297 lines
8.9 KiB
Python
297 lines
8.9 KiB
Python
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
from urllib.parse import urlparse
|
|
|
|
import httpx
|
|
|
|
from ..connectors.portainer import PortainerConnector
|
|
from ..core.config import settings
|
|
from ..core.redaction import redact_message
|
|
from ..db.models import JobRun
|
|
from ..services.approval_service import create_approval
|
|
from ..services.audit_logger import log_event
|
|
from ..services.job_runner import complete_job, create_job, start_job
|
|
from ..services.policy_engine import evaluate_policy
|
|
|
|
|
|
def _widefrog_health_endpoint() -> tuple[str | None, str | None]:
|
|
raw_url = str(settings.apis.get("WIDEFROG_URL") or "").strip()
|
|
if not raw_url:
|
|
return None, "missing_config"
|
|
|
|
candidate = (
|
|
raw_url if raw_url.startswith(("http://", "https://")) else f"http://{raw_url}"
|
|
)
|
|
try:
|
|
parsed = urlparse(candidate)
|
|
except Exception:
|
|
return None, "invalid_widefrog_url"
|
|
|
|
host = parsed.hostname
|
|
if not host:
|
|
return None, "invalid_widefrog_url"
|
|
|
|
port = parsed.port or 1207
|
|
return f"{parsed.scheme}://{host}:{port}/", None
|
|
|
|
|
|
def _widefrog_health_check() -> dict[str, Any]:
|
|
health_url, reason = _widefrog_health_endpoint()
|
|
if not health_url:
|
|
return {"status": "error", "reason": reason or "missing_config"}
|
|
|
|
try:
|
|
with httpx.Client(timeout=4.0, verify=settings.verify_tls) as client:
|
|
response = client.get(health_url)
|
|
except (httpx.RequestError, ValueError) as exc:
|
|
return {"status": "error", "reason": redact_message(str(exc))}
|
|
|
|
if response.status_code >= 500:
|
|
return {
|
|
"status": "error",
|
|
"reason": f"widefrog health check failed: HTTP {response.status_code}",
|
|
}
|
|
if response.status_code >= 400:
|
|
return {
|
|
"status": "warning",
|
|
"reason": f"widefrog health returned HTTP {response.status_code}",
|
|
}
|
|
|
|
return {"status": "ok"}
|
|
|
|
|
|
def _format_success_result(
|
|
summary: str,
|
|
*,
|
|
steps: list[str] | None = None,
|
|
before_state: dict[str, Any] | None = None,
|
|
after_state: dict[str, Any] | None = None,
|
|
post_checks: list[str] | None = None,
|
|
) -> dict[str, Any]:
|
|
return {
|
|
"success": True,
|
|
"decision": "allowed",
|
|
"status": "success",
|
|
"policy_decision": "allowed",
|
|
"result": "success",
|
|
"message": summary,
|
|
"plan": steps or [],
|
|
"steps": steps or [],
|
|
"before_state": before_state or {},
|
|
"after_state": after_state or {},
|
|
"post_checks": post_checks or [],
|
|
}
|
|
|
|
|
|
def _format_blocked_result(audit_id: str, reason: str) -> dict[str, Any]:
|
|
return {
|
|
"success": False,
|
|
"decision": "blocked",
|
|
"status": "failed",
|
|
"policy_decision": "blocked",
|
|
"result": "blocked",
|
|
"message": reason,
|
|
"auditId": audit_id,
|
|
}
|
|
|
|
|
|
def _format_approval_result(
|
|
audit_id: str, approval_id: str, reason: str
|
|
) -> dict[str, Any]:
|
|
return {
|
|
"success": False,
|
|
"decision": "approval_required",
|
|
"status": "failed",
|
|
"policy_decision": "approval_required",
|
|
"result": "approval_required",
|
|
"message": reason,
|
|
"approvalId": approval_id,
|
|
"auditId": audit_id,
|
|
}
|
|
|
|
|
|
def execute_container_restart(
|
|
*,
|
|
session,
|
|
action: str,
|
|
target: str,
|
|
source: str = "manual",
|
|
risk: str = "medium",
|
|
steps: list[str] | None = None,
|
|
approved: bool = False,
|
|
policy_override: dict[str, Any] | None = None,
|
|
):
|
|
plan_steps = steps or [
|
|
"Resolve container",
|
|
"Restart container",
|
|
"Post-check health",
|
|
]
|
|
if policy_override is not None:
|
|
decision = {
|
|
"decision": str(policy_override.get("decision") or "blocked"),
|
|
"reason": str(policy_override.get("reason") or "Policy override."),
|
|
"risk": str(policy_override.get("risk") or risk),
|
|
}
|
|
elif approved:
|
|
decision = {
|
|
"decision": "allowed",
|
|
"reason": "Exact action context was approved by an AppOps operator.",
|
|
"risk": risk,
|
|
}
|
|
else:
|
|
decision = evaluate_policy(session, action=action, target=target, source=source)
|
|
|
|
if decision["decision"] == "blocked":
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
risk=risk,
|
|
policy_decision=decision["decision"],
|
|
reason=decision["reason"],
|
|
result="blocked",
|
|
execution_plan={"plan": plan_steps, "policyReason": decision["reason"]},
|
|
)
|
|
return _format_blocked_result(audit.id, decision["reason"])
|
|
|
|
if decision["decision"] == "approval_required":
|
|
approval = create_approval(
|
|
session,
|
|
action=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
reason=decision["reason"],
|
|
requester=source,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
risk=risk,
|
|
policy_decision=decision["decision"],
|
|
reason=decision["reason"],
|
|
result="approval_requested",
|
|
execution_plan={"plan": plan_steps, "approvalId": approval.id},
|
|
redacted_metadata={"approval_id": approval.id},
|
|
)
|
|
return _format_approval_result(
|
|
audit.id, approval.id, "Action requires approval before execution."
|
|
)
|
|
|
|
# Allowed restart flow
|
|
job: JobRun = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision=decision["decision"],
|
|
steps=plan_steps,
|
|
)
|
|
start_job(session, job)
|
|
|
|
try:
|
|
connector = PortainerConnector()
|
|
|
|
precheck = connector.get_container_status(target)
|
|
if precheck.get("status") != "ok":
|
|
# keep execution context in logs while still allowing best-effort continuation
|
|
precheck = {
|
|
"status": "warn",
|
|
"container": {"name": target},
|
|
"reason": precheck.get("reason"),
|
|
}
|
|
|
|
restart_result = connector.restart_container(target)
|
|
if restart_result.get("status") != "ok":
|
|
raise RuntimeError(
|
|
str(restart_result.get("reason", "container_restart_failed"))
|
|
)
|
|
|
|
post_check = {"container": restart_result.get("container", target)}
|
|
if target == "widefrog":
|
|
health = _widefrog_health_check()
|
|
post_checks = [
|
|
f"widefrog health: {health.get('status')}",
|
|
f"widefrog reason: {health.get('reason', '')}".strip(),
|
|
]
|
|
post_check["widefrog_health"] = health
|
|
else:
|
|
post_checks = []
|
|
health = {}
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded",
|
|
result_summary="Container restart executed through Portainer connector.",
|
|
)
|
|
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
risk=risk,
|
|
policy_decision=decision["decision"],
|
|
reason=decision["reason"],
|
|
result="success",
|
|
execution_plan={
|
|
"plan": plan_steps,
|
|
"jobId": completed.id,
|
|
"precheck": precheck,
|
|
},
|
|
before_state=precheck,
|
|
after_state=post_check,
|
|
post_checks=health if target == "widefrog" else None,
|
|
)
|
|
|
|
result = _format_success_result(
|
|
"Container restart executed.",
|
|
steps=plan_steps,
|
|
before_state=precheck,
|
|
after_state=post_check,
|
|
post_checks=post_checks,
|
|
)
|
|
result["jobId"] = completed.id
|
|
result["auditId"] = audit.id
|
|
return result
|
|
|
|
except Exception as exc:
|
|
failed = complete_job(
|
|
session,
|
|
job,
|
|
status="failed",
|
|
result_summary=f"Container restart failed: {redact_message(str(exc))}",
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
risk=risk,
|
|
policy_decision=decision["decision"],
|
|
reason="Container restart execution failed.",
|
|
result="failed",
|
|
execution_plan={"plan": plan_steps, "jobId": failed.id},
|
|
after_state={"status": "failed", "reason": redact_message(str(exc))},
|
|
)
|
|
return {
|
|
"success": False,
|
|
"decision": "failed",
|
|
"status": "failed",
|
|
"policy_decision": decision["decision"],
|
|
"result": "failed",
|
|
"message": redact_message(str(exc)),
|
|
"jobId": failed.id,
|
|
"auditId": audit.id,
|
|
}
|