Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-04-21 13:37:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 91

Move query and scheduled query request and response types to server/fleet/ (#43236)

Browse source 
For #36087

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Refactor**
* Consolidated and centralized request/response type definitions for
query and scheduled query API operations
* Updated internal service handlers and client code to use unified type
structures
* Improved code consistency and reduced duplication across query-related
endpoints

* **Tests**
  * Updated integration tests to align with new API type organization

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
Lucas Manuel Rodriguez 2026-04-13 16:02:23 -03:00 committed by GitHub
parent c3f50293e9
commit 002c035b8d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 521 additions and 455 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

193
server/fleet/api_queries.go Normal file
View file

@ -0,0 +1,193 @@
package fleet
////////////////////////////////////////////////////////////////////////////////
// Get Query
////////////////////////////////////////////////////////////////////////////////
type GetQueryRequest struct {
ID uint `url:"id"`
}
type GetQueryResponse struct {
// Because `fleet.Query` has a `query` field that we don't want to rename,
// it's simpler to just duplicate the query in the response struct rather than
// relying on the `renameto` tag here.
// TODO - In Fleet 5, remove the extra field.
Query *Query `json:"query,omitempty"`
Report *Query `json:"report,omitempty"`
Err error `json:"error,omitempty"`
}
func (r GetQueryResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// List Queries
////////////////////////////////////////////////////////////////////////////////
type ListQueriesRequest struct {
ListOptions ListOptions `url:"list_options"`
// TeamID url argument set to 0 means global.
TeamID uint `query:"team_id,optional" renameto:"fleet_id"`
MergeInherited bool `query:"merge_inherited,optional"`
// only return queries targeted to run on this platform
Platform string `query:"platform,optional"`
}
type ListQueriesResponse struct {
Queries []Query `json:"queries" renameto:"reports"`
Count int `json:"count"`
InheritedQueryCount int `json:"inherited_query_count" renameto:"inherited_report_count"`
Meta *PaginationMetadata `json:"meta"`
Err error `json:"error,omitempty"`
}
func (r ListQueriesResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Query Reports
////////////////////////////////////////////////////////////////////////////////
type GetQueryReportRequest struct {
ID uint `url:"id"`
TeamID *uint `query:"team_id,optional" renameto:"fleet_id"`
}
type GetQueryReportResponse struct {
QueryID uint `json:"query_id" renameto:"report_id"`
Results []HostQueryResultRow `json:"results"`
ReportClipped bool `json:"report_clipped"`
Err error `json:"error,omitempty"`
}
func (r GetQueryReportResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Create Query
////////////////////////////////////////////////////////////////////////////////
type CreateQueryRequest struct {
QueryPayload
}
type CreateQueryResponse struct {
// Because `fleet.Query` has a `query` field that we don't want to rename,
// it's simpler to just duplicate the query in the response struct rather than
// relying on the `renameto` tag here.
// TODO - In Fleet 5, remove the extra field.
Query *Query `json:"query,omitempty"`
Report *Query `json:"report,omitempty"`
Err error `json:"error,omitempty"`
}
func (r CreateQueryResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Modify Query
////////////////////////////////////////////////////////////////////////////////
type ModifyQueryRequest struct {
ID uint `json:"-" url:"id"`
QueryPayload
}
type ModifyQueryResponse struct {
// Because `fleet.Query` has a `query` field that we don't want to rename,
// it's simpler to just duplicate the query in the response struct rather than
// relying on the `renameto` tag here.
// TODO - In Fleet 5, remove the extra field.
Query *Query `json:"query,omitempty"`
Report *Query `json:"report,omitempty"`
Err error `json:"error,omitempty"`
}
func (r ModifyQueryResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Delete Query
////////////////////////////////////////////////////////////////////////////////
type DeleteQueryRequest struct {
Name string `url:"name"`
// TeamID if not set is assumed to be 0 (global).
TeamID uint `url:"fleet_id,optional"`
}
type DeleteQueryResponse struct {
Err error `json:"error,omitempty"`
}
func (r DeleteQueryResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Delete Query By ID
////////////////////////////////////////////////////////////////////////////////
type DeleteQueryByIDRequest struct {
ID uint `url:"id"`
}
type DeleteQueryByIDResponse struct {
Err error `json:"error,omitempty"`
}
func (r DeleteQueryByIDResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Delete Queries
////////////////////////////////////////////////////////////////////////////////
type DeleteQueriesRequest struct {
IDs []uint `json:"ids"`
}
type DeleteQueriesResponse struct {
Deleted uint `json:"deleted"`
Err error `json:"error,omitempty"`
}
func (r DeleteQueriesResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Apply Query Specs
////////////////////////////////////////////////////////////////////////////////
type ApplyQuerySpecsRequest struct {
Specs []*QuerySpec `json:"specs"`
}
type ApplyQuerySpecsResponse struct {
Err error `json:"error,omitempty"`
}
func (r ApplyQuerySpecsResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Get Query Specs
////////////////////////////////////////////////////////////////////////////////
type GetQuerySpecsRequest struct {
TeamID uint `url:"fleet_id,optional"`
}
type GetQuerySpecsResponse struct {
Specs []*QuerySpec `json:"specs"`
Err error `json:"error,omitempty"`
}
func (r GetQuerySpecsResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Get Query Spec
////////////////////////////////////////////////////////////////////////////////
type GetQuerySpecRequest struct {
Name string `url:"name"`
TeamID uint `query:"team_id,optional" renameto:"fleet_id"`
}
type GetQuerySpecResponse struct {
Spec *QuerySpec `json:"specs,omitempty"`
Err error `json:"error,omitempty"`
}
func (r GetQuerySpecResponse) Error() error { return r.Err }

88
server/fleet/api_scheduled_queries.go Normal file
View file

@ -0,0 +1,88 @@
package fleet
////////////////////////////////////////////////////////////////////////////////
// Get Scheduled Queries In Pack
////////////////////////////////////////////////////////////////////////////////
type GetScheduledQueriesInPackRequest struct {
ID uint `url:"id"`
ListOptions ListOptions `url:"list_options"`
}
type ScheduledQueryResponse struct {
ScheduledQuery
}
type GetScheduledQueriesInPackResponse struct {
Scheduled []ScheduledQueryResponse `json:"scheduled"`
Err error `json:"error,omitempty"`
}
func (r GetScheduledQueriesInPackResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Schedule Query
////////////////////////////////////////////////////////////////////////////////
type ScheduleQueryRequest struct {
PackID uint `json:"pack_id"`
QueryID uint `json:"query_id" renameto:"report_id"`
Interval uint `json:"interval"`
Snapshot *bool `json:"snapshot"`
Removed *bool `json:"removed"`
Platform *string `json:"platform"`
Version *string `json:"version"`
Shard *uint `json:"shard"`
}
type ScheduleQueryResponse struct {
Scheduled *ScheduledQueryResponse `json:"scheduled,omitempty"`
Err error `json:"error,omitempty"`
}
func (r ScheduleQueryResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Get Scheduled Query
////////////////////////////////////////////////////////////////////////////////
type GetScheduledQueryRequest struct {
ID uint `url:"id"`
}
type GetScheduledQueryResponse struct {
Scheduled *ScheduledQueryResponse `json:"scheduled,omitempty"`
Err error `json:"error,omitempty"`
}
func (r GetScheduledQueryResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Modify Scheduled Query
////////////////////////////////////////////////////////////////////////////////
type ModifyScheduledQueryRequest struct {
ID uint `json:"-" url:"id"`
ScheduledQueryPayload
}
type ModifyScheduledQueryResponse struct {
Scheduled *ScheduledQueryResponse `json:"scheduled,omitempty"`
Err error `json:"error,omitempty"`
}
func (r ModifyScheduledQueryResponse) Error() error { return r.Err }
////////////////////////////////////////////////////////////////////////////////
// Delete Scheduled Query
////////////////////////////////////////////////////////////////////////////////
type DeleteScheduledQueryRequest struct {
ID uint `url:"id"`
}
type DeleteScheduledQueryResponse struct {
Err error `json:"error,omitempty"`
}
func (r DeleteScheduledQueryResponse) Error() error { return r.Err }

14
server/service/client_queries.go
View file

@ -10,9 +10,9 @@ import (
// ApplyQueries sends the list of Queries to be applied (upserted) to the
// Fleet instance.
func (c *Client) ApplyQueries(specs []*fleet.QuerySpec) error {
req := applyQuerySpecsRequest{Specs: specs}
req := fleet.ApplyQuerySpecsRequest{Specs: specs}
verb, path := "POST", "/api/latest/fleet/spec/reports"
var responseBody applyQuerySpecsResponse
var responseBody fleet.ApplyQuerySpecsResponse
return c.authenticatedRequest(req, verb, path, &responseBody)
}
@ -23,7 +23,7 @@ func (c *Client) GetQuerySpec(teamID *uint, name string) (*fleet.QuerySpec, erro
if teamID != nil {
query.Set("fleet_id", fmt.Sprint(*teamID))
}
var responseBody getQuerySpecResponse
var responseBody fleet.GetQuerySpecResponse
err := c.authenticatedRequestWithQuery(nil, verb, path, &responseBody, query.Encode())
return responseBody.Spec, err
}
@ -38,7 +38,7 @@ func (c *Client) GetQueries(teamID *uint, name *string) ([]fleet.Query, error) {
if name != nil {
query.Set("query", *name)
}
var responseBody listQueriesResponse
var responseBody fleet.ListQueriesResponse
err := c.authenticatedRequestWithQuery(nil, verb, path, &responseBody, query.Encode())
if err != nil {
return nil, err
@ -49,14 +49,14 @@ func (c *Client) GetQueries(teamID *uint, name *string) ([]fleet.Query, error) {
// DeleteQuery deletes the query with the matching name.
func (c *Client) DeleteQuery(name string) error {
verb, path := "DELETE", "/api/latest/fleet/reports/"+url.PathEscape(name)
var responseBody deleteQueryResponse
var responseBody fleet.DeleteQueryResponse
return c.authenticatedRequest(nil, verb, path, &responseBody)
}
// DeleteQueries deletes several queries.
func (c *Client) DeleteQueries(ids []uint) error {
req := deleteQueriesRequest{IDs: ids}
req := fleet.DeleteQueriesRequest{IDs: ids}
verb, path := "POST", "/api/latest/fleet/reports/delete"
var responseBody deleteQueriesResponse
var responseBody fleet.DeleteQueriesResponse
return c.authenticatedRequest(req, verb, path, &responseBody)
}

38
server/service/handler.go
View file

@ -364,17 +364,17 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
ue.POST("/api/_version_/fleet/spec/certificates", applyCertificateTemplateSpecsEndpoint, applyCertificateTemplateSpecsRequest{})
ue.DELETE("/api/_version_/fleet/spec/certificates", deleteCertificateTemplateSpecsEndpoint, deleteCertificateTemplateSpecsRequest{})
ue.GET("/api/_version_/fleet/reports/{id:[0-9]+}", getQueryEndpoint, getQueryRequest{})
ue.GET("/api/_version_/fleet/reports", listQueriesEndpoint, listQueriesRequest{})
ue.GET("/api/_version_/fleet/reports/{id:[0-9]+}/report", getQueryReportEndpoint, getQueryReportRequest{})
ue.POST("/api/_version_/fleet/reports", createQueryEndpoint, createQueryRequest{})
ue.PATCH("/api/_version_/fleet/reports/{id:[0-9]+}", modifyQueryEndpoint, modifyQueryRequest{})
ue.DELETE("/api/_version_/fleet/reports/{name}", deleteQueryEndpoint, deleteQueryRequest{})
ue.DELETE("/api/_version_/fleet/reports/id/{id:[0-9]+}", deleteQueryByIDEndpoint, deleteQueryByIDRequest{})
ue.POST("/api/_version_/fleet/reports/delete", deleteQueriesEndpoint, deleteQueriesRequest{})
ue.WithRequestBodySizeLimit(fleet.MaxSpecSize).POST("/api/_version_/fleet/spec/reports", applyQuerySpecsEndpoint, applyQuerySpecsRequest{})
ue.GET("/api/_version_/fleet/spec/reports", getQuerySpecsEndpoint, getQuerySpecsRequest{})
ue.GET("/api/_version_/fleet/spec/reports/{name}", getQuerySpecEndpoint, getQuerySpecRequest{})
ue.GET("/api/_version_/fleet/reports/{id:[0-9]+}", getQueryEndpoint, fleet.GetQueryRequest{})
ue.GET("/api/_version_/fleet/reports", listQueriesEndpoint, fleet.ListQueriesRequest{})
ue.GET("/api/_version_/fleet/reports/{id:[0-9]+}/report", getQueryReportEndpoint, fleet.GetQueryReportRequest{})
ue.POST("/api/_version_/fleet/reports", createQueryEndpoint, fleet.CreateQueryRequest{})
ue.PATCH("/api/_version_/fleet/reports/{id:[0-9]+}", modifyQueryEndpoint, fleet.ModifyQueryRequest{})
ue.DELETE("/api/_version_/fleet/reports/{name}", deleteQueryEndpoint, fleet.DeleteQueryRequest{})
ue.DELETE("/api/_version_/fleet/reports/id/{id:[0-9]+}", deleteQueryByIDEndpoint, fleet.DeleteQueryByIDRequest{})
ue.POST("/api/_version_/fleet/reports/delete", deleteQueriesEndpoint, fleet.DeleteQueriesRequest{})
ue.WithRequestBodySizeLimit(fleet.MaxSpecSize).POST("/api/_version_/fleet/spec/reports", applyQuerySpecsEndpoint, fleet.ApplyQuerySpecsRequest{})
ue.GET("/api/_version_/fleet/spec/reports", getQuerySpecsEndpoint, fleet.GetQuerySpecsRequest{})
ue.GET("/api/_version_/fleet/spec/reports/{name}", getQuerySpecEndpoint, fleet.GetQuerySpecRequest{})
ue.GET("/api/_version_/fleet/packs/{id:[0-9]+}", getPackEndpoint, getPackRequest{})
ue.POST("/api/_version_/fleet/packs", createPackEndpoint, createPackRequest{})
@ -510,14 +510,14 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
// This endpoint is deprecated and maintained for backwards compatibility. This and above endpoint are functionally equivalent
ue.POST("/api/_version_/fleet/reports/run_by_names", createDistributedQueryCampaignByIdentifierEndpoint, createDistributedQueryCampaignByIdentifierRequest{})
ue.GET("/api/_version_/fleet/packs/{id:[0-9]+}/scheduled", getScheduledQueriesInPackEndpoint, getScheduledQueriesInPackRequest{})
ue.EndingAtVersion("v1").POST("/api/_version_/fleet/schedule", scheduleQueryEndpoint, scheduleQueryRequest{})
ue.StartingAtVersion("2022-04").POST("/api/_version_/fleet/packs/schedule", scheduleQueryEndpoint, scheduleQueryRequest{})
ue.GET("/api/_version_/fleet/schedule/{id:[0-9]+}", getScheduledQueryEndpoint, getScheduledQueryRequest{})
ue.EndingAtVersion("v1").PATCH("/api/_version_/fleet/schedule/{id:[0-9]+}", modifyScheduledQueryEndpoint, modifyScheduledQueryRequest{})
ue.StartingAtVersion("2022-04").PATCH("/api/_version_/fleet/packs/schedule/{id:[0-9]+}", modifyScheduledQueryEndpoint, modifyScheduledQueryRequest{})
ue.EndingAtVersion("v1").DELETE("/api/_version_/fleet/schedule/{id:[0-9]+}", deleteScheduledQueryEndpoint, deleteScheduledQueryRequest{})
ue.StartingAtVersion("2022-04").DELETE("/api/_version_/fleet/packs/schedule/{id:[0-9]+}", deleteScheduledQueryEndpoint, deleteScheduledQueryRequest{})
ue.GET("/api/_version_/fleet/packs/{id:[0-9]+}/scheduled", getScheduledQueriesInPackEndpoint, fleet.GetScheduledQueriesInPackRequest{})
ue.EndingAtVersion("v1").POST("/api/_version_/fleet/schedule", scheduleQueryEndpoint, fleet.ScheduleQueryRequest{})
ue.StartingAtVersion("2022-04").POST("/api/_version_/fleet/packs/schedule", scheduleQueryEndpoint, fleet.ScheduleQueryRequest{})
ue.GET("/api/_version_/fleet/schedule/{id:[0-9]+}", getScheduledQueryEndpoint, fleet.GetScheduledQueryRequest{})
ue.EndingAtVersion("v1").PATCH("/api/_version_/fleet/schedule/{id:[0-9]+}", modifyScheduledQueryEndpoint, fleet.ModifyScheduledQueryRequest{})
ue.StartingAtVersion("2022-04").PATCH("/api/_version_/fleet/packs/schedule/{id:[0-9]+}", modifyScheduledQueryEndpoint, fleet.ModifyScheduledQueryRequest{})
ue.EndingAtVersion("v1").DELETE("/api/_version_/fleet/schedule/{id:[0-9]+}", deleteScheduledQueryEndpoint, fleet.DeleteScheduledQueryRequest{})
ue.StartingAtVersion("2022-04").DELETE("/api/_version_/fleet/packs/schedule/{id:[0-9]+}", deleteScheduledQueryEndpoint, fleet.DeleteScheduledQueryRequest{})
ue.EndingAtVersion("v1").GET("/api/_version_/fleet/global/schedule", getGlobalScheduleEndpoint, getGlobalScheduleRequest{})
ue.StartingAtVersion("2022-04").GET("/api/_version_/fleet/schedule", getGlobalScheduleEndpoint, getGlobalScheduleRequest{})

172
server/service/integration_core_test.go
View file

@ -345,7 +345,7 @@ func (s *integrationTestSuite) TestQueryCreationLogsActivity() {
Name: ptr.String("user1"),
Query: ptr.String("select * from time;"),
}
var createQueryResp createQueryResponse
var createQueryResp fleet.CreateQueryResponse
s.DoJSON("POST", "/api/latest/fleet/queries", &params, http.StatusOK, &createQueryResp)
defer s.cleanupQuery(createQueryResp.Query.ID)
assert.False(t, createQueryResp.Query.CreatedAt.IsZero())
@ -371,7 +371,7 @@ func (s *integrationTestSuite) TestQueryCreationLogsActivity() {
func (s *integrationTestSuite) TestQueryLabelsIncludeAnyRequiresPremium() {
// POST /api/v1/fleet/queries with labels_include_any should fail with 402 on free tier
var createResp createQueryResponse
var createResp fleet.CreateQueryResponse
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.QueryPayload{
Name: ptr.String("test-labels-query"),
Query: ptr.String("SELECT 1"),
@ -379,7 +379,7 @@ func (s *integrationTestSuite) TestQueryLabelsIncludeAnyRequiresPremium() {
}, http.StatusPaymentRequired, &createResp)
// Create a query without labels_include_any to use for the PATCH test
var createOKResp createQueryResponse
var createOKResp fleet.CreateQueryResponse
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.QueryPayload{
Name: ptr.String("test-labels-query-for-patch"),
Query: ptr.String("SELECT 1"),
@ -387,7 +387,7 @@ func (s *integrationTestSuite) TestQueryLabelsIncludeAnyRequiresPremium() {
defer s.cleanupQuery(createOKResp.Query.ID)
// PATCH with labels_include_any should also fail with 402 on free tier
var modifyResp modifyQueryResponse
var modifyResp fleet.ModifyQueryResponse
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", createOKResp.Query.ID), fleet.QueryPayload{
LabelsIncludeAny: []string{"some-label"},
}, http.StatusPaymentRequired, &modifyResp)
@ -398,8 +398,8 @@ func (s *integrationTestSuite) TestQueryLabelsIncludeAnyRequiresPremium() {
}, http.StatusPaymentRequired, &modifyResp)
// POST /api/latest/fleet/spec/queries with labels_include_any should fail with 402 on free tier
var applyResp applyQuerySpecsResponse
s.DoJSON("POST", "/api/latest/fleet/spec/queries", applyQuerySpecsRequest{
var applyResp fleet.ApplyQuerySpecsResponse
s.DoJSON("POST", "/api/latest/fleet/spec/queries", fleet.ApplyQuerySpecsRequest{
Specs: []*fleet.QuerySpec{
{Name: "test-labels-spec-query", Query: "SELECT 1", LabelsIncludeAny: []string{"some-label"}},
},
@ -3751,7 +3751,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
s.Do("GET", fmt.Sprintf("/api/latest/fleet/queries/%d", 9999), nil, http.StatusNotFound)
// list queries
var listQryResp listQueriesResponse
var listQryResp fleet.ListQueriesResponse
s.DoJSON("GET", "/api/latest/fleet/queries", nil, http.StatusOK, &listQryResp)
assert.Len(t, listQryResp.Queries, 0)
assert.Equal(t, 0, listQryResp.Count)
@ -3759,7 +3759,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
// create a query
sql := "select * from time;"
var createQueryResp createQueryResponse
var createQueryResp fleet.CreateQueryResponse
reqQuery := &fleet.QueryPayload{
Name: ptr.String(strings.ReplaceAll(t.Name(), "/", "_")),
Query: ptr.String(sql),
@ -3804,7 +3804,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
require.False(t, listQryResp.Meta.HasNextResults)
// getting that query works
var getQryResp getQueryResponse
var getQryResp fleet.GetQueryResponse
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d", query.ID), nil, http.StatusOK, &getQryResp)
assert.Equal(t, query.ID, getQryResp.Query.ID)
assert.Equal(t, query.ID, getQryResp.Report.ID)
@ -3812,7 +3812,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
assert.Equal(t, sql, getQryResp.Report.Query)
// list scheduled queries in pack, none yet
var getInPackResp getScheduledQueriesInPackResponse
var getInPackResp fleet.GetScheduledQueriesInPackResponse
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/packs/%d/scheduled", pack.ID), nil, http.StatusOK, &getInPackResp)
assert.Len(t, getInPackResp.Scheduled, 0)
@ -3821,8 +3821,8 @@ func (s *integrationTestSuite) TestScheduledQueries() {
assert.Len(t, getInPackResp.Scheduled, 0)
// create scheduled query
var createResp scheduleQueryResponse
reqSQ := &scheduleQueryRequest{
var createResp fleet.ScheduleQueryResponse
reqSQ := &fleet.ScheduleQueryRequest{
PackID: pack.ID,
QueryID: query.ID,
Interval: 1,
@ -3833,7 +3833,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
assert.Equal(t, uint(1), sq1.Interval)
// create scheduled query with invalid pack
reqSQ = &scheduleQueryRequest{
reqSQ = &fleet.ScheduleQueryRequest{
PackID: pack.ID + 1,
QueryID: query.ID,
Interval: 2,
@ -3841,7 +3841,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
s.DoJSON("POST", "/api/latest/fleet/packs/schedule", reqSQ, http.StatusUnprocessableEntity, &createResp)
// create scheduled query with invalid query
reqSQ = &scheduleQueryRequest{
reqSQ = &fleet.ScheduleQueryRequest{
PackID: pack.ID,
QueryID: query.ID + 1,
Interval: 3,
@ -3858,7 +3858,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
require.Len(t, getInPackResp.Scheduled, 0)
// get non-existing scheduled query
var getResp getScheduledQueryResponse
var getResp fleet.GetScheduledQueryResponse
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/schedule/%d", sq1.ID+1), nil, http.StatusNotFound, &getResp)
// get existing scheduled query
@ -3867,7 +3867,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
assert.Equal(t, sq1.Interval, getResp.Scheduled.Interval)
// modify scheduled query
var modResp modifyScheduledQueryResponse
var modResp fleet.ModifyScheduledQueryResponse
reqMod := fleet.ScheduledQueryPayload{
Interval: ptr.Uint(4),
}
@ -3882,7 +3882,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/packs/schedule/%d", sq1.ID+1), reqMod, http.StatusNotFound, &modResp)
// delete non-existing scheduled query
var delResp deleteScheduledQueryResponse
var delResp fleet.DeleteScheduledQueryResponse
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/packs/schedule/%d", sq1.ID+1), nil, http.StatusNotFound, &delResp)
// delete existing scheduled query
@ -3892,7 +3892,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/schedule/%d", sq1.ID), nil, http.StatusNotFound, &getResp)
// modify the query
var modQryResp modifyQueryResponse
var modQryResp fleet.ModifyQueryResponse
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", query.ID), fleet.QueryPayload{Description: ptr.String("updated")}, http.StatusOK, &modQryResp)
assert.Equal(t, "updated", modQryResp.Query.Description)
assert.Equal(t, sql, modQryResp.Query.Query)
@ -3906,7 +3906,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", query.ID+1), fleet.QueryPayload{Description: ptr.String("updated")}, http.StatusNotFound, &modQryResp)
// delete the query by name
var delByNameResp deleteQueryResponse
var delByNameResp fleet.DeleteQueryResponse
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/%s", query.Name), nil, http.StatusOK, &delByNameResp)
// delete unknown query by name (i.e. the same, now deleted)
@ -3921,7 +3921,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
query2 := createQueryResp.Query
// delete it by id
var delByIDResp deleteQueryByIDResponse
var delByIDResp fleet.DeleteQueryByIDResponse
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", query2.ID), nil, http.StatusOK, &delByIDResp)
// delete unknown query by id (same id just deleted)
@ -3936,7 +3936,7 @@ func (s *integrationTestSuite) TestScheduledQueries() {
query3 := createQueryResp.Query
// batch-delete by id, 3 ids, only one exists
var delBatchResp deleteQueriesResponse
var delBatchResp fleet.DeleteQueriesResponse
s.DoJSON("POST", "/api/latest/fleet/queries/delete", map[string]interface{}{
"ids": []uint{query.ID, query2.ID, query3.ID},
}, http.StatusOK, &delBatchResp)
@ -3966,7 +3966,7 @@ func (s *integrationTestSuite) TestQueriesPaginationAndPlatformFilter() {
{Name: "PPTestQuery9", Query: "select 9"},
{Name: "PPTestQuery10", Query: "select 10"},
}
var createQueryResp createQueryResponse
var createQueryResp fleet.CreateQueryResponse
for _, q := range testQueries {
reqQuery := &fleet.QueryPayload{
Name: &q.Name,
@ -3978,7 +3978,7 @@ func (s *integrationTestSuite) TestQueriesPaginationAndPlatformFilter() {
require.Equal(t, createQueryResp.Query.Platform, q.Platform)
}
var listQryResp listQueriesResponse
var listQryResp fleet.ListQueriesResponse
queryNameToMatch := "TestQuery"
// Test pagination, no filter
@ -4019,7 +4019,7 @@ func (s *integrationTestSuite) TestQueriesPaginationAndPlatformFilter() {
require.False(t, listQryResp.Meta.HasNextResults)
// invalid order_key returns 422
listQryResp = listQueriesResponse{}
listQryResp = fleet.ListQueriesResponse{}
s.DoJSON("GET", "/api/latest/fleet/queries", nil, http.StatusUnprocessableEntity, &listQryResp, "order_key", "invalid")
// test platform filtering
@ -4065,7 +4065,7 @@ func (s *integrationTestSuite) TestQueriesPaginationAndPlatformFilter() {
s.DoJSON("GET", "/api/latest/fleet/queries", nil, http.StatusBadRequest, &listQryResp, "platform", "lucas", "per_page", "1", "page", "1")
// delete them by name
var delByNameResp deleteQueryResponse
var delByNameResp fleet.DeleteQueryResponse
// for _, qId := range testQueryIds {
for _, q := range testQueries {
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/%s", q.Name), nil, http.StatusOK, &delByNameResp)
@ -7281,7 +7281,7 @@ func (s *integrationTestSuite) TestQueriesBadRequests() {
Name: ptr.String("existing query"),
Query: ptr.String("select 42;"),
}
createQueryResp := createQueryResponse{}
createQueryResp := fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", reqQuery, http.StatusOK, &createQueryResp)
require.NotNil(t, createQueryResp.Query)
existingQueryID := createQueryResp.Query.ID
@ -7347,7 +7347,7 @@ func (s *integrationTestSuite) TestQueriesBadRequests() {
Platform: ptr.String(tc.platform),
Logging: ptr.String(tc.logging),
}
createQueryResp := createQueryResponse{}
createQueryResp := fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", reqQuery, http.StatusBadRequest, &createQueryResp)
require.Nil(t, createQueryResp.Query)
@ -7357,7 +7357,7 @@ func (s *integrationTestSuite) TestQueriesBadRequests() {
Platform: ptr.String(tc.platform),
Logging: ptr.String(tc.logging),
}
mResp := modifyQueryResponse{}
mResp := fleet.ModifyQueryResponse{}
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", existingQueryID), &payload, http.StatusBadRequest, &mResp)
require.Nil(t, mResp.Query)
// TODO – add checks for specific errors
@ -7388,7 +7388,7 @@ func (s *integrationTestSuite) TestPacksBadRequests() {
reqQuery := &fleet.PackPayload{
Name: ptr.String(tc.name),
}
createPackResp := createQueryResponse{}
createPackResp := createPackResponse{}
s.DoJSON("POST", "/api/latest/fleet/packs", reqQuery, http.StatusBadRequest, &createPackResp)
payload := fleet.PackPayload{
@ -8102,19 +8102,19 @@ func (s *integrationTestSuite) TestQuerySpecs() {
s.lq.On("SetQueryResultsCount", mock.Anything, mock.Anything).Return(nil)
// list specs, none yet
var getSpecsResp getQuerySpecsResponse
var getSpecsResp fleet.GetQuerySpecsResponse
s.DoJSON("GET", "/api/latest/fleet/spec/queries", nil, http.StatusOK, &getSpecsResp)
assert.Len(t, getSpecsResp.Specs, 0)
// get unknown one
var getSpecResp getQuerySpecResponse
var getSpecResp fleet.GetQuerySpecResponse
s.DoJSON("GET", "/api/latest/fleet/spec/queries/nonesuch", nil, http.StatusNotFound, &getSpecResp)
// create some queries via apply specs
q1 := strings.ReplaceAll(t.Name(), "/", "_")
q2 := q1 + "_2"
var applyResp applyQuerySpecsResponse
s.DoJSON("POST", "/api/latest/fleet/spec/queries", applyQuerySpecsRequest{
var applyResp fleet.ApplyQuerySpecsResponse
s.DoJSON("POST", "/api/latest/fleet/spec/queries", fleet.ApplyQuerySpecsRequest{
Specs: []*fleet.QuerySpec{
{Name: q1, Query: "SELECT 1"},
{Name: q2, Query: "SELECT 2"},
@ -8122,7 +8122,7 @@ func (s *integrationTestSuite) TestQuerySpecs() {
}, http.StatusOK, &applyResp)
// get the queries back
var listQryResp listQueriesResponse
var listQryResp fleet.ListQueriesResponse
s.DoJSON("GET", "/api/latest/fleet/queries", nil, http.StatusOK, &listQryResp, "order_key", "name")
require.Len(t, listQryResp.Queries, 2)
assert.Equal(t, q1, listQryResp.Queries[0].Name)
@ -8141,7 +8141,7 @@ func (s *integrationTestSuite) TestQuerySpecs() {
// apply specs again - create q3 and update q2
q3 := q1 + "_3"
s.DoJSON("POST", "/api/latest/fleet/spec/queries", applyQuerySpecsRequest{
s.DoJSON("POST", "/api/latest/fleet/spec/queries", fleet.ApplyQuerySpecsRequest{
Specs: []*fleet.QuerySpec{
{Name: q2, Query: "SELECT -2"},
{Name: q3, Query: "SELECT 3"},
@ -8150,14 +8150,14 @@ func (s *integrationTestSuite) TestQuerySpecs() {
// try to create a query with invalid platform, fail
q4 := q1 + "_4"
s.DoJSON("POST", "/api/latest/fleet/spec/queries", applyQuerySpecsRequest{
s.DoJSON("POST", "/api/latest/fleet/spec/queries", fleet.ApplyQuerySpecsRequest{
Specs: []*fleet.QuerySpec{
{Name: q4, Query: "SELECT 4", Platform: "not valid"},
},
}, http.StatusBadRequest, &applyResp)
// try to edit a query with invalid platform, fail
s.DoJSON("POST", "/api/latest/fleet/spec/queries", applyQuerySpecsRequest{
s.DoJSON("POST", "/api/latest/fleet/spec/queries", fleet.ApplyQuerySpecsRequest{
Specs: []*fleet.QuerySpec{
{Name: q3, Query: "SELECT 3", Platform: "charles darwin"},
},
@ -8178,7 +8178,7 @@ func (s *integrationTestSuite) TestQuerySpecs() {
q3ID := listQryResp.Queries[2].ID
// delete all queries created
var delBatchResp deleteQueriesResponse
var delBatchResp fleet.DeleteQueriesResponse
s.DoJSON("POST", "/api/latest/fleet/queries/delete", map[string]interface{}{
"ids": []uint{q1ID, q2ID, q3ID},
}, http.StatusOK, &delBatchResp)
@ -11435,7 +11435,7 @@ func createSession(t *testing.T, uid uint, ds fleet.Datastore) *fleet.Session {
}
func (s *integrationTestSuite) cleanupQuery(queryID uint) {
var delResp deleteQueryByIDResponse
var delResp fleet.DeleteQueryByIDResponse
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", queryID), nil, http.StatusOK, &delResp)
}
@ -12748,8 +12748,8 @@ func (s *integrationTestSuite) TestQueryReports() {
require.NoError(t, err)
// Should return no results.
var gqrr getQueryReportResponse
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", usbDevicesQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
var gqrr fleet.GetQueryReportResponse
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", usbDevicesQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.NoError(t, gqrr.Err)
require.Equal(t, usbDevicesQuery.ID, gqrr.QueryID)
require.NotNil(t, gqrr.Results)
@ -12962,8 +12962,8 @@ func (s *integrationTestSuite) TestQueryReports() {
// Count stays the same because error rows don't count against the limit.
require.Equal(t, 3, counts[osqueryInfoQuery.ID])
gqrr = getQueryReportResponse{}
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", usbDevicesQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
gqrr = fleet.GetQueryReportResponse{}
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", usbDevicesQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.NoError(t, gqrr.Err)
require.Equal(t, usbDevicesQuery.ID, gqrr.QueryID)
require.Len(t, gqrr.Results, 2)
@ -13047,8 +13047,8 @@ func (s *integrationTestSuite) TestQueryReports() {
"version": "9.33",
}, ghqrr.Results[1].Columns)
gqrr = getQueryReportResponse{}
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
gqrr = fleet.GetQueryReportResponse{}
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.NoError(t, gqrr.Err)
require.Equal(t, osqueryInfoQuery.ID, gqrr.QueryID)
require.Len(t, gqrr.Results, 3)
@ -13108,8 +13108,8 @@ func (s *integrationTestSuite) TestQueryReports() {
"watcher": "1037",
}, gqrr.Results[2].Columns)
gqrr = getQueryReportResponse{}
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report?team_id=%d", osqueryInfoQuery.ID, team2.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
gqrr = fleet.GetQueryReportResponse{}
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report?team_id=%d", osqueryInfoQuery.ID, team2.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.NoError(t, gqrr.Err)
require.Equal(t, osqueryInfoQuery.ID, gqrr.QueryID)
require.Len(t, gqrr.Results, 1)
@ -13147,18 +13147,18 @@ func (s *integrationTestSuite) TestQueryReports() {
require.Len(t, ghqrr.Results, 0)
// verify that certain modifications to queries don't cause result deletion
modifyQueryResp := modifyQueryResponse{}
modifyQueryResp := fleet.ModifyQueryResponse{}
updatedDesc := "Updated description"
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), modifyQueryRequest{ID: osqueryInfoQuery.ID, QueryPayload: fleet.QueryPayload{Description: &updatedDesc}}, http.StatusOK, &modifyQueryResp)
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), fleet.ModifyQueryRequest{ID: osqueryInfoQuery.ID, QueryPayload: fleet.QueryPayload{Description: &updatedDesc}}, http.StatusOK, &modifyQueryResp)
require.Equal(t, updatedDesc, modifyQueryResp.Query.Description)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 3)
// now update the query and verify that results are deleted
updatedQuery := "SELECT * FROM some_new_table;"
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), modifyQueryRequest{ID: osqueryInfoQuery.ID, QueryPayload: fleet.QueryPayload{Query: &updatedQuery}}, http.StatusOK, &modifyQueryResp)
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), fleet.ModifyQueryRequest{ID: osqueryInfoQuery.ID, QueryPayload: fleet.QueryPayload{Query: &updatedQuery}}, http.StatusOK, &modifyQueryResp)
require.Equal(t, updatedQuery, modifyQueryResp.Query.Query)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 0)
// Re-add results to our query and check that they're actually there
@ -13167,11 +13167,11 @@ func (s *integrationTestSuite) TestQueryReports() {
require.Equal(t, 2, counts[usbDevicesQuery.ID])
require.Equal(t, 1, counts[osqueryInfoQuery.ID])
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 1)
// now update the platform and verify that results are deleted
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), modifyQueryRequest{
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), fleet.ModifyQueryRequest{
ID: osqueryInfoQuery.ID,
QueryPayload: fleet.QueryPayload{
Platform: ptr.String("linux"),
@ -13181,19 +13181,19 @@ func (s *integrationTestSuite) TestQueryReports() {
&modifyQueryResp,
)
require.Equal(t, "linux", modifyQueryResp.Query.Platform)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 0)
// Re-add results to our query and check that they're actually there
s.DoJSON("POST", "/api/osquery/log", slreq, http.StatusOK, &slres)
require.NoError(t, slres.Err)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 1)
require.Equal(t, 2, counts[usbDevicesQuery.ID])
require.Equal(t, 1, counts[osqueryInfoQuery.ID])
// now update the platform to the same value and verify that results are not deleted
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), modifyQueryRequest{
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), fleet.ModifyQueryRequest{
ID: osqueryInfoQuery.ID,
QueryPayload: fleet.QueryPayload{
Platform: ptr.String("linux"),
@ -13203,11 +13203,11 @@ func (s *integrationTestSuite) TestQueryReports() {
&modifyQueryResp,
)
require.Equal(t, "linux", modifyQueryResp.Query.Platform)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 1)
// now update the min_osquery_version and verify that results are deleted
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), modifyQueryRequest{
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), fleet.ModifyQueryRequest{
ID: osqueryInfoQuery.ID,
QueryPayload: fleet.QueryPayload{
MinOsqueryVersion: ptr.String("5.9.1"),
@ -13217,19 +13217,19 @@ func (s *integrationTestSuite) TestQueryReports() {
&modifyQueryResp,
)
require.Equal(t, "5.9.1", modifyQueryResp.Query.MinOsqueryVersion)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 0)
// Re-add results to our query and check that they're actually there
s.DoJSON("POST", "/api/osquery/log", slreq, http.StatusOK, &slres)
require.NoError(t, slres.Err)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 1)
require.Equal(t, 2, counts[usbDevicesQuery.ID])
require.Equal(t, 1, counts[osqueryInfoQuery.ID])
// now update the min_osquery_version to another value and verify that results are deleted
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), modifyQueryRequest{
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), fleet.ModifyQueryRequest{
ID: osqueryInfoQuery.ID,
QueryPayload: fleet.QueryPayload{
MinOsqueryVersion: ptr.String("5.11.0"),
@ -13239,18 +13239,18 @@ func (s *integrationTestSuite) TestQueryReports() {
&modifyQueryResp,
)
require.Equal(t, "5.11.0", modifyQueryResp.Query.MinOsqueryVersion)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 0)
// Re-add results to our query and check that they're actually there
s.DoJSON("POST", "/api/osquery/log", slreq, http.StatusOK, &slres)
require.NoError(t, slres.Err)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 1)
require.Equal(t, 1, counts[osqueryInfoQuery.ID])
// now update the min_osquery_version to the same value and verify that results are not deleted
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), modifyQueryRequest{
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), fleet.ModifyQueryRequest{
ID: osqueryInfoQuery.ID,
QueryPayload: fleet.QueryPayload{
MinOsqueryVersion: ptr.String("5.11.0"),
@ -13260,7 +13260,7 @@ func (s *integrationTestSuite) TestQueryReports() {
&modifyQueryResp,
)
require.Equal(t, "5.11.0", modifyQueryResp.Query.MinOsqueryVersion)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 1)
// now update the query via specs and change the min_osquery_version, results should be deleted.
@ -13277,11 +13277,11 @@ func (s *integrationTestSuite) TestQueryReports() {
DiscardData: osqueryInfoQuery.DiscardData,
}
osqueryInfoQuerySpec.MinOsqueryVersion = "5.12.0"
var applyResp applyQuerySpecsResponse
s.DoJSON("POST", "/api/latest/fleet/spec/queries", applyQuerySpecsRequest{
var applyResp fleet.ApplyQuerySpecsResponse
s.DoJSON("POST", "/api/latest/fleet/spec/queries", fleet.ApplyQuerySpecsRequest{
Specs: []*fleet.QuerySpec{osqueryInfoQuerySpec},
}, http.StatusOK, &applyResp)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 0)
require.False(t, gqrr.ReportClipped)
require.Equal(t, 0, counts[osqueryInfoQuery.ID]) // counter reset after min_osquery_version change
@ -13289,33 +13289,33 @@ func (s *integrationTestSuite) TestQueryReports() {
// Re-add results to our query and check that they're actually there
s.DoJSON("POST", "/api/osquery/log", slreq, http.StatusOK, &slres)
require.NoError(t, slres.Err)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 1)
require.False(t, gqrr.ReportClipped)
require.Equal(t, 1, counts[osqueryInfoQuery.ID])
// don't change platform or min_osquery_version and results should not be deleted
s.DoJSON("POST", "/api/latest/fleet/spec/queries", applyQuerySpecsRequest{
s.DoJSON("POST", "/api/latest/fleet/spec/queries", fleet.ApplyQuerySpecsRequest{
Specs: []*fleet.QuerySpec{osqueryInfoQuerySpec},
}, http.StatusOK, &applyResp)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 1)
require.False(t, gqrr.ReportClipped)
// now update the platform and results should be deleted.
osqueryInfoQuerySpec.Platform = "darwin"
s.DoJSON("POST", "/api/latest/fleet/spec/queries", applyQuerySpecsRequest{
s.DoJSON("POST", "/api/latest/fleet/spec/queries", fleet.ApplyQuerySpecsRequest{
Specs: []*fleet.QuerySpec{osqueryInfoQuerySpec},
}, http.StatusOK, &applyResp)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 0)
require.False(t, gqrr.ReportClipped)
require.Equal(t, 0, counts[osqueryInfoQuery.ID]) // counter reset after platform change
// Update logging type, which should cause results deletion
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", usbDevicesQuery.ID), modifyQueryRequest{ID: usbDevicesQuery.ID, QueryPayload: fleet.QueryPayload{Logging: &fleet.LoggingDifferential}}, http.StatusOK, &modifyQueryResp)
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", usbDevicesQuery.ID), fleet.ModifyQueryRequest{ID: usbDevicesQuery.ID, QueryPayload: fleet.QueryPayload{Logging: &fleet.LoggingDifferential}}, http.StatusOK, &modifyQueryResp)
require.Equal(t, fleet.LoggingDifferential, modifyQueryResp.Query.Logging)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", usbDevicesQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", usbDevicesQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 0)
require.False(t, gqrr.ReportClipped)
require.Equal(t, 0, counts[usbDevicesQuery.ID]) // counter reset after logging type change
@ -13323,15 +13323,15 @@ func (s *integrationTestSuite) TestQueryReports() {
// Re-add results to our query and check that they're actually there
s.DoJSON("POST", "/api/osquery/log", slreq, http.StatusOK, &slres)
require.NoError(t, slres.Err)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 1)
require.False(t, gqrr.ReportClipped)
require.Equal(t, 1, counts[osqueryInfoQuery.ID])
discardData := true
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), modifyQueryRequest{ID: osqueryInfoQuery.ID, QueryPayload: fleet.QueryPayload{DiscardData: &discardData}}, http.StatusOK, &modifyQueryResp)
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), fleet.ModifyQueryRequest{ID: osqueryInfoQuery.ID, QueryPayload: fleet.QueryPayload{DiscardData: &discardData}}, http.StatusOK, &modifyQueryResp)
require.True(t, modifyQueryResp.Query.DiscardData)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 0)
require.False(t, gqrr.ReportClipped)
require.Equal(t, 0, counts[osqueryInfoQuery.ID]) // counter reset after discardData=true
@ -13339,7 +13339,7 @@ func (s *integrationTestSuite) TestQueryReports() {
// check that now that discardData is set, we don't add new results
s.DoJSON("POST", "/api/osquery/log", slreq, http.StatusOK, &slres)
require.NoError(t, slres.Err)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 0)
require.False(t, gqrr.ReportClipped)
@ -13347,7 +13347,7 @@ func (s *integrationTestSuite) TestQueryReports() {
// The system allows up to limit+10% rows before blocking new inserts.
// This ensures the cleanup cron always has rows to delete, enabling rotation.
discardData = false
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), modifyQueryRequest{ID: osqueryInfoQuery.ID, QueryPayload: fleet.QueryPayload{DiscardData: &discardData}}, http.StatusOK, &modifyQueryResp)
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", osqueryInfoQuery.ID), fleet.ModifyQueryRequest{ID: osqueryInfoQuery.ID, QueryPayload: fleet.QueryPayload{DiscardData: &discardData}}, http.StatusOK, &modifyQueryResp)
require.False(t, modifyQueryResp.Query.DiscardData)
// Host1 submits exactly the max rows
@ -13381,7 +13381,7 @@ func (s *integrationTestSuite) TestQueryReports() {
// Host1 submits same rows again (overwrite), should still have 1000 rows
s.DoJSON("POST", "/api/osquery/log", slreq, http.StatusOK, &slres)
require.NoError(t, slres.Err)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, fleet.DefaultMaxQueryReportRows)
require.True(t, gqrr.ReportClipped)
require.Equal(t, fleet.DefaultMaxQueryReportRows, counts[osqueryInfoQuery.ID]) // counter unchanged after overwrite
@ -13421,7 +13421,7 @@ func (s *integrationTestSuite) TestQueryReports() {
require.NoError(t, slres.Err)
// Now we have 2000 rows (1000 from host1, 1000 from host2)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, fleet.DefaultMaxQueryReportRows*2)
require.True(t, gqrr.ReportClipped)
require.Equal(t, fleet.DefaultMaxQueryReportRows*2, counts[osqueryInfoQuery.ID]) // counter is now 2000
@ -13448,7 +13448,7 @@ func (s *integrationTestSuite) TestQueryReports() {
s.DoJSON("POST", "/api/osquery/log", slreq, http.StatusOK, &slres)
require.NoError(t, slres.Err)
// Still 2000 rows since the submission was blocked
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, fleet.DefaultMaxQueryReportRows*2)
require.True(t, gqrr.ReportClipped)
require.Equal(t, fleet.DefaultMaxQueryReportRows*2, counts[osqueryInfoQuery.ID]) // counter unchanged (blocked)
@ -13460,7 +13460,7 @@ func (s *integrationTestSuite) TestQueryReports() {
s.Do("PATCH", "/api/latest/fleet/config", appConfigSpec, http.StatusOK)
// With limit 3000, we have 2000 rows, which is below the limit, so not clipped
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, fleet.DefaultMaxQueryReportRows*2)
require.False(t, gqrr.ReportClipped)
@ -13488,7 +13488,7 @@ func (s *integrationTestSuite) TestQueryReports() {
require.NoError(t, slres.Err)
// Host1's 1000 rows were replaced with 500 rows, so total is now 1500 (500 from host1, 1000 from host2)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), getQueryReportRequest{}, http.StatusOK, &gqrr)
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d/report", osqueryInfoQuery.ID), fleet.GetQueryReportRequest{}, http.StatusOK, &gqrr)
require.Len(t, gqrr.Results, 1500)
require.Equal(t, 1500, counts[osqueryInfoQuery.ID]) // counter unchanged (blocked)
require.False(t, gqrr.ReportClipped)

76
server/service/integration_enterprise_test.go
View file

@ -1587,7 +1587,7 @@ func (s *integrationEnterpriseTestSuite) TestTeamQueries() {
Name: ptr.String("global1"),
Query: ptr.String("select * from time;"),
}
var createQueryResp createQueryResponse
var createQueryResp fleet.CreateQueryResponse
s.DoJSON("POST", "/api/latest/fleet/queries", &params, http.StatusOK, &createQueryResp)
defer s.cleanupQuery(createQueryResp.Query.ID)
@ -1597,12 +1597,12 @@ func (s *integrationEnterpriseTestSuite) TestTeamQueries() {
Query: ptr.String("select * from time;"),
TeamID: ptr.Uint(team1.ID),
}
createQueryResp = createQueryResponse{}
createQueryResp = fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", &params, http.StatusOK, &createQueryResp)
defer s.cleanupQuery(createQueryResp.Query.ID)
// list team queries
var listQueriesResp listQueriesResponse
var listQueriesResp fleet.ListQueriesResponse
s.DoJSON("GET", "/api/latest/fleet/queries", nil, http.StatusOK, &listQueriesResp, "team_id", fmt.Sprint(team1.ID))
require.Len(t, listQueriesResp.Queries, 1)
assert.Equal(t, "team1", listQueriesResp.Queries[0].Name)
@ -6900,29 +6900,29 @@ func (s *integrationEnterpriseTestSuite) TestGitOpsUserActions() {
}, http.StatusForbidden, &runLiveQueryResponse{})
// Attempt to create queries, should allow.
cqr := createQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", createQueryRequest{
cqr := fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.CreateQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo4"),
Query: ptr.String("SELECT * from osquery_info;"),
},
}, http.StatusOK, &cqr)
cqr2 := createQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", createQueryRequest{
cqr2 := fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.CreateQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo5"),
Query: ptr.String("SELECT * from os_version;"),
},
}, http.StatusOK, &cqr2)
cqr3 := createQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", createQueryRequest{
cqr3 := fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.CreateQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo6"),
Query: ptr.String("SELECT * from processes;"),
},
}, http.StatusOK, &cqr3)
cqr4 := createQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", createQueryRequest{
cqr4 := fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.CreateQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo7"),
Query: ptr.String("SELECT * from managed_policies;"),
@ -6930,41 +6930,41 @@ func (s *integrationEnterpriseTestSuite) TestGitOpsUserActions() {
}, http.StatusOK, &cqr4)
// Attempt to edit queries, should allow.
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", cqr.Query.ID), modifyQueryRequest{
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", cqr.Query.ID), fleet.ModifyQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo4"),
Query: ptr.String("SELECT * FROM system_info;"),
},
}, http.StatusOK, &modifyQueryResponse{})
}, http.StatusOK, &fleet.ModifyQueryResponse{})
// Attempt to view a query, should work.
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d", cqr.Query.ID), getQueryRequest{}, http.StatusOK, &getQueryResponse{})
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d", cqr.Query.ID), fleet.GetQueryRequest{}, http.StatusOK, &fleet.GetQueryResponse{})
// Attempt to list all queries, should work.
s.DoJSON("GET", "/api/latest/fleet/queries", listQueriesRequest{}, http.StatusOK, &listQueriesResponse{})
s.DoJSON("GET", "/api/latest/fleet/queries", fleet.ListQueriesRequest{}, http.StatusOK, &fleet.ListQueriesResponse{})
// Attempt to delete queries, should allow.
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", cqr.Query.ID), deleteQueryByIDRequest{}, http.StatusOK, &deleteQueryByIDResponse{})
s.DoJSON("POST", "/api/latest/fleet/queries/delete", deleteQueriesRequest{IDs: []uint{cqr2.Query.ID}}, http.StatusOK, &deleteQueriesResponse{})
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/%s", cqr3.Query.Name), deleteQueryRequest{}, http.StatusOK, &deleteQueryResponse{})
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", cqr.Query.ID), fleet.DeleteQueryByIDRequest{}, http.StatusOK, &fleet.DeleteQueryByIDResponse{})
s.DoJSON("POST", "/api/latest/fleet/queries/delete", fleet.DeleteQueriesRequest{IDs: []uint{cqr2.Query.ID}}, http.StatusOK, &fleet.DeleteQueriesResponse{})
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/%s", cqr3.Query.Name), fleet.DeleteQueryRequest{}, http.StatusOK, &fleet.DeleteQueryResponse{})
// Attempt to add a query to a user pack, should allow.
sqr := scheduleQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/packs/schedule", scheduleQueryRequest{
sqr := fleet.ScheduleQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/packs/schedule", fleet.ScheduleQueryRequest{
PackID: userPackID,
QueryID: cqr4.Query.ID,
Interval: 60,
}, http.StatusOK, &sqr)
// Attempt to edit a scheduled query in the global schedule, should allow.
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/packs/schedule/%d", sqr.Scheduled.ID), modifyScheduledQueryRequest{
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/packs/schedule/%d", sqr.Scheduled.ID), fleet.ModifyScheduledQueryRequest{
ScheduledQueryPayload: fleet.ScheduledQueryPayload{
Interval: ptr.Uint(30),
},
}, http.StatusOK, &scheduleQueryResponse{})
}, http.StatusOK, &fleet.ScheduleQueryResponse{})
// Attempt to remove a query from the global schedule, should allow.
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/packs/schedule/%d", sqr.Scheduled.ID), deleteScheduledQueryRequest{}, http.StatusOK, &scheduleQueryResponse{})
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/packs/schedule/%d", sqr.Scheduled.ID), fleet.DeleteScheduledQueryRequest{}, http.StatusOK, &fleet.DeleteScheduledQueryResponse{})
// Attempt to read the global schedule, should allow.
s.DoJSON("GET", "/api/latest/fleet/schedule", nil, http.StatusOK, &getGlobalScheduleResponse{})
@ -7167,8 +7167,8 @@ func (s *integrationEnterpriseTestSuite) TestGitOpsUserActions() {
s.setTokenForTest(t, "gitops2@example.com", test.GoodPassword)
// Attempt to create queries in global domain, should fail.
tcqr := createQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", createQueryRequest{
tcqr := fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.CreateQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo600"),
Query: ptr.String("SELECT * from orbit_info;"),
@ -7176,8 +7176,8 @@ func (s *integrationEnterpriseTestSuite) TestGitOpsUserActions() {
}, http.StatusForbidden, &tcqr)
// Attempt to create queries in its team, should allow.
tcqr = createQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", createQueryRequest{
tcqr = fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.CreateQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo600"),
Query: ptr.String("SELECT * from orbit_info;"),
@ -7186,26 +7186,26 @@ func (s *integrationEnterpriseTestSuite) TestGitOpsUserActions() {
}, http.StatusOK, &tcqr)
// Attempt to edit own query, should allow.
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", tcqr.Query.ID), modifyQueryRequest{
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", tcqr.Query.ID), fleet.ModifyQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo4"),
Query: ptr.String("SELECT * FROM system_info;"),
},
}, http.StatusOK, &modifyQueryResponse{})
}, http.StatusOK, &fleet.ModifyQueryResponse{})
// Attempt to delete own query, should allow.
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", tcqr.Query.ID), deleteQueryByIDRequest{}, http.StatusOK, &deleteQueryByIDResponse{})
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", tcqr.Query.ID), fleet.DeleteQueryByIDRequest{}, http.StatusOK, &fleet.DeleteQueryByIDResponse{})
// Attempt to edit query created by somebody else, should fail.
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", cqr4.Query.ID), modifyQueryRequest{
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", cqr4.Query.ID), fleet.ModifyQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo4"),
Query: ptr.String("SELECT * FROM system_info;"),
},
}, http.StatusForbidden, &modifyQueryResponse{})
}, http.StatusForbidden, &fleet.ModifyQueryResponse{})
// Attempt to delete query created by somebody else, should fail.
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", cqr4.Query.ID), deleteQueryByIDRequest{}, http.StatusForbidden, &deleteQueryByIDResponse{})
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", cqr4.Query.ID), fleet.DeleteQueryByIDRequest{}, http.StatusForbidden, &fleet.DeleteQueryByIDResponse{})
// Attempt to read the global schedule, should fail.
s.DoJSON("GET", "/api/latest/fleet/schedule", nil, http.StatusForbidden, &getGlobalScheduleResponse{})
@ -7220,16 +7220,16 @@ func (s *integrationEnterpriseTestSuite) TestGitOpsUserActions() {
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d/schedule", t2.ID), getTeamScheduleRequest{}, http.StatusForbidden, &getTeamScheduleResponse{})
// Attempt to add a query to a user pack, should fail.
tsqr := scheduleQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/packs/schedule", scheduleQueryRequest{
tsqr := fleet.ScheduleQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/packs/schedule", fleet.ScheduleQueryRequest{
PackID: userPackID,
QueryID: cqr4.Query.ID,
Interval: 60,
}, http.StatusForbidden, &tsqr)
// Attempt to add a query to the team's schedule, should allow.
cqrt1 := createQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", createQueryRequest{
cqrt1 := fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.CreateQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo8"),
Query: ptr.String("SELECT * from managed_policies;"),
@ -15851,7 +15851,7 @@ func triggerAndWait(ctx context.Context, t *testing.T, ds fleet.Datastore, s *sc
}
func (s *integrationEnterpriseTestSuite) cleanupQuery(queryID uint) {
var delResp deleteQueryByIDResponse
var delResp fleet.DeleteQueryByIDResponse
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", queryID), nil, http.StatusOK, &delResp)
}

2
server/service/integration_logger_test.go
View file

@ -73,7 +73,7 @@ func (s *integrationLoggerTestSuite) TestLogger() {
"query": "select 1 from osquery;",
"fleet_id": nil,
}
var createResp createQueryResponse
var createResp fleet.CreateQueryResponse
s.DoJSON("POST", "/api/latest/fleet/queries", params, http.StatusOK, &createResp)
records := s.handler.Records()

68
server/service/integration_mdm_test.go
View file

@ -20945,7 +20945,7 @@ func (s *integrationMDMTestSuite) TestTeamLabelsAssociationsCheck() {
t.Run("2. query labels assignment checks", func(t *testing.T) {
// 2.A.1 Attempt to create global query with team labels (should fail).
var createQueryResp createQueryResponse
var createQueryResp fleet.CreateQueryResponse
reqQuery := &fleet.QueryPayload{
Name: ptr.String("All teams query"),
Query: ptr.String("SELECT 1;"),
@ -20954,7 +20954,7 @@ func (s *integrationMDMTestSuite) TestTeamLabelsAssociationsCheck() {
s.DoJSON("POST", "/api/latest/fleet/queries", reqQuery, http.StatusBadRequest, &createQueryResp)
// 2.A.2 Attempt to create global query with global label (should succeed).
createQueryResp = createQueryResponse{}
createQueryResp = fleet.CreateQueryResponse{}
reqQuery = &fleet.QueryPayload{
Name: ptr.String("All teams query"),
Query: ptr.String("SELECT 1;"),
@ -20964,23 +20964,23 @@ func (s *integrationMDMTestSuite) TestTeamLabelsAssociationsCheck() {
globalQueryID := createQueryResp.Query.ID
// 2.A.3 Attempt to edit global query with team label (should fail).
modifyQueryResp := modifyQueryResponse{}
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", globalQueryID), modifyQueryRequest{
modifyQueryResp := fleet.ModifyQueryResponse{}
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", globalQueryID), fleet.ModifyQueryRequest{
QueryPayload: fleet.QueryPayload{
LabelsIncludeAny: []string{l1t1.Name},
},
}, http.StatusBadRequest, &modifyQueryResp)
// 2.A.4 Attempt to edit global query with global label (should succeed).
modifyQueryResp = modifyQueryResponse{}
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", globalQueryID), modifyQueryRequest{
modifyQueryResp = fleet.ModifyQueryResponse{}
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", globalQueryID), fleet.ModifyQueryRequest{
QueryPayload: fleet.QueryPayload{
LabelsIncludeAny: []string{globalLabel.Name},
},
}, http.StatusOK, &modifyQueryResp)
// 2.B.1 Attempt to create a team query with a label of another team (should fail).
createQueryResp = createQueryResponse{}
createQueryResp = fleet.CreateQueryResponse{}
reqQuery = &fleet.QueryPayload{
Name: ptr.String("Team one query"),
Query: ptr.String("SELECT 1;"),
@ -20991,7 +20991,7 @@ func (s *integrationMDMTestSuite) TestTeamLabelsAssociationsCheck() {
s.DoJSON("POST", "/api/latest/fleet/queries", reqQuery, http.StatusBadRequest, &createQueryResp)
// 2.B.2 Attempt to create a team query with a label of the same team (should succeed).
createQueryResp = createQueryResponse{}
createQueryResp = fleet.CreateQueryResponse{}
reqQuery = &fleet.QueryPayload{
Name: ptr.String("Team one query"),
Query: ptr.String("SELECT 1;"),
@ -21003,16 +21003,16 @@ func (s *integrationMDMTestSuite) TestTeamLabelsAssociationsCheck() {
team1LabelID := createQueryResp.Query.ID
// 2.A.3 Attempt to edit a team query with a label of another team (should fail).
modifyQueryResp = modifyQueryResponse{}
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", team1LabelID), modifyQueryRequest{
modifyQueryResp = fleet.ModifyQueryResponse{}
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", team1LabelID), fleet.ModifyQueryRequest{
QueryPayload: fleet.QueryPayload{
LabelsIncludeAny: []string{l2t2.Name, globalLabel.Name},
},
}, http.StatusBadRequest, &modifyQueryResp)
// 2.A.4 Attempt to edit team query with a label of the same team (should succeed).
modifyQueryResp = modifyQueryResponse{}
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", team1LabelID), modifyQueryRequest{
modifyQueryResp = fleet.ModifyQueryResponse{}
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", team1LabelID), fleet.ModifyQueryRequest{
QueryPayload: fleet.QueryPayload{
LabelsIncludeAny: []string{l1t1.Name},
},
@ -21839,8 +21839,8 @@ func (s *integrationMDMTestSuite) TestTechnicianPermissions() {
}, http.StatusOK, &runLiveQueryResponse{})
// Attempt to create queries, should fail.
cqr := createQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", createQueryRequest{
cqr := fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.CreateQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo4"),
Query: ptr.String("SELECT * from osquery_info;"),
@ -21848,27 +21848,27 @@ func (s *integrationMDMTestSuite) TestTechnicianPermissions() {
}, http.StatusForbidden, &cqr)
// Attempt to edit queries, should fail.
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", q1.ID), modifyQueryRequest{
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", q1.ID), fleet.ModifyQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo4"),
Query: ptr.String("SELECT * FROM system_info;"),
},
}, http.StatusForbidden, &modifyQueryResponse{})
}, http.StatusForbidden, &fleet.ModifyQueryResponse{})
// Attempt to view a query, should work.
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d", q1.ID), getQueryRequest{}, http.StatusOK, &getQueryResponse{})
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/queries/%d", q1.ID), fleet.GetQueryRequest{}, http.StatusOK, &fleet.GetQueryResponse{})
// Attempt to list all queries, should work.
s.DoJSON("GET", "/api/latest/fleet/queries", listQueriesRequest{}, http.StatusOK, &listQueriesResponse{})
s.DoJSON("GET", "/api/latest/fleet/queries", fleet.ListQueriesRequest{}, http.StatusOK, &fleet.ListQueriesResponse{})
// Attempt to delete queries, should fail.
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", q1.ID), deleteQueryByIDRequest{}, http.StatusForbidden, &deleteQueryByIDResponse{})
s.DoJSON("POST", "/api/latest/fleet/queries/delete", deleteQueriesRequest{IDs: []uint{q1.ID}}, http.StatusForbidden, &deleteQueriesResponse{})
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/%s", q1.Name), deleteQueryRequest{}, http.StatusForbidden, &deleteQueryResponse{})
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", q1.ID), fleet.DeleteQueryByIDRequest{}, http.StatusForbidden, &fleet.DeleteQueryByIDResponse{})
s.DoJSON("POST", "/api/latest/fleet/queries/delete", fleet.DeleteQueriesRequest{IDs: []uint{q1.ID}}, http.StatusForbidden, &fleet.DeleteQueriesResponse{})
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/%s", q1.Name), fleet.DeleteQueryRequest{}, http.StatusForbidden, &fleet.DeleteQueryResponse{})
// Attempt to add a query to a user pack, should fail.
sqr := scheduleQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/packs/schedule", scheduleQueryRequest{
sqr := fleet.ScheduleQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/packs/schedule", fleet.ScheduleQueryRequest{
PackID: userPackID,
QueryID: q1.ID,
Interval: 60,
@ -22180,8 +22180,8 @@ func (s *integrationMDMTestSuite) TestTechnicianPermissions() {
require.Nil(t, teamTechConfigResp.AgentOptions)
// Attempt to create queries in global domain, should allow.
tcqr := createQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", createQueryRequest{
tcqr := fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.CreateQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo600"),
Query: ptr.String("SELECT * from orbit_info;"),
@ -22189,8 +22189,8 @@ func (s *integrationMDMTestSuite) TestTechnicianPermissions() {
}, http.StatusForbidden, &tcqr)
// Attempt to create queries in its team, should fail.
tcqr = createQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", createQueryRequest{
tcqr = fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.CreateQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo600"),
Query: ptr.String("SELECT * from orbit_info;"),
@ -22199,15 +22199,15 @@ func (s *integrationMDMTestSuite) TestTechnicianPermissions() {
}, http.StatusForbidden, &tcqr)
// Attempt to edit query, should fail.
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", q1.ID), modifyQueryRequest{
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/queries/%d", q1.ID), fleet.ModifyQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo4"),
Query: ptr.String("SELECT * FROM system_info;"),
},
}, http.StatusForbidden, &modifyQueryResponse{})
}, http.StatusForbidden, &fleet.ModifyQueryResponse{})
// Attempt to delete query, should fail.
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", q1.ID), deleteQueryByIDRequest{}, http.StatusForbidden, &deleteQueryByIDResponse{})
s.DoJSON("DELETE", fmt.Sprintf("/api/latest/fleet/queries/id/%d", q1.ID), fleet.DeleteQueryByIDRequest{}, http.StatusForbidden, &fleet.DeleteQueryByIDResponse{})
// Attempt to read the global schedule, should allow.
s.DoJSON("GET", "/api/latest/fleet/schedule", nil, http.StatusOK, &getGlobalScheduleResponse{})
@ -22222,16 +22222,16 @@ func (s *integrationMDMTestSuite) TestTechnicianPermissions() {
s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d/schedule", t2.ID), getTeamScheduleRequest{}, http.StatusForbidden, &getTeamScheduleResponse{})
// Attempt to add a query to a user pack, should fail.
tsqr := scheduleQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/packs/schedule", scheduleQueryRequest{
tsqr := fleet.ScheduleQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/packs/schedule", fleet.ScheduleQueryRequest{
PackID: userPackID,
QueryID: q1.ID,
Interval: 60,
}, http.StatusForbidden, &tsqr)
// Attempt to add a query to the team's schedule, should fail.
cqrt1 := createQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", createQueryRequest{
cqrt1 := fleet.CreateQueryResponse{}
s.DoJSON("POST", "/api/latest/fleet/queries", fleet.CreateQueryRequest{
QueryPayload: fleet.QueryPayload{
Name: ptr.String("foo8"),
Query: ptr.String("SELECT * from managed_policies;"),

214
server/service/queries.go
View file

@ -19,29 +19,13 @@ import (
// Get Query
////////////////////////////////////////////////////////////////////////////////
type getQueryRequest struct {
ID uint `url:"id"`
}
type getQueryResponse struct {
// Because `fleet.Query` has a `query` field that we don't want to rename,
// it's simpler to just duplicate the query in the response struct rather than
// relying on the `renameto` tag here.
// TODO - In Fleet 5, remove the extra field.
Query *fleet.Query `json:"query,omitempty"`
Report *fleet.Query `json:"report,omitempty"`
Err error `json:"error,omitempty"`
}
func (r getQueryResponse) Error() error { return r.Err }
func getQueryEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*getQueryRequest)
req := request.(*fleet.GetQueryRequest)
query, err := svc.GetQuery(ctx, req.ID)
if err != nil {
return getQueryResponse{Err: err}, nil
return fleet.GetQueryResponse{Err: err}, nil
}
return getQueryResponse{Query: query, Report: query}, nil
return fleet.GetQueryResponse{Query: query, Report: query}, nil
}
func (svc *Service) GetQuery(ctx context.Context, id uint) (*fleet.Query, error) {
@ -61,27 +45,8 @@ func (svc *Service) GetQuery(ctx context.Context, id uint) (*fleet.Query, error)
// List Queries
////////////////////////////////////////////////////////////////////////////////
type listQueriesRequest struct {
ListOptions fleet.ListOptions `url:"list_options"`
// TeamID url argument set to 0 means global.
TeamID uint `query:"team_id,optional" renameto:"fleet_id"`
MergeInherited bool `query:"merge_inherited,optional"`
// only return queries targeted to run on this platform
Platform string `query:"platform,optional"`
}
type listQueriesResponse struct {
Queries []fleet.Query `json:"queries" renameto:"reports"`
Count int `json:"count"`
InheritedQueryCount int `json:"inherited_query_count" renameto:"inherited_report_count"`
Meta *fleet.PaginationMetadata `json:"meta"`
Err error `json:"error,omitempty"`
}
func (r listQueriesResponse) Error() error { return r.Err }
func listQueriesEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*listQueriesRequest)
req := request.(*fleet.ListQueriesRequest)
var teamID *uint
if req.TeamID != 0 {
@ -95,7 +60,7 @@ func listQueriesEndpoint(ctx context.Context, request interface{}, svc fleet.Ser
queries, count, inheritedCount, meta, err := svc.ListQueries(ctx, req.ListOptions, teamID, nil, req.MergeInherited, urlPlatform)
if err != nil {
return listQueriesResponse{Err: err}, nil
return fleet.ListQueriesResponse{Err: err}, nil
}
respQueries := make([]fleet.Query, 0, len(queries))
@ -103,7 +68,7 @@ func listQueriesEndpoint(ctx context.Context, request interface{}, svc fleet.Ser
respQueries = append(respQueries, *query)
}
return listQueriesResponse{
return fleet.ListQueriesResponse{
Queries: respQueries,
Count: count,
InheritedQueryCount: inheritedCount,
@ -158,32 +123,18 @@ func (svc *Service) ListQueries(ctx context.Context, opt fleet.ListOptions, team
// Query Reports
////////////////////////////////////////////////////////////////////////////////
type getQueryReportRequest struct {
ID uint `url:"id"`
TeamID *uint `query:"team_id,optional" renameto:"fleet_id"`
}
type getQueryReportResponse struct {
QueryID uint `json:"query_id" renameto:"report_id"`
Results []fleet.HostQueryResultRow `json:"results"`
ReportClipped bool `json:"report_clipped"`
Err error `json:"error,omitempty"`
}
func (r getQueryReportResponse) Error() error { return r.Err }
func getQueryReportEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*getQueryReportRequest)
req := request.(*fleet.GetQueryReportRequest)
queryReportResults, reportClipped, err := svc.GetQueryReportResults(ctx, req.ID, req.TeamID)
if err != nil {
return listQueriesResponse{Err: err}, nil
return fleet.GetQueryReportResponse{Err: err}, nil
}
// Return an empty array if there are no results stored.
results := []fleet.HostQueryResultRow{}
if len(queryReportResults) > 0 {
results = queryReportResults
}
return getQueryReportResponse{
return fleet.GetQueryReportResponse{
QueryID: req.ID,
Results: results,
ReportClipped: reportClipped,
@ -251,29 +202,13 @@ func (svc *Service) QueryReportIsClipped(ctx context.Context, queryID uint, maxQ
// Create Query
////////////////////////////////////////////////////////////////////////////////
type createQueryRequest struct {
fleet.QueryPayload
}
type createQueryResponse struct {
// Because `fleet.Query` has a `query` field that we don't want to rename,
// it's simpler to just duplicate the query in the response struct rather than
// relying on the `renameto` tag here.
// TODO - In Fleet 5, remove the extra field.
Query *fleet.Query `json:"query,omitempty"`
Report *fleet.Query `json:"report,omitempty"`
Err error `json:"error,omitempty"`
}
func (r createQueryResponse) Error() error { return r.Err }
func createQueryEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*createQueryRequest)
req := request.(*fleet.CreateQueryRequest)
query, err := svc.NewQuery(ctx, req.QueryPayload)
if err != nil {
return createQueryResponse{Err: err}, nil
return fleet.CreateQueryResponse{Err: err}, nil
}
return createQueryResponse{Query: query, Report: query}, nil
return fleet.CreateQueryResponse{Query: query, Report: query}, nil
}
func (svc *Service) NewQuery(ctx context.Context, p fleet.QueryPayload) (*fleet.Query, error) {
@ -393,30 +328,13 @@ func (svc *Service) NewQuery(ctx context.Context, p fleet.QueryPayload) (*fleet.
// Modify Query
////////////////////////////////////////////////////////////////////////////////
type modifyQueryRequest struct {
ID uint `json:"-" url:"id"`
fleet.QueryPayload
}
type modifyQueryResponse struct {
// Because `fleet.Query` has a `query` field that we don't want to rename,
// it's simpler to just duplicate the query in the response struct rather than
// relying on the `renameto` tag here.
// TODO - In Fleet 5, remove the extra field.
Query *fleet.Query `json:"query,omitempty"`
Report *fleet.Query `json:"report,omitempty"`
Err error `json:"error,omitempty"`
}
func (r modifyQueryResponse) Error() error { return r.Err }
func modifyQueryEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*modifyQueryRequest)
req := request.(*fleet.ModifyQueryRequest)
query, err := svc.ModifyQuery(ctx, req.ID, req.QueryPayload)
if err != nil {
return modifyQueryResponse{Err: err}, nil
return fleet.ModifyQueryResponse{Err: err}, nil
}
return modifyQueryResponse{Query: query, Report: query}, nil
return fleet.ModifyQueryResponse{Query: query, Report: query}, nil
}
func (svc *Service) ModifyQuery(ctx context.Context, id uint, p fleet.QueryPayload) (*fleet.Query, error) {
@ -573,29 +491,17 @@ func comparePlatforms(platform1, platform2 string) bool {
// Delete Query
////////////////////////////////////////////////////////////////////////////////
type deleteQueryRequest struct {
Name string `url:"name"`
// TeamID if not set is assumed to be 0 (global).
TeamID uint `url:"fleet_id,optional"`
}
type deleteQueryResponse struct {
Err error `json:"error,omitempty"`
}
func (r deleteQueryResponse) Error() error { return r.Err }
func deleteQueryEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*deleteQueryRequest)
req := request.(*fleet.DeleteQueryRequest)
var teamID *uint
if req.TeamID != 0 {
teamID = &req.TeamID
}
err := svc.DeleteQuery(ctx, teamID, req.Name)
if err != nil {
return deleteQueryResponse{Err: err}, nil
return fleet.DeleteQueryResponse{Err: err}, nil
}
return deleteQueryResponse{}, nil
return fleet.DeleteQueryResponse{}, nil
}
func (svc *Service) DeleteQuery(ctx context.Context, teamID *uint, name string) error {
@ -656,23 +562,13 @@ func (svc *Service) DeleteQuery(ctx context.Context, teamID *uint, name string)
// Delete Query By ID
////////////////////////////////////////////////////////////////////////////////
type deleteQueryByIDRequest struct {
ID uint `url:"id"`
}
type deleteQueryByIDResponse struct {
Err error `json:"error,omitempty"`
}
func (r deleteQueryByIDResponse) Error() error { return r.Err }
func deleteQueryByIDEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*deleteQueryByIDRequest)
req := request.(*fleet.DeleteQueryByIDRequest)
err := svc.DeleteQueryByID(ctx, req.ID)
if err != nil {
return deleteQueryByIDResponse{Err: err}, nil
return fleet.DeleteQueryByIDResponse{Err: err}, nil
}
return deleteQueryByIDResponse{}, nil
return fleet.DeleteQueryByIDResponse{}, nil
}
func (svc *Service) DeleteQueryByID(ctx context.Context, id uint) error {
@ -734,24 +630,13 @@ func (svc *Service) DeleteQueryByID(ctx context.Context, id uint) error {
// Delete Queries
////////////////////////////////////////////////////////////////////////////////
type deleteQueriesRequest struct {
IDs []uint `json:"ids"`
}
type deleteQueriesResponse struct {
Deleted uint `json:"deleted"`
Err error `json:"error,omitempty"`
}
func (r deleteQueriesResponse) Error() error { return r.Err }
func deleteQueriesEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*deleteQueriesRequest)
req := request.(*fleet.DeleteQueriesRequest)
deleted, err := svc.DeleteQueries(ctx, req.IDs)
if err != nil {
return deleteQueriesResponse{Err: err}, nil
return fleet.DeleteQueriesResponse{Err: err}, nil
}
return deleteQueriesResponse{Deleted: deleted}, nil
return fleet.DeleteQueriesResponse{Deleted: deleted}, nil
}
func (svc *Service) DeleteQueries(ctx context.Context, ids []uint) (uint, error) {
@ -816,23 +701,13 @@ func (svc *Service) DeleteQueries(ctx context.Context, ids []uint) (uint, error)
// Apply Query Specs
////////////////////////////////////////////////////////////////////////////////
type applyQuerySpecsRequest struct {
Specs []*fleet.QuerySpec `json:"specs"`
}
type applyQuerySpecsResponse struct {
Err error `json:"error,omitempty"`
}
func (r applyQuerySpecsResponse) Error() error { return r.Err }
func applyQuerySpecsEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*applyQuerySpecsRequest)
req := request.(*fleet.ApplyQuerySpecsRequest)
err := svc.ApplyQuerySpecs(ctx, req.Specs)
if err != nil {
return applyQuerySpecsResponse{Err: err}, nil
return fleet.ApplyQuerySpecsResponse{Err: err}, nil
}
return applyQuerySpecsResponse{}, nil
return fleet.ApplyQuerySpecsResponse{}, nil
}
func (svc *Service) ApplyQuerySpecs(ctx context.Context, specs []*fleet.QuerySpec) error {
@ -974,28 +849,17 @@ func (svc *Service) queryFromSpec(ctx context.Context, spec *fleet.QuerySpec) (*
// Get Query Specs
////////////////////////////////////////////////////////////////////////////////
type getQuerySpecsResponse struct {
Specs []*fleet.QuerySpec `json:"specs"`
Err error `json:"error,omitempty"`
}
type getQuerySpecsRequest struct {
TeamID uint `url:"fleet_id,optional"`
}
func (r getQuerySpecsResponse) Error() error { return r.Err }
func getQuerySpecsEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*getQuerySpecsRequest)
req := request.(*fleet.GetQuerySpecsRequest)
var teamID *uint
if req.TeamID != 0 {
teamID = &req.TeamID
}
specs, err := svc.GetQuerySpecs(ctx, teamID)
if err != nil {
return getQuerySpecsResponse{Err: err}, nil
return fleet.GetQuerySpecsResponse{Err: err}, nil
}
return getQuerySpecsResponse{Specs: specs}, nil
return fleet.GetQuerySpecsResponse{Specs: specs}, nil
}
func (svc *Service) GetQuerySpecs(ctx context.Context, teamID *uint) ([]*fleet.QuerySpec, error) {
@ -1050,29 +914,17 @@ func (svc *Service) specFromQuery(ctx context.Context, query *fleet.Query) (*fle
// Get Query Spec
////////////////////////////////////////////////////////////////////////////////
type getQuerySpecResponse struct {
Spec *fleet.QuerySpec `json:"specs,omitempty"`
Err error `json:"error,omitempty"`
}
type getQuerySpecRequest struct {
Name string `url:"name"`
TeamID uint `query:"team_id,optional" renameto:"fleet_id"`
}
func (r getQuerySpecResponse) Error() error { return r.Err }
func getQuerySpecEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*getQuerySpecRequest)
req := request.(*fleet.GetQuerySpecRequest)
var teamID *uint
if req.TeamID != 0 {
teamID = &req.TeamID
}
spec, err := svc.GetQuerySpec(ctx, teamID, req.Name)
if err != nil {
return getQuerySpecResponse{Err: err}, nil
return fleet.GetQuerySpecResponse{Err: err}, nil
}
return getQuerySpecResponse{Spec: spec}, nil
return fleet.GetQuerySpecResponse{Spec: spec}, nil
}
func (svc *Service) GetQuerySpec(ctx context.Context, teamID *uint, name string) (*fleet.QuerySpec, error) {

103
server/service/scheduled_queries.go
View file

@ -17,33 +17,17 @@ import (
// Get Scheduled Queries In Pack
////////////////////////////////////////////////////////////////////////////////
type getScheduledQueriesInPackRequest struct {
ID uint `url:"id"`
ListOptions fleet.ListOptions `url:"list_options"`
}
type scheduledQueryResponse struct {
fleet.ScheduledQuery
}
type getScheduledQueriesInPackResponse struct {
Scheduled []scheduledQueryResponse `json:"scheduled"`
Err error `json:"error,omitempty"`
}
func (r getScheduledQueriesInPackResponse) Error() error { return r.Err }
func getScheduledQueriesInPackEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*getScheduledQueriesInPackRequest)
resp := getScheduledQueriesInPackResponse{Scheduled: []scheduledQueryResponse{}}
req := request.(*fleet.GetScheduledQueriesInPackRequest)
resp := fleet.GetScheduledQueriesInPackResponse{Scheduled: []fleet.ScheduledQueryResponse{}}
queries, err := svc.GetScheduledQueriesInPack(ctx, req.ID, req.ListOptions)
if err != nil {
return getScheduledQueriesInPackResponse{Err: err}, nil
return fleet.GetScheduledQueriesInPackResponse{Err: err}, nil
}
for _, q := range queries {
resp.Scheduled = append(resp.Scheduled, scheduledQueryResponse{
resp.Scheduled = append(resp.Scheduled, fleet.ScheduledQueryResponse{
ScheduledQuery: *q,
})
}
@ -63,26 +47,8 @@ func (svc *Service) GetScheduledQueriesInPack(ctx context.Context, id uint, opts
// Schedule Query
////////////////////////////////////////////////////////////////////////////////
type scheduleQueryRequest struct {
PackID uint `json:"pack_id"`
QueryID uint `json:"query_id" renameto:"report_id"`
Interval uint `json:"interval"`
Snapshot *bool `json:"snapshot"`
Removed *bool `json:"removed"`
Platform *string `json:"platform"`
Version *string `json:"version"`
Shard *uint `json:"shard"`
}
type scheduleQueryResponse struct {
Scheduled *scheduledQueryResponse `json:"scheduled,omitempty"`
Err error `json:"error,omitempty"`
}
func (r scheduleQueryResponse) Error() error { return r.Err }
func scheduleQueryEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*scheduleQueryRequest)
req := request.(*fleet.ScheduleQueryRequest)
scheduled, err := svc.ScheduleQuery(ctx, &fleet.ScheduledQuery{
PackID: req.PackID,
@ -95,9 +61,9 @@ func scheduleQueryEndpoint(ctx context.Context, request interface{}, svc fleet.S
Shard: req.Shard,
})
if err != nil {
return scheduleQueryResponse{Err: err}, nil
return fleet.ScheduleQueryResponse{Err: err}, nil
}
return scheduleQueryResponse{Scheduled: &scheduledQueryResponse{
return fleet.ScheduleQueryResponse{Scheduled: &fleet.ScheduledQueryResponse{
ScheduledQuery: *scheduled,
}}, nil
}
@ -158,27 +124,16 @@ func findNextNameForQuery(name string, scheduled []*fleet.ScheduledQuery) string
// Get Scheduled Query
////////////////////////////////////////////////////////////////////////////////
type getScheduledQueryRequest struct {
ID uint `url:"id"`
}
type getScheduledQueryResponse struct {
Scheduled *scheduledQueryResponse `json:"scheduled,omitempty"`
Err error `json:"error,omitempty"`
}
func (r getScheduledQueryResponse) Error() error { return r.Err }
func getScheduledQueryEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*getScheduledQueryRequest)
req := request.(*fleet.GetScheduledQueryRequest)
sq, err := svc.GetScheduledQuery(ctx, req.ID)
if err != nil {
return getScheduledQueryResponse{Err: err}, nil
return fleet.GetScheduledQueryResponse{Err: err}, nil
}
return getScheduledQueryResponse{
Scheduled: &scheduledQueryResponse{
return fleet.GetScheduledQueryResponse{
Scheduled: &fleet.ScheduledQueryResponse{
ScheduledQuery: *sq,
},
}, nil
@ -197,28 +152,16 @@ func (svc *Service) GetScheduledQuery(ctx context.Context, id uint) (*fleet.Sche
// Modify Scheduled Query
////////////////////////////////////////////////////////////////////////////////
type modifyScheduledQueryRequest struct {
ID uint `json:"-" url:"id"`
fleet.ScheduledQueryPayload
}
type modifyScheduledQueryResponse struct {
Scheduled *scheduledQueryResponse `json:"scheduled,omitempty"`
Err error `json:"error,omitempty"`
}
func (r modifyScheduledQueryResponse) Error() error { return r.Err }
func modifyScheduledQueryEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*modifyScheduledQueryRequest)
req := request.(*fleet.ModifyScheduledQueryRequest)
sq, err := svc.ModifyScheduledQuery(ctx, req.ID, req.ScheduledQueryPayload)
if err != nil {
return modifyScheduledQueryResponse{Err: err}, nil
return fleet.ModifyScheduledQueryResponse{Err: err}, nil
}
return modifyScheduledQueryResponse{
Scheduled: &scheduledQueryResponse{
return fleet.ModifyScheduledQueryResponse{
Scheduled: &fleet.ScheduledQueryResponse{
ScheduledQuery: *sq,
},
}, nil
@ -289,25 +232,15 @@ func (svc *Service) unauthorizedModifyScheduledQuery(ctx context.Context, id uin
// Delete Scheduled Query
////////////////////////////////////////////////////////////////////////////////
type deleteScheduledQueryRequest struct {
ID uint `url:"id"`
}
type deleteScheduledQueryResponse struct {
Err error `json:"error,omitempty"`
}
func (r deleteScheduledQueryResponse) Error() error { return r.Err }
func deleteScheduledQueryEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*deleteScheduledQueryRequest)
req := request.(*fleet.DeleteScheduledQueryRequest)
err := svc.DeleteScheduledQuery(ctx, req.ID)
if err != nil {
return deleteScheduledQueryResponse{Err: err}, nil
return fleet.DeleteScheduledQueryResponse{Err: err}, nil
}
return deleteScheduledQueryResponse{}, nil
return fleet.DeleteScheduledQueryResponse{}, nil
}
func (svc *Service) DeleteScheduledQuery(ctx context.Context, id uint) error {

8
server/service/team_schedule.go
View file

@ -21,21 +21,21 @@ type getTeamScheduleRequest struct {
}
type getTeamScheduleResponse struct {
Scheduled []scheduledQueryResponse `json:"scheduled"`
Err error `json:"error,omitempty"`
Scheduled []fleet.ScheduledQueryResponse `json:"scheduled"`
Err error `json:"error,omitempty"`
}
func (r getTeamScheduleResponse) Error() error { return r.Err }
func getTeamScheduleEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
req := request.(*getTeamScheduleRequest)
resp := getTeamScheduleResponse{Scheduled: []scheduledQueryResponse{}}
resp := getTeamScheduleResponse{Scheduled: []fleet.ScheduledQueryResponse{}}
queries, err := svc.GetTeamScheduledQueries(ctx, req.TeamID, req.ListOptions)
if err != nil {
return getTeamScheduleResponse{Err: err}, nil
}
for _, q := range queries {
resp.Scheduled = append(resp.Scheduled, scheduledQueryResponse{
resp.Scheduled = append(resp.Scheduled, fleet.ScheduledQueryResponse{
ScheduledQuery: *q,
})
}