@optimuslabs/harness-map-staging 1.5.24 → 1.5.26

package/dist/log_config_files/runtime/remediation_sync.js

@@ -4,7 +4,7 @@ import { homedir } from 'node:os';
 import { executeBody } from '../../endpoint_client/http_transport.js';
 import { parseJsonWithJsoncFallback, parseTomlText, stringifyToml } from '../readers/file_readers.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
-import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
+import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeApprovedTenants, writeUnapprovedEmailDomains, writeAllowedEmailDomains, writeApprovedAgents, writeRemediationInstructionsFile, } from './management_storage.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
 import { ensureAuthentication } from '../auth/auth_flow.js';
 import { createSignature } from '../sender/signing.js';
@@ -1600,123 +1600,172 @@ export function reportAutofixApplied(remediationUuid, result, details) {
 // ---------------------------------------------------------------------------
 // Main entry point
 // ---------------------------------------------------------------------------
-export async function syncRemediations(endpointBase, machineUuid) {
-    let remediations = readInstructions().remediations;
-    const activeUuids = remediations.map((r) => r.uuid);
-    complianceRunnerDiag(`remediation_sync: begin endpoint=${endpointBase} machine_uuid=${machineUuid} local_rows=${remediations.length}`);
+const errorText = (err) => (err instanceof Error ? err.message : String(err));
+/** The strings in a synced list, lowercased; anything else in it is dropped. */
+function lowercaseStrings(list) {
+    return list.filter((v) => typeof v === 'string').map((v) => v.toLowerCase());
+}
+async function ensureVscdbContract(endpointBase) {
     try {
-        if (!existsSync(getFileCollectionVscdbContractPath())) {
-            const pr = await getFileCollectionPatterns(endpointBase);
-            if (pr)
-                persistVscdbComposerContractFromPatternsResponse(pr);
-        }
+        if (existsSync(getFileCollectionVscdbContractPath()))
+            return;
+        const pr = await getFileCollectionPatterns(endpointBase);
+        if (pr)
+            persistVscdbComposerContractFromPatternsResponse(pr);
     }
     catch {
         /* contract also written on full log-config run */
     }
+}
+/** The server's sync answer, or null (logged) when the request failed or came back empty. */
+async function fetchSyncResult(endpointBase, machineUuid, activeUuids) {
     let syncResult;
     try {
         syncResult = await fetchSync(endpointBase, machineUuid, activeUuids);
     }
     catch (err) {
-        const msg = `remediation_sync_error: ${err instanceof Error ? err.message : String(err)}`;
+        const msg = `remediation_sync_error: ${errorText(err)}`;
         hookRunLog(msg);
         complianceRunnerDiag(msg);
-        return;
+        return null;
     }
     if (!syncResult) {
         hookRunLog(`remediation_sync: no response from server, skipping`);
         complianceRunnerDiag('remediation_sync: no response from server (non-200 or empty body), skipping');
-        return;
     }
-    applyClearApplyTrackingUuids(syncResult.clear_apply_tracking_uuids);
-    if (syncResult.status === 'unchanged') {
-        hookRunLog(`remediation_sync: unchanged enforced=${activeUuids.length}`);
-        complianceRunnerDiag(`remediation_sync: server status=unchanged local_uuids=${activeUuids.length} — no new rows to fetch; if a deploy should exist, verify Finding.machine matches this hardware_uuid`);
-        const want = new Set(activeUuids);
-        const have = new Map(remediations.map((r) => [r.uuid, r]));
-        const needBackfill = activeUuids.some((u) => !have.has(u));
-        const haveIncomplete = remediations.some((r) => want.has(r.uuid) && needsManifestRefetch(r));
-        const haveOrphan = remediations.some((r) => !want.has(r.uuid));
-        const path = getRemediationInstructionsPath();
-        if (activeUuids.length > 0) {
-            if (needBackfill || haveIncomplete || haveOrphan || !existsSync(path)) {
-                try {
-                    await ensureInstructionsForUuids(endpointBase, machineUuid, want, null);
-                }
-                catch (err) {
-                    hookRunLog(`remediation_instructions_reconcile_error: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-        else if (remediations.length > 0) {
-            try {
-                await ensureInstructionsForUuids(endpointBase, machineUuid, new Set(), null);
-            }
-            catch (err) {
-                hookRunLog(`remediation_instructions_reconcile_error: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
+    return syncResult;
+}
+/**
+ * Kept locally so the prompt gate checks the signed-in tenant without a round trip; a failed
+ * sync never gets here and leaves the last lists in place.
+ */
+function storeApprovals(syncResult) {
+    const approvedTenants = syncResult.approved_tenants;
+    if (approvedTenants && typeof approvedTenants === 'object' && !Array.isArray(approvedTenants)) {
+        writeApprovedTenants(approvedTenants);
+    }
+    const unapprovedDomains = syncResult.unapproved_email_domains;
+    if (Array.isArray(unapprovedDomains))
+        writeUnapprovedEmailDomains(lowercaseStrings(unapprovedDomains));
+    const approvedAgents = syncResult.approved_agents;
+    if (Array.isArray(approvedAgents))
+        writeApprovedAgents(lowercaseStrings(approvedAgents));
+    const allowedDomains = syncResult.allowed_email_domains;
+    if (Array.isArray(allowedDomains))
+        writeAllowedEmailDomains(lowercaseStrings(allowedDomains));
+}
+async function reconcileInstructions(endpointBase, machineUuid, want) {
+    try {
+        await ensureInstructionsForUuids(endpointBase, machineUuid, want, null);
+    }
+    catch (err) {
+        hookRunLog(`remediation_instructions_reconcile_error: ${errorText(err)}`);
+    }
+}
+/** Server says nothing changed: still repair a local file that is missing rows, incomplete or stale. */
+async function reconcileUnchanged(endpointBase, machineUuid, remediations, activeUuids) {
+    hookRunLog(`remediation_sync: unchanged enforced=${activeUuids.length}`);
+    complianceRunnerDiag(`remediation_sync: server status=unchanged local_uuids=${activeUuids.length} — no new rows to fetch; if a deploy should exist, verify Finding.machine matches this hardware_uuid`);
+    const want = new Set(activeUuids);
+    if (activeUuids.length === 0) {
+        if (remediations.length > 0)
+            await reconcileInstructions(endpointBase, machineUuid, new Set());
         return;
     }
-    const { added, removed } = syncResult;
-    hookRunLog(`remediation_sync: status=updated added=${added.length} removed=${removed.length}`);
-    complianceRunnerDiag(`remediation_sync: server status=updated added=${JSON.stringify(added)} removed=${JSON.stringify(removed)}`);
-    const removedSet = new Set(removed);
-    const retiredInstructions = remediations.filter((r) => removedSet.has(r.uuid));
-    let removedCount = 0;
-    remediations = remediations.filter((r) => {
-        if (removedSet.has(r.uuid)) {
-            removedCount++;
-            hookRunLog(`remediation_remove: uuid=${r.uuid} path=${r.config_file_path}`);
-            return false;
-        }
-        return true;
-    });
-    let manifest = null;
-    if (added.length > 0) {
-        try {
-            manifest = await fetchManifest(endpointBase, machineUuid, added);
-        }
-        catch (err) {
-            const msg = `remediation_manifest_error: ${err instanceof Error ? err.message : String(err)}`;
-            hookRunLog(msg);
-            complianceRunnerDiag(msg);
-            if (removedCount > 0) {
-                remediations.sort((a, b) => a.uuid.localeCompare(b.uuid));
-                writeInstructions({ remediations });
-            }
-            return;
-        }
-        if (!manifest) {
-            hookRunLog(`remediation_sync: manifest fetch failed, skipping`);
-            complianceRunnerDiag('remediation_sync: manifest fetch failed (null), skipping — remediation_instructions.json not updated');
-            if (removedCount > 0) {
-                remediations.sort((a, b) => a.uuid.localeCompare(b.uuid));
-                writeInstructions({ remediations });
-            }
-            return;
-        }
+    const have = new Map(remediations.map((r) => [r.uuid, r]));
+    const needBackfill = activeUuids.some((u) => !have.has(u));
+    const haveIncomplete = remediations.some((r) => want.has(r.uuid) && needsManifestRefetch(r));
+    const haveOrphan = remediations.some((r) => !want.has(r.uuid));
+    if (needBackfill || haveIncomplete || haveOrphan || !existsSync(getRemediationInstructionsPath())) {
+        await reconcileInstructions(endpointBase, machineUuid, want);
+    }
+}
+function writeSortedInstructions(remediations) {
+    remediations.sort((a, b) => a.uuid.localeCompare(b.uuid));
+    writeInstructions({ remediations });
+}
+/** The manifest rows for the added UUIDs; null (logged) when it could not be fetched. */
+async function fetchAddedManifest(endpointBase, machineUuid, added) {
+    let manifest;
+    try {
+        manifest = await fetchManifest(endpointBase, machineUuid, added);
+    }
+    catch (err) {
+        const msg = `remediation_manifest_error: ${errorText(err)}`;
+        hookRunLog(msg);
+        complianceRunnerDiag(msg);
+        return null;
+    }
+    if (!manifest) {
+        hookRunLog(`remediation_sync: manifest fetch failed, skipping`);
+        complianceRunnerDiag('remediation_sync: manifest fetch failed (null), skipping — remediation_instructions.json not updated');
+    }
+    return manifest;
+}
+function upsertInstruction(remediations, existingUuids, instruction) {
+    if (!existingUuids.has(instruction.uuid)) {
+        remediations.push(instruction);
+        existingUuids.add(instruction.uuid);
+        return;
     }
+    // Enforced remediations are always in `added`; overwrite local copy with fresh server data.
+    const idx = remediations.findIndex((r) => r.uuid === instruction.uuid);
+    if (idx >= 0)
+        remediations[idx] = instruction;
+}
+/** Put the manifest's added rows into `remediations` (replacing a local copy); returns the rows put in. */
+function mergeAddedInstructions(remediations, manifest, added) {
     const existingUuids = new Set(remediations.map((r) => r.uuid));
     const addedSet = new Set(added);
     const overlay = [];
-    for (const instruction of manifest ?? []) {
+    for (const instruction of manifest) {
         if (!addedSet.has(instruction.uuid))
             continue;
-        if (existingUuids.has(instruction.uuid)) {
-            // Enforced remediations are always in `added`; overwrite local copy with fresh server data.
-            const idx = remediations.findIndex((r) => r.uuid === instruction.uuid);
-            if (idx >= 0)
-                remediations[idx] = instruction;
-        }
-        else {
-            remediations.push(instruction);
-            existingUuids.add(instruction.uuid);
-        }
+        upsertInstruction(remediations, existingUuids, instruction);
         overlay.push(instruction);
         hookRunLog(`remediation_instructions_saved: uuid=${instruction.uuid} path=${instruction.config_file_path}`);
     }
+    return overlay;
+}
+/** Write the merged instructions, fetch anything still missing, and report the new UUID set. */
+async function persistSyncedInstructions(endpointBase, machineUuid, remediations, overlay, removedCount) {
+    writeSortedInstructions(remediations);
+    complianceRunnerDiag(`remediation_sync: wrote ${getRemediationInstructionsPath()} rows=${remediations.length} (added_from_manifest=${overlay.length} removed=${removedCount})`);
+    const finalWant = new Set(remediations.map((r) => r.uuid));
+    try {
+        await ensureInstructionsForUuids(endpointBase, machineUuid, finalWant, overlay.length > 0 ? overlay : null);
+    }
+    catch (err) {
+        hookRunLog(`remediation_instructions_persist_error: ${errorText(err)}`);
+    }
+    // Post-sync heartbeat: report the updated UUID set so the server has a before/after pair.
+    const finalUuids = remediations.map((r) => r.uuid);
+    try {
+        await fetchSync(endpointBase, machineUuid, finalUuids);
+        hookRunLog(`remediation_sync: post-sync heartbeat reported uuids=${finalUuids.length}`);
+    }
+    catch {
+        // Non-critical — skip silently.
+    }
+}
+/** Server sent added/removed UUIDs: drop the removed, fetch and merge the added, then persist. */
+async function applySyncUpdate(endpointBase, machineUuid, local, syncResult) {
+    const { added, removed } = syncResult;
+    hookRunLog(`remediation_sync: status=updated added=${added.length} removed=${removed.length}`);
+    complianceRunnerDiag(`remediation_sync: server status=updated added=${JSON.stringify(added)} removed=${JSON.stringify(removed)}`);
+    const removedSet = new Set(removed);
+    const retiredInstructions = local.filter((r) => removedSet.has(r.uuid));
+    for (const r of retiredInstructions)
+        hookRunLog(`remediation_remove: uuid=${r.uuid} path=${r.config_file_path}`);
+    const removedCount = retiredInstructions.length;
+    const remediations = local.filter((r) => !removedSet.has(r.uuid));
+    const manifest = added.length > 0 ? await fetchAddedManifest(endpointBase, machineUuid, added) : [];
+    if (!manifest) {
+        if (removedCount > 0)
+            writeSortedInstructions(remediations);
+        return;
+    }
+    const overlay = mergeAddedInstructions(remediations, manifest, added);
     transferQuarantineForRetiredUuids(removed, added, retiredInstructions, overlay);
     const addedCount = overlay.length;
     if (added.length > 0 && addedCount === 0) {
@@ -1725,26 +1774,24 @@ export async function syncRemediations(endpointBase, machineUuid) {
         complianceRunnerDiag(`${msg} — remediation_instructions.json not written`);
     }
     if (removedCount > 0 || addedCount > 0) {
-        remediations.sort((a, b) => a.uuid.localeCompare(b.uuid));
-        writeInstructions({ remediations });
-        complianceRunnerDiag(`remediation_sync: wrote ${getRemediationInstructionsPath()} rows=${remediations.length} (added_from_manifest=${addedCount} removed=${removedCount})`);
-        const finalWant = new Set(remediations.map((r) => r.uuid));
-        try {
-            await ensureInstructionsForUuids(endpointBase, machineUuid, finalWant, overlay.length > 0 ? overlay : null);
-        }
-        catch (err) {
-            hookRunLog(`remediation_instructions_persist_error: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        // Post-sync heartbeat: report the updated UUID set so the server has a before/after pair.
-        const finalUuids = remediations.map((r) => r.uuid);
-        try {
-            await fetchSync(endpointBase, machineUuid, finalUuids);
-            hookRunLog(`remediation_sync: post-sync heartbeat reported uuids=${finalUuids.length}`);
-        }
-        catch {
-            // Non-critical — skip silently.
-        }
+        await persistSyncedInstructions(endpointBase, machineUuid, remediations, overlay, removedCount);
     }
     hookRunLog(`remediation_sync: saved=${addedCount} removed=${removedCount}`);
     complianceRunnerDiag(`remediation_sync: done saved=${addedCount} removed=${removedCount}`);
 }
+export async function syncRemediations(endpointBase, machineUuid) {
+    const remediations = readInstructions().remediations;
+    const activeUuids = remediations.map((r) => r.uuid);
+    complianceRunnerDiag(`remediation_sync: begin endpoint=${endpointBase} machine_uuid=${machineUuid} local_rows=${remediations.length}`);
+    await ensureVscdbContract(endpointBase);
+    const syncResult = await fetchSyncResult(endpointBase, machineUuid, activeUuids);
+    if (!syncResult)
+        return;
+    applyClearApplyTrackingUuids(syncResult.clear_apply_tracking_uuids);
+    storeApprovals(syncResult);
+    if (syncResult.status === 'unchanged') {
+        await reconcileUnchanged(endpointBase, machineUuid, remediations, activeUuids);
+        return;
+    }
+    await applySyncUpdate(endpointBase, machineUuid, remediations, syncResult);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.24",
+  "version": "1.5.26",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {