|
|
for col in inspector.get_columns(table_name))
|
|
|
|
|
|
def upgrade():
|
|
if not _has_column(TABLE_NAME, COLUMN_NAME):
|
|
op.add_column(
|
|
TABLE_NAME,
|
|
sa.Column(COLUMN_NAME, sa.Text(length=16777215), nullable=True))
|
|
|
|
|
|
def downgrade():
|
|
if _has_column(TABLE_NAME, COLUMN_NAME):
|
|
op.drop_column(TABLE_NAME, COLUMN_NAME)
|