python-rac 0.2.0__py3-none-any.whl

pyrac/read_service.py

@@ -0,0 +1,831 @@
+"""Shared, bounded read-only views over the versioned RAC client."""
+from uuid import UUID
+
+from .client import RacClient
+
+# Only verified, cluster-scoped reads. No caller-supplied Python method names.
+CLUSTER_LISTS = {
+    'servers': 'list_servers',
+    'processes': 'list_processes',
+    'infobases': 'list_infobases',
+    'sessions': 'list_sessions',
+    'connections': 'list_connections',
+    'profiles': 'list_profiles',
+    'counters': 'list_counters',
+    'limits': 'list_limits',
+    'managers': 'list_managers',
+    'services': 'list_services',
+    'locks': 'list_locks',
+}
+
+SERVER_LISTS = {
+    'rules': 'list_rules',
+    'service-settings': 'list_service_settings',
+    'transfer-directories': 'list_service_data_dirs_for_transfer',
+}
+
+PROFILE_ACL_LISTS = {
+    'directory': 'list_profile_directories',
+    'com': 'list_profile_com_classes',
+    'addin': 'list_profile_addins',
+    'module': 'list_profile_modules',
+    'app': 'list_profile_apps',
+    'inet': 'list_profile_inet',
+}
+
+
+class ReadService:
+    PRIVATE_FIELDS = frozenset({'password', 'db_password', 'permission_code',
+                                'denied_parameter', 'external_connection_string'})
+
+    @staticmethod
+    def public_row(row):
+        return {key: value for key, value in row.items()
+                if key not in ReadService.PRIVATE_FIELDS}
+
+    @staticmethod
+    def public_data(value):
+        if isinstance(value, dict):
+            return {key: ReadService.public_data(item) for key, item in value.items()
+                    if key not in ReadService.PRIVATE_FIELDS}
+        if isinstance(value, list):
+            return [ReadService.public_data(item) for item in value]
+        return value
+
+    def __init__(self, factory=None):
+        self.factory = factory or RacClient
+
+    @staticmethod
+    def _search_needle(query):
+        if (not isinstance(query, str) or not query.strip() or '\x00' in query
+                or len(query) > 100 or not ReadService._valid_search_text(query)):
+            raise ValueError('Invalid search query')
+        return query.strip().casefold()
+
+    async def clusters(self):
+        async with self.factory() as client:
+            return self.public_data(await client.list_clusters())
+
+    async def search_clusters(self, query):
+        needle = self._search_needle(query)
+        matches = []
+        named = set()
+        async with self.factory() as client:
+            for row in await client.list_clusters():
+                if not isinstance(row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                name = row.get('name', '')
+                valid_name = isinstance(name, str) and self._valid_search_text(name) and bool(name.strip())
+                host = row.get('host', '')
+                valid_host = isinstance(host, str) and self._valid_search_text(host) and bool(host.strip())
+                if (needle in cluster.casefold()
+                        or valid_name and needle in name.casefold()
+                        or valid_host and needle in host.casefold()):
+                    entry = {'cluster': cluster, 'name': name if valid_name else
+                             host if valid_host and host else 'Unnamed cluster'}
+                    previous = next((i for i, item in enumerate(matches)
+                                     if item['cluster'] == cluster), None)
+                    if previous is None:
+                        matches.append(entry)
+                        if valid_name:
+                            named.add(cluster)
+                    elif valid_name and cluster not in named:
+                        matches[previous] = entry
+                        named.add(cluster)
+        return matches
+
+    async def search_infobases(self, query):
+        needle = self._search_needle(query)
+        matches = []
+        async with self.factory() as client:
+            for cluster_row in await client.list_clusters():
+                if not isinstance(cluster_row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(cluster_row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                try:
+                    for base in await client.list_infobases(UUID(cluster)):
+                        if not isinstance(base, dict):
+                            continue
+                        try:
+                            infobase = str(UUID(str(base['infobase'])))
+                        except (KeyError, TypeError, ValueError):
+                            continue
+                        name = base.get('name', '')
+                        valid_name = isinstance(name, str) and self._valid_search_text(name) and bool(name.strip())
+                        if needle in infobase.casefold() or valid_name and needle in name.casefold():
+                            matches.append({'cluster': cluster, 'infobase': infobase,
+                                            'name': name if valid_name else 'Unnamed infobase'})
+                except Exception:
+                    # One inaccessible cluster must not conceal other clusters.
+                    continue
+        return matches
+
+    async def search_profiles(self, query):
+        needle = self._search_needle(query)
+        matches = []
+        async with self.factory() as client:
+            for cluster_row in await client.list_clusters():
+                if not isinstance(cluster_row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(cluster_row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                try:
+                    for profile in await client.list_profiles(UUID(cluster)):
+                        if not isinstance(profile, dict):
+                            continue
+                        name = profile.get('name')
+                        if (isinstance(name, str) and self._valid_search_text(name)
+                                and name.strip() and needle in name.casefold()):
+                            matches.append({'cluster': cluster, 'name': name})
+                except Exception:
+                    # One inaccessible cluster must not conceal other clusters.
+                    continue
+        return matches
+
+    async def search_working_servers(self, query):
+        needle = self._search_needle(query)
+        matches = []
+        async with self.factory() as client:
+            for cluster_row in await client.list_clusters():
+                if not isinstance(cluster_row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(cluster_row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                try:
+                    for row in await client.list_servers(UUID(cluster)):
+                        if not isinstance(row, dict):
+                            continue
+                        try:
+                            server = str(UUID(str(row['server'])))
+                        except (KeyError, TypeError, ValueError):
+                            continue
+                        name = row.get('name', '')
+                        valid_name = isinstance(name, str) and self._valid_search_text(name) and bool(name.strip())
+                        host = row.get('host_name', '')
+                        valid_host = isinstance(host, str) and self._valid_search_text(host) and bool(host.strip())
+                        if (needle in server.casefold()
+                                or valid_name and needle in name.casefold()
+                                or valid_host and needle in host.casefold()):
+                            matches.append({'cluster': cluster, 'server': server,
+                                            'name': name if valid_name else
+                                            host if valid_host and host else 'Unnamed server'})
+                except Exception:
+                    # One inaccessible cluster must not conceal other clusters.
+                    continue
+        return matches
+
+    async def search_working_processes(self, query):
+        needle = self._search_needle(query)
+        matches = []
+        async with self.factory() as client:
+            for cluster_row in await client.list_clusters():
+                if not isinstance(cluster_row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(cluster_row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                try:
+                    for row in await client.list_processes(UUID(cluster)):
+                        if not isinstance(row, dict):
+                            continue
+                        try:
+                            process = str(UUID(str(row['process'])))
+                        except (KeyError, TypeError, ValueError):
+                            continue
+                        pid = row.get('pid')
+                        valid_pid = (type(pid) is str and pid.isascii()
+                                     and pid.isdecimal() and len(pid) <= 20)
+                        host = row.get('host', '')
+                        valid_host = self._valid_search_text(host)
+                        if (isinstance(pid, str) and valid_pid and needle in pid.casefold()
+                                or needle in process.casefold()
+                                or valid_host and needle in host.casefold()):
+                            address = {'cluster': cluster, 'process': process}
+                            if isinstance(pid, str) and valid_pid:
+                                address['pid'] = pid
+                            if valid_host:
+                                address['host'] = host
+                            matches.append(address)
+                except Exception:
+                    # One inaccessible cluster must not conceal other clusters.
+                    continue
+        return matches
+
+    async def search_sessions(self, query):
+        return await self._search_cluster_records(query, 'list_sessions', 'session_id',
+                                                  'user_name', ('host', 'app_id'), 'id')
+
+    async def search_connections(self, query):
+        return await self._search_cluster_records(query, 'list_connections', 'connection',
+                                                  'host', ('application',), 'conn-id')
+
+    async def search_managers(self, query):
+        return await self._search_cluster_records(query, 'list_managers', 'manager',
+                                                  'host', ('descr', 'pid'), None)
+
+    async def search_services(self, query):
+        needle = self._search_needle(query)
+        matches = []
+        async with self.factory() as client:
+            for cluster_row in await client.list_clusters():
+                if not isinstance(cluster_row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(cluster_row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                try:
+                    for row in await client.list_services(UUID(cluster)):
+                        if not isinstance(row, dict):
+                            continue
+                        name = row.get('name')
+                        if (not isinstance(name, str) or not name
+                                or not self._valid_search_text(name)):
+                            continue
+                        description = row.get('descr')
+                        manager = row.get('manager')
+                        fields = (name, description, manager)
+                        if any(isinstance(value, str) and self._valid_search_text(value)
+                               and needle in value.casefold() for value in fields):
+                            matches.append({'cluster': cluster, 'name': name})
+                except Exception:
+                    # One inaccessible cluster must not conceal other clusters.
+                    continue
+        return matches
+
+    async def search_counters(self, query):
+        return await self._search_named_records(query, 'counters')
+
+    async def search_limits(self, query):
+        return await self._search_named_records(query, 'limits')
+
+    async def search_locks(self, query):
+        needle = self._search_needle(query)
+        matches = []
+        async with self.factory() as client:
+            for cluster_row in await client.list_clusters():
+                if not isinstance(cluster_row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(cluster_row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                try:
+                    for row in await client.list_locks(UUID(cluster)):
+                        if not isinstance(row, dict):
+                            continue
+                        try:
+                            connection = str(UUID(str(row['connection'])))
+                            obj = str(UUID(str(row['object'])))
+                        except (KeyError, TypeError, ValueError):
+                            continue
+                        description = row.get('lock-descr')
+                        if (needle in connection.casefold() or needle in obj.casefold()
+                                or isinstance(description, str)
+                                and self._valid_search_text(description)
+                                and needle in description.casefold()):
+                            matches.append({'cluster': cluster, 'connection': connection,
+                                            'object': obj})
+                except Exception:
+                    # One inaccessible cluster must not conceal other clusters.
+                    continue
+        return matches
+
+    async def search_rules(self, query):
+        return await self._search_server_records(query, 'rules')
+
+    async def search_service_settings(self, query):
+        return await self._search_server_records(query, 'service-settings')
+
+    async def search_transfer_directories(self, query):
+        needle = self._search_needle(query)
+        matches = []
+        async with self.factory() as client:
+            for cluster_row in await client.list_clusters():
+                if not isinstance(cluster_row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(cluster_row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                try:
+                    servers = await client.list_servers(UUID(cluster))
+                except Exception:
+                    continue
+                for server_row in servers:
+                    if not isinstance(server_row, dict):
+                        continue
+                    try:
+                        server = str(UUID(str(server_row['server'])))
+                    except (KeyError, TypeError, ValueError):
+                        continue
+                    try:
+                        rows = await client.list_service_data_dirs_for_transfer(
+                            UUID(cluster), UUID(server))
+                        for row in rows:
+                            if not isinstance(row, dict):
+                                continue
+                            service = row.get('service-name')
+                            infobase = row.get('infobase-name')
+                            if (not isinstance(service, str) or not service
+                                    or not self._valid_search_text(service)):
+                                continue
+                            valid_infobase = (isinstance(infobase, str)
+                                              and self._valid_search_text(infobase))
+                            if (needle in service.casefold() or isinstance(infobase, str)
+                                    and valid_infobase and needle in infobase.casefold()):
+                                address = {'cluster': cluster, 'server': server,
+                                           'service-name': service}
+                                if isinstance(infobase, str) and valid_infobase:
+                                    address['infobase-name'] = infobase
+                                matches.append(address)
+                    except Exception:
+                        # An inaccessible server must not hide other servers.
+                        continue
+        return matches
+
+    async def _search_server_records(self, query, group):
+        needle = self._search_needle(query)
+        method, id_key, label_key = {
+            'rules': ('list_rules', 'rule', 'object-type'),
+            'service-settings': ('list_service_settings', 'setting', 'service-name'),
+        }[group]
+        secondary = ('infobase-name', 'application-ext') if group == 'rules' else ('infobase-name',)
+        matches = []
+        async with self.factory() as client:
+            for cluster_row in await client.list_clusters():
+                if not isinstance(cluster_row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(cluster_row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                try:
+                    servers = await client.list_servers(UUID(cluster))
+                except Exception:
+                    continue
+                for server_row in servers:
+                    if not isinstance(server_row, dict):
+                        continue
+                    try:
+                        server = str(UUID(str(server_row['server'])))
+                    except (KeyError, TypeError, ValueError):
+                        continue
+                    try:
+                        for row in await getattr(client, method)(UUID(cluster), UUID(server)):
+                            if not isinstance(row, dict):
+                                continue
+                            try:
+                                ident = str(UUID(str(row[id_key])))
+                            except (KeyError, TypeError, ValueError):
+                                continue
+                            label = row.get(label_key)
+                            valid_label = (isinstance(label, str)
+                                           and self._valid_search_text(label) and bool(label.strip()))
+                            fields = (label, ident) + tuple(row.get(key) for key in secondary)
+                            if any(isinstance(field, str) and self._valid_search_text(field)
+                                   and needle in field.casefold() for field in fields):
+                                matches.append({'cluster': cluster, 'server': server,
+                                                id_key: ident,
+                                                'name': label if valid_label else
+                                                'Assignment rule' if group == 'rules' else 'Service setting'})
+                    except Exception:
+                        # A broken server inventory must not hide its neighbors.
+                        continue
+        return matches
+
+    async def _search_named_records(self, query, kind):
+        needle = self._search_needle(query)
+        methods = {'counters': 'list_counters', 'limits': 'list_limits'}
+        method = methods[kind]
+        matches = []
+        async with self.factory() as client:
+            for cluster_row in await client.list_clusters():
+                if not isinstance(cluster_row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(cluster_row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                try:
+                    for row in await getattr(client, method)(UUID(cluster)):
+                        if not isinstance(row, dict):
+                            continue
+                        name = row.get('name')
+                        if (not isinstance(name, str) or not name.strip()
+                                or not self._valid_search_text(name)):
+                            continue
+                        description = row.get('descr')
+                        if (needle in name.casefold() or isinstance(description, str)
+                                and self._valid_search_text(description)
+                                and needle in description.casefold()):
+                            matches.append({'cluster': cluster, 'kind': kind[:-1], 'name': name})
+                except Exception:
+                    # One inaccessible cluster must not conceal other clusters.
+                    continue
+        return matches
+
+    @staticmethod
+    def _valid_search_text(value):
+        if not isinstance(value, str) or '\x00' in value:
+            return False
+        try:
+            return len(value.encode('utf-8')) <= 1024
+        except UnicodeError:
+            return False
+
+    async def _search_cluster_records(self, query, method, ident_key, label_key,
+                                      secondary_keys, number_key):
+        needle = self._search_needle(query)
+        matches = []
+        async with self.factory() as client:
+            for cluster_row in await client.list_clusters():
+                if not isinstance(cluster_row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(cluster_row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                try:
+                    for row in await getattr(client, method)(UUID(cluster)):
+                        if not isinstance(row, dict):
+                            continue
+                        try:
+                            ident = str(UUID(str(row[ident_key])))
+                        except (KeyError, TypeError, ValueError):
+                            continue
+                        label = row.get(label_key)
+                        valid_label = isinstance(label, str) and self._valid_search_text(label) and bool(label.strip())
+                        fields = (label, ident) + tuple(row.get(key) for key in secondary_keys)
+                        number = row.get(number_key) if number_key is not None else None
+                        if (any(isinstance(value, str) and self._valid_search_text(value)
+                                and needle in value.casefold() for value in fields)
+                                or type(number) is int and number >= 0
+                                and needle == str(number)):
+                            fallback = {'session_id': 'Session', 'connection': 'Connection',
+                                        'manager': 'Cluster manager'}[ident_key]
+                            if not valid_label and number_key is not None and type(number) is int and number >= 0:
+                                fallback = str(number)
+                            matches.append({'cluster': cluster, ident_key: ident,
+                                            label_key: label if valid_label else fallback})
+                except Exception:
+                    # A broken cluster cannot conceal valid results from its neighbors.
+                    continue
+        return matches
+
+    async def agent_version(self):
+        async with self.factory() as client:
+            return await client.agent_version()
+
+    async def agent_admins(self):
+        async with self.factory() as client:
+            return self.public_data(await client.list_agent_admins())
+
+    @classmethod
+    def _matching_admins(cls, rows, needle, cluster=None):
+        matches = []
+        for row in rows:
+            if not isinstance(row, dict):
+                continue
+            name = row.get('name')
+            if not isinstance(name, str) or not name or not cls._valid_search_text(name):
+                continue
+            os_user = row.get('os-user')
+            if (needle in name.casefold() or isinstance(os_user, str)
+                    and cls._valid_search_text(os_user) and needle in os_user.casefold()):
+                address = {'name': name}
+                if cluster is not None:
+                    address['cluster'] = cluster
+                matches.append(address)
+        return matches
+
+    async def search_agent_admins(self, query):
+        needle = self._search_needle(query)
+        async with self.factory() as client:
+            return self._matching_admins(await client.list_agent_admins(), needle)
+
+    async def search_cluster_admins(self, query):
+        needle = self._search_needle(query)
+        matches = []
+        async with self.factory() as client:
+            for row in await client.list_clusters():
+                if not isinstance(row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(row['cluster'])))
+                except (KeyError, TypeError, ValueError):
+                    continue
+                try:
+                    matches.extend(self._matching_admins(
+                        await client.list_cluster_admins(UUID(cluster)), needle, cluster))
+                except Exception:
+                    # An inaccessible cluster cannot suppress neighboring results.
+                    continue
+        return matches
+
+    async def cluster_admins(self, cluster_id):
+        cluster = UUID(str(cluster_id))
+        async with self.factory() as client:
+            return self.public_data(await client.list_cluster_admins(cluster))
+
+    async def cluster(self, cluster_id, include_info=True):
+        ident = UUID(str(cluster_id))
+        async with self.factory() as client:
+            result = {
+                'servers': await client.list_servers(ident),
+                'processes': await client.list_processes(ident),
+                'infobases': await client.list_infobases(ident),
+            }
+            if include_info:
+                result['cluster'] = await client.get_cluster(ident)
+            return self.public_data(result)
+
+    async def one(self, cluster_id, method):
+        if method not in ('get_cluster', 'list_servers', 'list_processes', 'list_infobases'):
+            raise ValueError('Unsupported read operation')
+        ident = UUID(str(cluster_id))
+        async with self.factory() as client:
+            return self.public_data(await getattr(client, method)(ident))
+
+    async def list_group(self, cluster_id, group):
+        if group not in CLUSTER_LISTS:
+            raise ValueError('Unsupported read group')
+        ident = UUID(str(cluster_id))
+        async with self.factory() as client:
+            return self.public_data(await getattr(client, CLUSTER_LISTS[group])(ident))
+
+    async def server(self, cluster_id, server_id):
+        cluster, server = UUID(str(cluster_id)), UUID(str(server_id))
+        async with self.factory() as client:
+            return self.public_data(await client.get_server(cluster, server))
+
+    async def process(self, cluster_id, process_id):
+        cluster, process = UUID(str(cluster_id)), UUID(str(process_id))
+        async with self.factory() as client:
+            return self.public_data(await client.get_process(cluster, process))
+
+    async def processes_on_server(self, cluster_id, server_id):
+        cluster, server = UUID(str(cluster_id)), UUID(str(server_id))
+        async with self.factory() as client:
+            return self.public_data(await client.list_processes(cluster, server))
+
+    async def session(self, cluster_id, session_id):
+        cluster, session = UUID(str(cluster_id)), UUID(str(session_id))
+        async with self.factory() as client:
+            return self.public_data(await client.get_session(cluster, session))
+
+    async def sessions_in_infobase(self, cluster_id, infobase_id):
+        cluster, infobase = UUID(str(cluster_id)), UUID(str(infobase_id))
+        async with self.factory() as client:
+            return self.public_data(await client.list_sessions(cluster, infobase))
+
+    async def infobase_summary(self, cluster_id, infobase_id):
+        cluster, infobase = UUID(str(cluster_id)), UUID(str(infobase_id))
+        async with self.factory() as client:
+            return self.public_data(await client.get_infobase_summary(cluster, infobase))
+
+    @staticmethod
+    def _validated_infobase_name(name):
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid infobase name')
+        return name
+
+    async def infobase_summary_by_name(self, cluster_id, name):
+        self._validated_infobase_name(name)
+        cluster = UUID(str(cluster_id))
+        async with self.factory() as client:
+            return self.public_data(await client.get_infobase_summary(cluster, name=name))
+
+    async def infobase_info_by_name(self, cluster_id, name):
+        self._validated_infobase_name(name)
+        cluster = UUID(str(cluster_id))
+        async with self.factory() as client:
+            row = await client.get_infobase_info(cluster, name=name)
+        return self._public_infobase_info(row)
+
+    @staticmethod
+    def _public_infobase_info(row):
+        # Do not leak authentication material even if another adapter returns it.
+        return ReadService.public_data(row)
+
+    async def infobase_info(self, cluster_id, infobase_id):
+        cluster, infobase = UUID(str(cluster_id)), UUID(str(infobase_id))
+        async with self.factory() as client:
+            row = await client.get_infobase_info(cluster, infobase)
+        return self._public_infobase_info(row)
+
+    async def binary_storages(self, cluster_id, infobase_id):
+        cluster, infobase = UUID(str(cluster_id)), UUID(str(infobase_id))
+        async with self.factory() as client:
+            rows = await client.list_binary_storages(cluster, infobase)
+        return self.public_data(rows)
+
+    async def connection(self, cluster_id, connection_id):
+        cluster, connection = UUID(str(cluster_id)), UUID(str(connection_id))
+        async with self.factory() as client:
+            return self.public_data(await client.get_connection(cluster, connection))
+
+    async def connections_in_infobase(self, cluster_id, infobase_id):
+        cluster, infobase = UUID(str(cluster_id)), UUID(str(infobase_id))
+        async with self.factory() as client:
+            return self.public_data(await client.list_connections(cluster, infobase))
+
+    async def connections_in_process(self, cluster_id, process_id):
+        cluster, process = UUID(str(cluster_id)), UUID(str(process_id))
+        async with self.factory() as client:
+            return self.public_data(await client.list_connections(cluster, process_id=process))
+
+    async def filtered_locks(self, cluster_id, scope, record_id):
+        if scope not in ('infobase', 'connection'):
+            raise ValueError('Unsupported lock filter')
+        cluster, record = UUID(str(cluster_id)), UUID(str(record_id))
+        async with self.factory() as client:
+            if scope == 'infobase':
+                return self.public_data(await client.list_locks(cluster, infobase_id=record))
+            return self.public_data(await client.list_locks(cluster, connection_id=record))
+
+    async def service_setting(self, cluster_id, server_id, setting_id):
+        cluster, server, setting = (UUID(str(value)) for value in
+                                    (cluster_id, server_id, setting_id))
+        async with self.factory() as client:
+            return self.public_data(await client.get_service_setting(cluster, server, setting))
+
+    async def rule(self, cluster_id, server_id, rule_id):
+        cluster, server, rule = (UUID(str(value)) for value in
+                                 (cluster_id, server_id, rule_id))
+        async with self.factory() as client:
+            return self.public_data(await client.get_rule(cluster, server, rule))
+
+    async def manager(self, cluster_id, manager_id):
+        cluster, manager = UUID(str(cluster_id)), UUID(str(manager_id))
+        async with self.factory() as client:
+            return self.public_data(await client.get_manager(cluster, manager))
+
+    async def limit(self, cluster_id, name):
+        if (not isinstance(name, str) or not name or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid limit name')
+        cluster = UUID(str(cluster_id))
+        async with self.factory() as client:
+            return self.public_data(await client.get_limit(cluster, name))
+
+    async def counter(self, cluster_id, name):
+        if (not isinstance(name, str) or not name or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid counter name')
+        cluster = UUID(str(cluster_id))
+        async with self.factory() as client:
+            return self.public_data(await client.get_counter(cluster, name))
+
+    async def counter_values(self, cluster_id, name, object_filter='', *, accumulated=False):
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid counter name')
+        if (not isinstance(object_filter, str) or '\x00' in object_filter
+                or len(object_filter.encode('utf-8')) > 4096):
+            raise ValueError('Invalid counter object filter')
+        cluster = UUID(str(cluster_id))
+        async with self.factory() as client:
+            if accumulated:
+                return self.public_data(await client.list_accumulated_counter_values(cluster, name, object_filter))
+            return self.public_data(await client.list_counter_values(cluster, name, object_filter))
+
+    async def list_server_group(self, cluster_id, server_id, group):
+        if group not in SERVER_LISTS:
+            raise ValueError('Unsupported server read group')
+        cluster, server = UUID(str(cluster_id)), UUID(str(server_id))
+        async with self.factory() as client:
+            return self.public_data(await getattr(client, SERVER_LISTS[group])(cluster, server))
+
+    async def transfer_directories(self, cluster_id, server_id, service_name=''):
+        if (not isinstance(service_name, str) or '\x00' in service_name
+                or len(service_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid service name')
+        cluster, server = UUID(str(cluster_id)), UUID(str(server_id))
+        async with self.factory() as client:
+            return self.public_data(await client.list_service_data_dirs_for_transfer(cluster, server, service_name))
+
+    @staticmethod
+    def _validated_profile_name(name):
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid profile name')
+        return name
+
+    async def profile_by_name(self, cluster_id, name):
+        self._validated_profile_name(name)
+        cluster = UUID(str(cluster_id))
+        async with self.factory() as client:
+            matches = [row for row in await client.list_profiles(cluster)
+                       if row['name'] == name]
+        if len(matches) != 1:
+            raise ValueError('Expected exactly one profile by name')
+        return self.public_data(matches[0])
+
+    async def profile_overview(self, cluster_id, name):
+        self._validated_profile_name(name)
+        cluster = UUID(str(cluster_id))
+        async with self.factory() as client:
+            matches = [row for row in await client.list_profiles(cluster)
+                       if row['name'] == name]
+            if len(matches) != 1:
+                raise ValueError('Expected exactly one profile by name')
+            acl = {kind: await getattr(client, method)(cluster, name)
+                   for kind, method in PROFILE_ACL_LISTS.items()}
+        return self.public_data({'profile': matches[0], 'acl': acl})
+
+    async def list_profile_acl(self, cluster_id, profile_name, acl_type, name=''):
+        if acl_type not in PROFILE_ACL_LISTS:
+            raise ValueError('Unsupported profile ACL')
+        if (not isinstance(profile_name, str) or not profile_name.strip()
+                or '\x00' in profile_name or len(profile_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid profile name')
+        if (not isinstance(name, str) or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid ACL name')
+        cluster = UUID(str(cluster_id))
+        async with self.factory() as client:
+            rows = await getattr(client, PROFILE_ACL_LISTS[acl_type])(cluster, profile_name)
+        key = 'alias' if acl_type == 'directory' else 'name'
+        return self.public_data([row for row in rows if row.get(key) == name] if name else rows)
+
+    async def search_profile_acl_all(self, acl_type, query):
+        if acl_type not in PROFILE_ACL_LISTS:
+            raise ValueError('Unsupported profile ACL')
+        needle = self._search_needle(query)
+        field = 'alias' if acl_type == 'directory' else 'name'
+        matches = []
+        async with self.factory() as client:
+            for cluster_row in await client.list_clusters():
+                if not isinstance(cluster_row, dict):
+                    continue
+                try:
+                    cluster = str(UUID(str(cluster_row['cluster'])))
+                    profiles = await client.list_profiles(UUID(cluster))
+                except Exception:
+                    continue
+                for profile in profiles:
+                    if not isinstance(profile, dict):
+                        continue
+                    name = profile.get('name')
+                    if (not isinstance(name, str) or not name.strip()
+                            or not self._valid_search_text(name)):
+                        continue
+                    try:
+                        for entry in await getattr(client, PROFILE_ACL_LISTS[acl_type])(
+                                UUID(cluster), name):
+                            if not isinstance(entry, dict):
+                                continue
+                            value = entry.get(field)
+                            if (isinstance(value, str) and value
+                                    and self._valid_search_text(value)
+                                    and needle in value.casefold()):
+                                matches.append({'cluster': cluster, 'profile': name,
+                                                'acl_type': acl_type, 'name': value})
+                    except Exception:
+                        # Other profiles and clusters remain searchable.
+                        continue
+        return matches
+
+    async def search_profile_acl(self, cluster_id, acl_type, query):
+        if acl_type not in PROFILE_ACL_LISTS:
+            raise ValueError('Unsupported profile ACL')
+        needle = self._search_needle(query)
+        cluster = UUID(str(cluster_id))
+        field = 'alias' if acl_type == 'directory' else 'name'
+        matches = []
+        async with self.factory() as client:
+            for profile in await client.list_profiles(cluster):
+                if not isinstance(profile, dict):
+                    continue
+                name = profile.get('name')
+                if (not isinstance(name, str) or not name.strip()
+                        or not self._valid_search_text(name)):
+                    continue
+                try:
+                    for entry in await getattr(client, PROFILE_ACL_LISTS[acl_type])(cluster, name):
+                        if not isinstance(entry, dict):
+                            continue
+                        value = entry.get(field)
+                        if (isinstance(value, str) and value
+                                and self._valid_search_text(value)
+                                and needle in value.casefold()):
+                            matches.append({'cluster': str(cluster), 'profile': name,
+                                            'acl_type': acl_type, 'name': value})
+                except Exception:
+                    # Other profiles remain searchable; never return backend exception text.
+                    continue
+        return matches