534f179ee6
main was 16 days and 259 commits behind the line the product is actually built on, at contract 0.30.0 against 0.35.0, with no per-PC credential code at all. It was neither current nor curated - just stale. This brings it forward and, at the same time, makes it mean something: main is what a receiving site installs, and nothing else. WHAT IT CARRIES. Twelve plugins - backups, computers, endpoints, guides, knowledgebase, machines, network, notifications, printers, slides, tools, warranty - plus applications, which is manifest-less core and always ships. The only manifest dependency inside that set is endpoints on computers, and both are in it, so the closure is self-contained. WHAT IT DOES NOT. employees, geenforce, measuringtools, printedparts and usb stay on the site line. So do the Windows installer tree, the VM rehearsal helpers, the agent tooling config, one site's data loader, the internal audit and findings records, and the planner spreadsheet. 1,135 tracked files against 1,438. A REMOVAL THAT BREAKS THE APP IS NOT A REMOVAL, and two nearly shipped: deploy/site-profile-universal.json still named all seventeen plugins. It is the file docs/DEPLOY.md tells a site to provision from, so a fresh install would have failed at `flask plugin apply-profile` with PluginError - the first thing a receiving site does, broken by the branch meant to serve them. It now names the twelve that exist, and its comment says the two must agree. agent/ was never refreshed. Whoever populated this branch copied shopdb/, plugins/, frontend/ and tests/ from the site line and left the agent tree at its September state: 22 C# and PowerShell sources missing, including AgentCredentials, EnrollmentService, AgentHttpFactory and the fleet-alert client, plus one file the site line had deleted still present. The old tree is internally consistent, so it compiles, and nothing in CI builds it - every gate was green over a server that speaks enrollment and per-PC credentials to a bundled agent source that cannot. Resynced whole. DECISIONS THIS ENCODES, rather than defers: - The plugin-authoring lab builds printedparts, whose manifest depends on employees, so it could not stay. The lab remains on the site line and main ships no build-along tutorial. That is a real loss for an adopting developer and is recorded here rather than discovered later. - Recognition, Training and Recertification notifications are no longer seeded. Each splits one notification into a card per employee and renders a photo, which needs a plugin this branch does not bundle. Seeding them would offer an author a type that cannot resolve anybody. A site that installs employees gets them from that plugin's own seed. - Windows/IIS is documented as the legacy path throughout, and the README leads with Docker, because that is what a receiving site gets. The API description is regenerated for THIS branch - 347 paths and 483 operations, down from 415 and 573 - so the published contract describes what is here rather than what the site line serves. docs/CONFIG.md lost the two measuring-tool label keys the code no longer declares, which two lanes had decided opposite ways. Suite: 3124 passed, 6 skipped. Naming and style gates pass. The docs gates run rather than skip, and every index line count is derived from the file it names.
623 lines
25 KiB
Python
623 lines
25 KiB
Python
"""CRUD API for Configuration and Business Policies.
|
|
|
|
Registered on computers_bp under /api/computers/policies/... Kept in its own
|
|
module so the whole policy surface can be removed by not importing it - part of
|
|
the exit gate. Every route first checks the computers_configpolicies_enabled
|
|
switch and returns 404 while it is off, so enabling/disabling the feature never
|
|
half-exposes it.
|
|
|
|
Write-time validation lives here (not in the model): scope ASTs go through
|
|
validate_scope, and action names are checked against the endpoints command
|
|
allowlist, so a bad tree or an unknown action never reaches the database.
|
|
"""
|
|
|
|
from flask import request
|
|
|
|
from shopdb.api import (db, AuditLog, success_response, error_response,
|
|
ErrorCodes, require_permission, caller_holds)
|
|
|
|
from .routes import computers_bp
|
|
from ..models import (ConfigurationPolicy, ConfigurationPolicyAction,
|
|
BusinessPolicy, BusinessPolicyItem, POLICY_SOURCE_LOCAL,
|
|
POLICY_SOURCE_AUTOAPP, POLICY_SOURCE_SHIPPED,
|
|
ACTION_MODE_DESIRED, ACTION_MODE_GATE)
|
|
from ..policyflag import policy_flag_enabled
|
|
from ..services.apppolicy import disown_if_generated
|
|
from ..services.policyscope import validate_scope, ScopeError
|
|
|
|
_MODES = {ACTION_MODE_DESIRED, ACTION_MODE_GATE}
|
|
|
|
|
|
def _elevated_denial(actionnames):
|
|
"""Refuse unless the caller may author every elevated action in actionnames.
|
|
|
|
A policy is a deferred instruction to run something. Gating only the enqueue
|
|
route left authoring wide open: computers.edit alone could author a policy
|
|
carrying run_script and let the agent execute it, which is the whole point of
|
|
splitting the big four undone. The permission to CAUSE an action must be the
|
|
same permission required to RUN it.
|
|
|
|
caller_holds, not current_user.haspermission: a scoped personal token is a
|
|
narrower caller than its owner, and asking the owner is the exact bypass
|
|
require_permission exists to prevent.
|
|
"""
|
|
from plugins.endpoints.commands import elevated_permission_for
|
|
|
|
missing = []
|
|
for name in sorted(set(actionnames)):
|
|
elevated = elevated_permission_for(name)
|
|
if elevated and not caller_holds(elevated) and elevated not in missing:
|
|
missing.append(elevated)
|
|
if not missing:
|
|
return None
|
|
return error_response(
|
|
ErrorCodes.FORBIDDEN,
|
|
'This policy carries actions you may not author. Missing: '
|
|
+ ', '.join(missing),
|
|
http_code=403)
|
|
|
|
|
|
def _requested_actionnames(actions):
|
|
return [(row.get('action') or '').strip() for row in actions or []]
|
|
|
|
|
|
def _policy_actionnames(policy):
|
|
return [a.action for a in policy.actions]
|
|
|
|
|
|
def _composed_actionnames(configpolicyids):
|
|
"""Every action reachable through a set of configuration policies.
|
|
|
|
Composition is an authoring act: adding a configuration policy to a business
|
|
policy causes its actions to run on everything the business policy targets,
|
|
without the composer ever naming those actions.
|
|
"""
|
|
names = []
|
|
for cpid in configpolicyids:
|
|
policy = db.session.get(ConfigurationPolicy, cpid)
|
|
if policy:
|
|
names.extend(_policy_actionnames(policy))
|
|
return names
|
|
|
|
|
|
def _changes_effect(data, policy=None):
|
|
"""Whether this payload changes WHAT a policy does, rather than how it reads.
|
|
|
|
Scope widening, reactivation, priority and composition all change the effect
|
|
of an already-authored action without touching the action list, so gating the
|
|
action payload alone would leave every one of them open. Renaming a policy or
|
|
editing its description changes nothing that runs, so it stays ungated.
|
|
"""
|
|
for field in ('actions', 'items', 'scopejson', 'priority'):
|
|
if field in data:
|
|
return True
|
|
if 'isactive' in data:
|
|
# Only reactivation matters. Deactivating a policy cannot widen anything,
|
|
# and refusing it would strand a live policy nobody present can switch off.
|
|
was = getattr(policy, 'isactive', False) if policy is not None else False
|
|
return bool(data['isactive']) and not was
|
|
return False
|
|
|
|
|
|
def _feature_gate():
|
|
"""Return a 404 response when the policy feature is off, else None."""
|
|
if not policy_flag_enabled():
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Policy feature is not enabled', http_code=404)
|
|
return None
|
|
|
|
|
|
def _known_actions():
|
|
"""The code-level allowlist of action names a policy may reference."""
|
|
from plugins.endpoints.commands import COMMAND_ALLOWLIST
|
|
return set(COMMAND_ALLOWLIST.keys())
|
|
|
|
|
|
def _is_valid_action(name):
|
|
"""True when an action name is either an allowlisted command or a monitor
|
|
attachment (monitor:<id>) pointing at an existing monitor definition.
|
|
|
|
Monitor actions are intentionally kept out of the command allowlist so they
|
|
are never enqueued as commands; they are only valid as policy attachments.
|
|
"""
|
|
if name in _known_actions():
|
|
return True
|
|
from plugins.endpoints.commands import monitor_id_from_action
|
|
from plugins.endpoints.models import EndpointMonitor
|
|
monitorid = monitor_id_from_action(name)
|
|
if monitorid is None:
|
|
return False
|
|
return db.session.get(EndpointMonitor, monitorid) is not None
|
|
|
|
|
|
def _configpolicy_dict(policy):
|
|
data = policy.to_dict()
|
|
data['actions'] = [a.to_dict() for a in policy.actions]
|
|
return data
|
|
|
|
|
|
def _businesspolicy_dict(policy):
|
|
data = policy.to_dict()
|
|
data['items'] = [{
|
|
'businesspolicyitemid': it.businesspolicyitemid,
|
|
'configurationpolicyid': it.configurationpolicyid,
|
|
'sortorder': it.sortorder,
|
|
'name': it.configurationpolicy.name if it.configurationpolicy else None,
|
|
} for it in policy.items]
|
|
return data
|
|
|
|
|
|
# =============================================================================
|
|
# Configuration Policies
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/configuration', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_configuration_policies():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policies = ConfigurationPolicy.query.order_by(ConfigurationPolicy.name).all()
|
|
return success_response([_configpolicy_dict(p) for p in policies])
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
return success_response(_configpolicy_dict(policy))
|
|
|
|
|
|
def _apply_actions(policy, actions):
|
|
"""Replace a policy's actions from request data, validating each.
|
|
|
|
Returns an error_response on failure, else None.
|
|
"""
|
|
policy.actions.clear()
|
|
# Flush the deletes before re-appending. The (configurationpolicyid, action)
|
|
# unique constraint collides if SQLAlchemy orders a re-added action's INSERT
|
|
# before the old row's DELETE in the same flush, which surfaces as a generic
|
|
# "value already in use" IntegrityError on an otherwise valid edit.
|
|
db.session.flush()
|
|
for row in actions or []:
|
|
name = (row.get('action') or '').strip()
|
|
if not _is_valid_action(name):
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Unknown action: {name!r}')
|
|
mode = (row.get('mode') or ACTION_MODE_GATE).strip()
|
|
if mode not in _MODES:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Unknown action mode: {mode!r}')
|
|
policy.actions.append(ConfigurationPolicyAction(
|
|
action=name,
|
|
mode=mode,
|
|
desiredstate=row.get('desiredstate'),
|
|
params=row.get('params'),
|
|
intervalminutes=row.get('intervalminutes'),
|
|
sortorder=row.get('sortorder', 0) or 0,
|
|
))
|
|
return None
|
|
|
|
|
|
@computers_bp.route('/policies/configuration', methods=['POST'])
|
|
@require_permission('computers.create')
|
|
def create_configuration_policy():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
data = request.get_json() or {}
|
|
name = (data.get('name') or '').strip()
|
|
if not name:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
|
|
if ConfigurationPolicy.query.filter_by(name=name).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Configuration policy '{name}' already exists",
|
|
http_code=409)
|
|
|
|
scope = data.get('scopejson')
|
|
if scope is not None:
|
|
try:
|
|
validate_scope(scope)
|
|
except ScopeError as exc:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Invalid scope: {exc}')
|
|
|
|
denial = _elevated_denial(_requested_actionnames(data.get('actions')))
|
|
if denial:
|
|
return denial
|
|
|
|
policy = ConfigurationPolicy(
|
|
name=name,
|
|
description=data.get('description'),
|
|
scopejson=scope,
|
|
source=POLICY_SOURCE_LOCAL,
|
|
)
|
|
err = _apply_actions(policy, data.get('actions'))
|
|
if err:
|
|
return err
|
|
|
|
db.session.add(policy)
|
|
AuditLog.log('created', 'ConfigurationPolicy', entityname=name)
|
|
db.session.commit()
|
|
return success_response(_configpolicy_dict(policy),
|
|
message='Configuration policy created',
|
|
http_code=201)
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['PUT'])
|
|
@require_permission('computers.edit')
|
|
def update_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
# An autoapp row is generated from an Application's "Required on all PCs"
|
|
# checkbox and IS editable: editing it is precisely how an admin takes
|
|
# ownership. A shipped row is editable for the same reason - the product
|
|
# ships a starting point, not an opinion about one site's floor - and keeps
|
|
# source='shipped' so provenance survives the edit. Genuinely external
|
|
# sources (a future managed owner) stay read-only.
|
|
if policy.source not in (POLICY_SOURCE_LOCAL, POLICY_SOURCE_AUTOAPP,
|
|
POLICY_SOURCE_SHIPPED):
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
data = request.get_json() or {}
|
|
|
|
# Both sides. The incoming actions are what the caller is asking to cause;
|
|
# the existing ones are what a scope widening or reactivation would newly
|
|
# unleash on machines that were never in range before.
|
|
if _changes_effect(data, policy):
|
|
names = list(_policy_actionnames(policy))
|
|
if 'actions' in data:
|
|
names.extend(_requested_actionnames(data['actions']))
|
|
denial = _elevated_denial(names)
|
|
if denial:
|
|
return denial
|
|
|
|
if 'name' in data:
|
|
newname = (data['name'] or '').strip()
|
|
if newname and newname != policy.name:
|
|
if ConfigurationPolicy.query.filter_by(name=newname).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Configuration policy '{newname}' already exists",
|
|
http_code=409)
|
|
policy.name = newname
|
|
if 'description' in data:
|
|
policy.description = data['description']
|
|
if 'isactive' in data:
|
|
policy.isactive = data['isactive']
|
|
if 'scopejson' in data:
|
|
scope = data['scopejson']
|
|
if scope is not None:
|
|
try:
|
|
validate_scope(scope)
|
|
except ScopeError as exc:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'Invalid scope: {exc}')
|
|
policy.scopejson = scope
|
|
if 'actions' in data:
|
|
err = _apply_actions(policy, data['actions'])
|
|
if err:
|
|
return err
|
|
|
|
# Hand-editing a generated policy transfers ownership: from here on the
|
|
# application checkbox will not delete it, it will warn instead.
|
|
disown_if_generated(policy)
|
|
|
|
AuditLog.log('updated', 'ConfigurationPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(_configpolicy_dict(policy),
|
|
message='Configuration policy updated')
|
|
|
|
|
|
@computers_bp.route('/policies/configuration/<int:policy_id>', methods=['DELETE'])
|
|
@require_permission('computers.delete')
|
|
def delete_configuration_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(ConfigurationPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Configuration policy not found', http_code=404)
|
|
# As with update: a generated or shipped row is the site's to remove, an
|
|
# externally managed one is not. A site that does not run MTConnect should
|
|
# be able to delete its monitor policy outright rather than carry it.
|
|
if policy.source not in (POLICY_SOURCE_LOCAL, POLICY_SOURCE_AUTOAPP,
|
|
POLICY_SOURCE_SHIPPED):
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
inuse = BusinessPolicyItem.query.filter_by(
|
|
configurationpolicyid=policy_id).count()
|
|
if inuse:
|
|
return error_response(
|
|
ErrorCodes.CONFLICT,
|
|
f'Cannot delete: used by {inuse} business policy item(s)',
|
|
http_code=409)
|
|
# Deleting a gate policy REMOVES a restriction, so it changes what endpoints
|
|
# will run just as surely as authoring one does.
|
|
denial = _elevated_denial(_policy_actionnames(policy))
|
|
if denial:
|
|
return denial
|
|
db.session.delete(policy)
|
|
AuditLog.log('deleted', 'ConfigurationPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(None, message='Configuration policy deleted')
|
|
|
|
|
|
# =============================================================================
|
|
# Business Policies
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/business', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_business_policies():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policies = (BusinessPolicy.query
|
|
.order_by(BusinessPolicy.priority, BusinessPolicy.businesspolicyid)
|
|
.all())
|
|
return success_response([_businesspolicy_dict(p) for p in policies])
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
return success_response(_businesspolicy_dict(policy))
|
|
|
|
|
|
def _apply_items(policy, items):
|
|
"""Replace a business policy's configuration-policy items, validating each."""
|
|
policy.items.clear()
|
|
# Flush the deletes before re-appending so the (businesspolicyid,
|
|
# configurationpolicyid) unique constraint does not collide with a re-added
|
|
# item whose INSERT would otherwise race ahead of the old row's DELETE.
|
|
db.session.flush()
|
|
seen = set()
|
|
for order, row in enumerate(items or []):
|
|
cpid = row.get('configurationpolicyid')
|
|
if cpid is None:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
'item requires configurationpolicyid')
|
|
if cpid in seen:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'duplicate configuration policy {cpid}')
|
|
if not db.session.get(ConfigurationPolicy, cpid):
|
|
return error_response(ErrorCodes.VALIDATION_ERROR,
|
|
f'unknown configuration policy {cpid}')
|
|
seen.add(cpid)
|
|
policy.items.append(BusinessPolicyItem(
|
|
configurationpolicyid=cpid,
|
|
sortorder=row.get('sortorder', order),
|
|
))
|
|
return None
|
|
|
|
|
|
@computers_bp.route('/policies/business', methods=['POST'])
|
|
@require_permission('computers.create')
|
|
def create_business_policy():
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
data = request.get_json() or {}
|
|
name = (data.get('name') or '').strip()
|
|
if not name:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR, 'name is required')
|
|
if BusinessPolicy.query.filter_by(name=name).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Business policy '{name}' already exists",
|
|
http_code=409)
|
|
policy = BusinessPolicy(
|
|
name=name,
|
|
description=data.get('description'),
|
|
priority=data.get('priority', 100),
|
|
source=POLICY_SOURCE_LOCAL,
|
|
)
|
|
requested = [row.get('configurationpolicyid')
|
|
for row in data.get('items') or []]
|
|
denial = _elevated_denial(_composed_actionnames(
|
|
[cpid for cpid in requested if cpid is not None]))
|
|
if denial:
|
|
return denial
|
|
err = _apply_items(policy, data.get('items'))
|
|
if err:
|
|
return err
|
|
db.session.add(policy)
|
|
AuditLog.log('created', 'BusinessPolicy', entityname=name)
|
|
db.session.commit()
|
|
return success_response(_businesspolicy_dict(policy),
|
|
message='Business policy created', http_code=201)
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['PUT'])
|
|
@require_permission('computers.edit')
|
|
def update_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
data = request.get_json() or {}
|
|
|
|
# Composition is the quiet escalation: attaching a configuration policy runs
|
|
# its actions everywhere this business policy reaches, without the composer
|
|
# naming a single one of them.
|
|
if _changes_effect(data, policy):
|
|
cpids = [it.configurationpolicyid for it in policy.items]
|
|
for row in data.get('items') or []:
|
|
cpid = row.get('configurationpolicyid')
|
|
if cpid is not None:
|
|
cpids.append(cpid)
|
|
denial = _elevated_denial(_composed_actionnames(cpids))
|
|
if denial:
|
|
return denial
|
|
|
|
if 'name' in data:
|
|
newname = (data['name'] or '').strip()
|
|
if newname and newname != policy.name:
|
|
if BusinessPolicy.query.filter_by(name=newname).first():
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
f"Business policy '{newname}' already exists",
|
|
http_code=409)
|
|
policy.name = newname
|
|
if 'description' in data:
|
|
policy.description = data['description']
|
|
if 'priority' in data:
|
|
policy.priority = data['priority']
|
|
if 'isactive' in data:
|
|
policy.isactive = data['isactive']
|
|
if 'items' in data:
|
|
err = _apply_items(policy, data['items'])
|
|
if err:
|
|
return err
|
|
AuditLog.log('updated', 'BusinessPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(_businesspolicy_dict(policy),
|
|
message='Business policy updated')
|
|
|
|
|
|
@computers_bp.route('/policies/business/<int:policy_id>', methods=['DELETE'])
|
|
@require_permission('computers.delete')
|
|
def delete_business_policy(policy_id: int):
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
policy = db.session.get(BusinessPolicy, policy_id)
|
|
if not policy:
|
|
return error_response(ErrorCodes.NOT_FOUND,
|
|
'Business policy not found', http_code=404)
|
|
if policy.source != POLICY_SOURCE_LOCAL:
|
|
return error_response(ErrorCodes.CONFLICT,
|
|
'Policy is managed externally and is read-only',
|
|
http_code=409)
|
|
denial = _elevated_denial(_composed_actionnames(
|
|
[it.configurationpolicyid for it in policy.items]))
|
|
if denial:
|
|
return denial
|
|
db.session.delete(policy)
|
|
AuditLog.log('deleted', 'BusinessPolicy', entityname=policy.name)
|
|
db.session.commit()
|
|
return success_response(None, message='Business policy deleted')
|
|
|
|
|
|
# =============================================================================
|
|
# Action catalog (for the UI) and effective-policy preview
|
|
# =============================================================================
|
|
|
|
@computers_bp.route('/policies/actions', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def list_policy_actions():
|
|
"""The allowlisted action names + labels a policy may reference.
|
|
|
|
Returns command actions tagged kind='command'. Monitor attachments are not
|
|
listed here: the UI builds that branch from the endpoints monitor catalog
|
|
(endpointsApi.monitors) so newly created monitors appear without a reload.
|
|
|
|
Actions the caller may not author are marked rather than hidden. Hiding them
|
|
would make the editor look like the capability does not exist; marking them
|
|
says it exists and is not yours, which is the difference between a confusing
|
|
UI and an honest one. The authoring gate is enforced server-side regardless.
|
|
"""
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
from plugins.endpoints.commands import (COMMAND_ALLOWLIST,
|
|
elevated_permission_for)
|
|
catalog = []
|
|
for name, meta in COMMAND_ALLOWLIST.items():
|
|
elevated = elevated_permission_for(name)
|
|
catalog.append({
|
|
'action': name,
|
|
'label': meta.get('label'),
|
|
'description': meta.get('description'),
|
|
'kind': 'command',
|
|
'requiredpermission': elevated,
|
|
'mayauthor': not elevated or caller_holds(elevated),
|
|
})
|
|
return success_response(catalog)
|
|
|
|
|
|
@computers_bp.route('/policies/effective/<int:asset_id>', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def get_effective_policy(asset_id: int):
|
|
"""Preview the resolved effective policy for one endpoint (debug/UI)."""
|
|
gate = _feature_gate()
|
|
if gate:
|
|
return gate
|
|
from ..services.policyresolver import effective_policy_for
|
|
effective = effective_policy_for(asset_id)
|
|
return success_response(effective.to_dict())
|
|
|
|
|
|
@computers_bp.route('/asset/<int:asset_id>/policypanel', methods=['GET'])
|
|
@require_permission('computers.view')
|
|
def policy_panel(asset_id: int):
|
|
"""Keyvalue panel: which policy governs this endpoint, and what it allows.
|
|
|
|
Provenance, not a control. It matters because the effective policy already
|
|
narrows the command allowlist, so it is the answer to "why is Start greyed
|
|
out on this PC" - which is otherwise invisible.
|
|
|
|
Returns an EMPTY field list rather than the feature-gate 404 when the
|
|
feature is off. The panel contract hides a card with no fields; an error
|
|
would render a broken card on every site that has not enabled policies,
|
|
which is most of them.
|
|
"""
|
|
if not policy_flag_enabled():
|
|
return success_response({'fields': []})
|
|
|
|
from ..services.policyresolver import effective_policy_for
|
|
effective = effective_policy_for(asset_id)
|
|
actions = effective.to_dict()
|
|
if not actions:
|
|
return success_response({'fields': []})
|
|
|
|
# One endpoint resolves through one winning business policy, but read the
|
|
# ids off the actions rather than assuming: a fold can draw from more than
|
|
# one configuration policy.
|
|
businesspolicyids = {a['businesspolicyid'] for a in actions.values()
|
|
if a.get('businesspolicyid')}
|
|
configpolicyids = {a['configurationpolicyid'] for a in actions.values()
|
|
if a.get('configurationpolicyid')}
|
|
|
|
names = []
|
|
if businesspolicyids:
|
|
names = [p.name for p in BusinessPolicy.query
|
|
.filter(BusinessPolicy.businesspolicyid.in_(businesspolicyids)).all()]
|
|
|
|
gated = sum(1 for a in actions.values() if a.get('mode') == ACTION_MODE_GATE)
|
|
desired = sum(1 for a in actions.values() if a.get('mode') == ACTION_MODE_DESIRED)
|
|
|
|
fields = []
|
|
if names:
|
|
fields.append({'label': 'Policy', 'value': ', '.join(sorted(names))})
|
|
fields.append({'label': 'Configuration policies', 'value': str(len(configpolicyids))})
|
|
fields.append({'label': 'Allowed actions', 'value': str(gated)})
|
|
fields.append({'label': 'Desired state', 'value': str(desired)})
|
|
return success_response({'fields': fields})
|