Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 17:08:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 83

Merge branch 'main' into feat-prefill-account-name

Browse source
This commit is contained in:
Martin Angers 2024-03-27 09:53:02 -04:00 committed by GitHub
commit 8abee3e72d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
12 changed files with 350 additions and 124 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
cmd/fleet/calendar_cron.go
View file

@ -110,6 +110,10 @@ func cronCalendarEventsForTeam(
}
if len(policies) == 0 {
level.Debug(logger).Log(
"msg", "skipping, no calendar policies",
"team_id", team.ID,
)
return nil
}
@ -120,6 +124,7 @@ func cronCalendarEventsForTeam(
// - We ignore hosts that are passing all policies and do not have an associated email.
// - We get only one host per email that's failing policies (the one with lower host id).
// - On every host, we get only the first email that matches the domain (sorted lexicographically).
// - GetTeamHostsPolicyMemberships returns the hosts that are passing all policies and have a calendar event.
//
policyIDs := make([]uint, 0, len(policies))
@ -625,7 +630,7 @@ func cronCalendarEventsCleanup(ctx context.Context, ds fleet.Datastore, logger k
}
for _, team := range teams {
if err := deleteTeamCalendarEvents(ctx, ds, userCalendar, *team); err != nil {
if err := cleanupTeamCalendarEvents(ctx, ds, userCalendar, *team); err != nil {
level.Info(logger).Log("msg", "delete team calendar events", "team_id", team.ID, "err", err)
}
}
@ -666,17 +671,27 @@ func deleteAllCalendarEvents(
return nil
}
func deleteTeamCalendarEvents(
func cleanupTeamCalendarEvents(
ctx context.Context,
ds fleet.Datastore,
userCalendar fleet.UserCalendar,
team fleet.Team,
) error {
if team.Config.Integrations.GoogleCalendar != nil &&
team.Config.Integrations.GoogleCalendar.Enable {
// Feature is enabled, nothing to cleanup.
return nil
teamFeatureEnabled := team.Config.Integrations.GoogleCalendar != nil && team.Config.Integrations.GoogleCalendar.Enable
if teamFeatureEnabled {
policies, err := ds.GetCalendarPolicies(ctx, team.ID)
if err != nil {
return fmt.Errorf("get calendar policy ids: %w", err)
}
if len(policies) > 0 {
// Feature is enabled and there are calendar policies configured, so nothing to do.
return nil
}
// Feature is enabled but there are no calendar policies,
// so we want to cleanup all calendar events for the team.
}
return deleteAllCalendarEvents(ctx, ds, userCalendar, &team.ID)
}

136
frontend/pages/admin/IntegrationsPage/cards/Calendars/Calendars.tsx
View file

@ -7,6 +7,7 @@ import { AppContext } from "context/app";
import configAPI from "services/entities/config";
// @ts-ignore
import { stringToClipboard } from "utilities/copy_text";
import paths from "router/paths";
// @ts-ignore
import InputField from "components/forms/fields/InputField";
@ -17,6 +18,7 @@ import Spinner from "components/Spinner";
import DataError from "components/DataError";
import PremiumFeatureMessage from "components/PremiumFeatureMessage/PremiumFeatureMessage";
import Icon from "components/Icon";
import Card from "components/Card";
const CREATING_SERVICE_ACCOUNT =
"https://www.fleetdm.com/learn-more-about/creating-service-accounts";
@ -236,6 +238,9 @@ const Calendars = (): JSX.Element => {
For "Organization" and "Location", select
your calendar's organization.
</li>
<li>
Click <b>Create</b>.
</li>
</ul>
</p>
@ -277,69 +282,72 @@ const Calendars = (): JSX.Element => {
<li>
Click <b>Create</b> to create the key & download a JSON file.
</li>
<li className={`${baseClass}__configuration`}>
Configure your service account integration in Fleet using the
form below:
<form onSubmit={onFormSubmit} autoComplete="off">
<InputField
label="API key JSON"
onChange={onInputChange}
name="apiKeyJson"
value={apiKeyJson}
parseTarget
type="textarea"
tooltip={
<>
Paste the full contents of the JSON file downloaded{" "}
<br />
when creating your service account API key.
</>
}
placeholder={API_KEY_JSON_PLACEHOLDER}
ignore1password
inputClassName={`${baseClass}__api-key-json`}
error={formErrors.apiKeyJson}
/>
<InputField
label="Primary domain"
onChange={onInputChange}
name="domain"
value={domain}
parseTarget
tooltip={
<>
If the end user is signed into multiple Google accounts,
this will be used to identify their work calendar.
</>
}
placeholder="example.com"
helpText={
<>
You can find your primary domain in Google Workspace{" "}
<CustomLink
url={GOOGLE_WORKSPACE_DOMAINS}
text="here"
newTab
/>
</>
}
error={formErrors.domain}
/>
<Button
type="submit"
variant="brand"
disabled={Object.keys(formErrors).length > 0}
className="save-loading"
isLoading={isUpdatingSettings}
>
Save
</Button>
</form>
</ul>
</p>
<p className={`${baseClass}__configuration`}>
5. Configure your service account integration in Fleet using the
form below:
<ul>
<li>
Paste the full contents of the JSON file downloaded when
creating your service account API key.
</li>
<li>
Set your primary domain. (If the end user is signed into
multiple Google accounts, this will be used to identify their
work calendar.)
</li>
<li>
Save your changes.
<Card>
<form onSubmit={onFormSubmit} autoComplete="off">
<InputField
label="API key JSON"
onChange={onInputChange}
name="apiKeyJson"
value={apiKeyJson}
parseTarget
type="textarea"
placeholder={API_KEY_JSON_PLACEHOLDER}
ignore1password
inputClassName={`${baseClass}__api-key-json`}
error={formErrors.apiKeyJson}
/>
<InputField
label="Primary domain"
onChange={onInputChange}
name="domain"
value={domain}
parseTarget
placeholder="example.com"
helpText={
<>
You can find your primary domain in Google Workspace{" "}
<CustomLink
url={GOOGLE_WORKSPACE_DOMAINS}
text="here"
newTab
/>
</>
}
error={formErrors.domain}
/>
<Button
type="submit"
variant="brand"
disabled={Object.keys(formErrors).length > 0}
className="save-loading"
isLoading={isUpdatingSettings}
>
Save
</Button>
</form>
</Card>
</li>
</ul>
</p>
<p>
5. Authorize the service account via domain-wide delegation.
6. Authorize the service account via domain-wide delegation.
<ul>
<li>
In Google Workspace, go to{" "}
@ -381,7 +389,7 @@ const Calendars = (): JSX.Element => {
</ul>
</p>
<p>
6. Enable the Google Calendar API.
7. Enable the Google Calendar API.
<ul>
<li>
In the Google Cloud console API library, go to the Google
@ -402,8 +410,12 @@ const Calendars = (): JSX.Element => {
</ul>
</p>
<p>
You&apos;re ready to automatically schedule calendar events for end
users.
Now head over to{" "}
<CustomLink
url={paths.MANAGE_POLICIES}
text="Policies &gt; Manage automations"
/>{" "}
to finish setup.
</p>
</div>
</>

4
frontend/pages/admin/IntegrationsPage/cards/Calendars/_styles.scss
View file

@ -16,8 +16,8 @@
margin: $pad-small 0;
}
form {
margin-top: $pad-large;
.card {
margin-top: $pad-small;
}
&__configuration {

40
schema/osquery_fleet_schema.json
View file

@ -3970,7 +3970,7 @@
{
"name": "path",
"description": "Path to extension folder. Defaults to '' on ChromeOS",
"type": "STRING",
"type": "TEXT",
"notes": "",
"hidden": false,
"required": false,
@ -4067,7 +4067,7 @@
{
"name": "state",
"description": "1 if this extension is enabled",
"type": "STRING",
"type": "TEXT",
"notes": "",
"hidden": false,
"required": false,
@ -15143,19 +15143,19 @@
"name": "trace_id",
"description": "The ID of a trace event",
"required": false,
"type": "string"
"type": "text"
},
{
"name": "event_type",
"description": "The type of event, this can be logEvent, signpostEvent or stateEvent.",
"required": false,
"type": "string"
"type": "text"
},
{
"name": "format_string",
"description": "The format string used to convert variable content into a string for output.",
"required": false,
"type": "string"
"type": "text"
},
{
"name": "activity_identifier",
@ -15185,19 +15185,19 @@
"name": "sender_image_uuid",
"description": "The UUID of the library, framework, kernel extension, or mach-o image, that originated the event.",
"required": false,
"type": "string"
"type": "text"
},
{
"name": "sender_image_path",
"description": "The full path of the library, framework, kernel extension, or mach-o image, that originated the event.",
"required": false,
"type": "string"
"type": "text"
},
{
"name": "boot_uuid",
"description": "The boot UUID of the event.",
"required": false,
"type": "string"
"type": "text"
},
{
"name": "process_id",
@ -15209,7 +15209,7 @@
"name": "process_image_path",
"description": "The full path of the process that originated the event.",
"required": false,
"type": "string"
"type": "text"
},
{
"name": "timestamp",
@ -15221,7 +15221,7 @@
"name": "event_message",
"description": "The message of the log entry.",
"required": false,
"type": "string"
"type": "text"
},
{
"name": "sender_program_counter",
@ -25617,7 +25617,7 @@
{
"name": "hostname",
"description": "Network hostname including domain. For ChromeOS, this is only available if the extension was force-installed by an enterprise policy",
"type": "STRING",
"type": "TEXT",
"notes": "",
"hidden": false,
"required": false,
@ -25635,7 +25635,7 @@
{
"name": "cpu_type",
"description": "CPU type",
"type": "STRING",
"type": "TEXT",
"notes": "",
"hidden": false,
"required": false,
@ -25658,7 +25658,7 @@
{
"name": "cpu_brand",
"description": "CPU brand string, contains vendor and model",
"type": "STRING",
"type": "TEXT",
"notes": "",
"hidden": false,
"required": false,
@ -25718,7 +25718,7 @@
{
"name": "physical_memory",
"description": "Total physical memory in bytes",
"type": "STRING",
"type": "TEXT",
"notes": "",
"hidden": false,
"required": false,
@ -25727,7 +25727,7 @@
{
"name": "hardware_vendor",
"description": "Hardware vendor. For ChromeOS, this is only available if the extension was force-installed by an enterprise policy",
"type": "STRING",
"type": "TEXT",
"notes": "",
"hidden": false,
"required": false,
@ -25736,7 +25736,7 @@
{
"name": "hardware_model",
"description": "Hardware model. For ChromeOS, this is only available if the extension was force-installed by an enterprise policy",
"type": "STRING",
"type": "TEXT",
"notes": "",
"hidden": false,
"required": false,
@ -25759,7 +25759,7 @@
{
"name": "hardware_serial",
"description": "The device's serial number. For ChromeOS, this is only available if the extension was force-installed by an enterprise policy",
"type": "STRING",
"type": "TEXT",
"notes": "",
"hidden": false,
"required": false,
@ -25824,7 +25824,7 @@
{
"name": "computer_name",
"description": "Friendly computer name (optional). For ChromeOS, if the extension wasn't force-installed by an enterprise policy this will default to 'ChromeOS' only",
"type": "STRING",
"type": "TEXT",
"notes": "",
"hidden": false,
"required": false,
@ -25857,7 +25857,7 @@
"columns": [
{
"name": "idle_state",
"type": "string",
"type": "text",
"description": "Returns \"locked\", \"idle\", or \"active\".",
"required": false
}
@ -27254,7 +27254,7 @@
{
"name": "email",
"required": false,
"type": "string",
"type": "text",
"description": "Email",
"platforms": [
"chrome"

4
schema/tables/chrome_extensions.yml
View file

@ -57,7 +57,7 @@ columns:
- windows
- linux
- name: path
type: string
type: text
description: Path to extension folder. Defaults to '' on ChromeOS
- name: optional_permissions
platforms:
@ -85,7 +85,7 @@ columns:
- windows
- linux
- name: state
type: string
type: text
- name: install_time
platforms:
- darwin

16
schema/tables/macadmins_unified_log.yml
View file

@ -16,15 +16,15 @@ columns:
- name: trace_id
description: The ID of a trace event
required: false
type: string
type: text
- name: event_type
description: The type of event, this can be logEvent, signpostEvent or stateEvent.
required: false
type: string
type: text
- name: format_string
description: The format string used to convert variable content into a string for output.
required: false
type: string
type: text
- name: activity_identifier
description: The identifier of the log activity.
required: false
@ -44,15 +44,15 @@ columns:
- name: sender_image_uuid
description: The UUID of the library, framework, kernel extension, or mach-o image, that originated the event.
required: false
type: string
type: text
- name: sender_image_path
description: The full path of the library, framework, kernel extension, or mach-o image, that originated the event.
required: false
type: string
type: text
- name: boot_uuid
description: The boot UUID of the event.
required: false
type: string
type: text
- name: process_id
description: Process ID of the process that generated this log item, which can be joined to multiple other tables including a *PID*.
required: false
@ -60,7 +60,7 @@ columns:
- name: process_image_path
description: The full path of the process that originated the event.
required: false
type: string
type: text
- name: timestamp
description: Timestamp in [UNIX time format](https://en.wikipedia.org/wiki/Unix_time).
required: false
@ -68,7 +68,7 @@ columns:
- name: event_message
description: The message of the log entry.
required: false
type: string
type: text
- name: sender_program_counter
description: The program counter of the library, framework, kernel extension, or mach-o image, that originated the event.
required: false

16
schema/tables/system_info.yml
View file

@ -56,26 +56,26 @@ columns:
- windows
- linux
- name: hostname
type: string
type: text
description: Network hostname including domain. For ChromeOS, this is only available if the extension was force-installed by an enterprise policy
- name: computer_name
type: string
type: text
description: Friendly computer name (optional). For ChromeOS, if the extension wasn't force-installed by an enterprise policy this will default to 'ChromeOS' only
- name: hardware_serial
type: string
type: text
description: The device's serial number. For ChromeOS, this is only available if the extension was force-installed by an enterprise policy
- name: hardware_vendor
type: string
type: text
description: Hardware vendor. For ChromeOS, this is only available if the extension was force-installed by an enterprise policy
- name: hardware_model
type: string
type: text
description: Hardware model. For ChromeOS, this is only available if the extension was force-installed by an enterprise policy
- name: cpu_brand
type: string
type: text
- name: cpu_type
type: string
type: text
- name: physical_memory
type: string
type: text
examples: >-
See the CPU architecture of a machine as well as who made it and what its

2
schema/tables/system_state.yml
View file

@ -12,7 +12,7 @@ examples: >-
```
columns:
- name: idle_state
type: string
type: text
description: Returns "locked", "idle", or "active".
required: false
evented: false

2
schema/tables/users.yml
View file

@ -46,7 +46,7 @@ columns:
- name: uuid
- name: email
required: false
type: string
type: text
description: Email
platforms:
- chrome

1
server/datastore/mysql/calendar_events.go
View file

@ -210,7 +210,6 @@ func (ds *Datastore) ListCalendarEvents(ctx context.Context, teamID *uint) ([]*f
var args []interface{}
if teamID != nil {
// TODO(lucas): Should we add a team_id column to calendar_events?
calendarEventsQuery += ` JOIN host_calendar_events hce ON ce.id=hce.calendar_event_id
JOIN hosts h ON h.id=hce.host_id WHERE h.team_id = ?`
args = append(args, *teamID)

18
server/datastore/mysql/policies.go
View file

@ -1181,28 +1181,30 @@ func (ds *Datastore) GetTeamHostsPolicyMemberships(
query := `
SELECT
COALESCE(sh.email, '') AS email,
pm.passing AS passing,
COALESCE(pm.passing, 1) AS passing,
h.id AS host_id,
hdn.display_name AS host_display_name,
COALESCE(hdn.display_name, '') AS host_display_name,
h.hardware_serial AS host_hardware_serial
FROM (
FROM hosts h
LEFT JOIN (
SELECT host_id, BIT_AND(COALESCE(passes, 0)) AS passing
FROM policy_membership
WHERE policy_id IN (?)
GROUP BY host_id
) pm
) pm ON h.id = pm.host_id
LEFT JOIN (
SELECT host_id, MIN(email) AS email
FROM host_emails
JOIN hosts ON host_emails.host_id=hosts.id
WHERE email LIKE CONCAT('%@', ?) AND team_id = ?
GROUP BY host_id
) sh ON sh.host_id = pm.host_id
JOIN hosts h ON h.id = pm.host_id
LEFT JOIN host_display_names hdn ON hdn.host_id = pm.host_id;
) sh ON h.id = sh.host_id
LEFT JOIN host_display_names hdn ON h.id = hdn.host_id
LEFT JOIN host_calendar_events hce ON h.id = hce.host_id
WHERE h.team_id = ? AND ((pm.passing IS NOT NULL AND NOT pm.passing) OR (COALESCE(pm.passing, 1) AND hce.host_id IS NOT NULL));
`
query, args, err := sqlx.In(query, policyIDs, domain, teamID)
query, args, err := sqlx.In(query, policyIDs, domain, teamID, teamID)
if err != nil {
return nil, ctxerr.Wrapf(ctx, err, "build select get team hosts policy memberships query")
}

208
server/datastore/mysql/policies_test.go
View file

@ -2865,6 +2865,23 @@ func testGetCalendarPolicies(t *testing.T, ds *Datastore) {
func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
ctx := context.Background()
//
// Test setup:
//
// team1:
// team1Policy1 (calendar), team1Policy2
// host1, host5, host6
//
// team2:
// team2Policy1 (calendar), team2Policy2 (calendar)
// host2, host3
//
// global:
// Global Policy 1
// host4
//
//
team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
require.NoError(t, err)
team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
@ -2894,11 +2911,16 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
CalendarEventsEnabled: true,
})
require.NoError(t, err)
_, err = ds.NewGlobalPolicy(ctx, nil, fleet.PolicyPayload{
Name: "Global Policy 1",
Query: "SELECT * FROM foobar;",
})
require.NoError(t, err)
// Empty teams.
hostsTeam1, err := ds.GetTeamHostsPolicyMemberships(ctx, "example.com", team1.ID, []uint{team1Policy1.ID, team1Policy2.ID})
require.NoError(t, err)
require.Len(t, hostsTeam1, 0)
require.Empty(t, hostsTeam1)
host1, err := ds.NewHost(ctx, &fleet.Host{
OsqueryHostID: ptr.String("host1"),
@ -2939,11 +2961,35 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
TeamID: &team1.ID,
})
require.NoError(t, err)
host6, err := ds.NewHost(ctx, &fleet.Host{
OsqueryHostID: ptr.String("host6"),
NodeKey: ptr.String("host6"),
HardwareSerial: "serial6",
ComputerName: "display_name6",
TeamID: &team1.ID,
})
require.NoError(t, err)
// No policy results yet.
// Some domain that doesn't exist on any of the hosts
hostsTeam1, err = ds.GetTeamHostsPolicyMemberships(ctx, "not-exists.com", team1.ID, []uint{team1Policy1.ID, team1Policy2.ID})
require.NoError(t, err)
require.Empty(t, hostsTeam1)
// No policy results yet (and no calendar events).
hostsTeam1, err = ds.GetTeamHostsPolicyMemberships(ctx, "example.com", team1.ID, []uint{team1Policy1.ID, team1Policy2.ID})
require.NoError(t, err)
require.Len(t, hostsTeam1, 0)
require.Empty(t, hostsTeam1)
//
// Email setup
//
// host1 has foo@example.com, zoo@example.com
// host2 has foo@example.com, foo@other.com
// host3 has zoo@example.com
// host4 has foo@example.com
// host5 has foo@other.com
// host6 has bar@example.com
//
err = ds.ReplaceHostDeviceMapping(ctx, host1.ID, []*fleet.HostDeviceMapping{
{HostID: host1.ID, Email: "foo@example.com", Source: "google_chrome_profiles"},
@ -2973,6 +3019,20 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
{HostID: host5.ID, Email: "foo@other.com", Source: "google_chrome_profiles"},
}, "google_chrome_profiles")
require.NoError(t, err)
err = ds.ReplaceHostDeviceMapping(ctx, host6.ID, []*fleet.HostDeviceMapping{
{HostID: host6.ID, Email: "bar@example.com", Source: "google_chrome_profiles"},
}, "google_chrome_profiles")
require.NoError(t, err)
//
// Results setup
//
// host1 (team1) is passing team1Policy1 (calendar) and failing team1Policy2.
// host2 (team2) is failing team2Policy1 (calendar) and passing team2Policy2 (calendar).
// host3 (team2) is passing all policies.
// host5 (team1) is failing all policies.
// host6 (team1) has not returned results.
//
err = ds.RecordPolicyQueryExecutions(ctx, host1, map[uint]*bool{
team1Policy1.ID: ptr.Bool(true),
@ -3005,9 +3065,34 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
require.NoError(t, err)
require.Len(t, team2Policies, 2)
// Only returns the failing host, because the passing hosts do not have a calendar event.
hostsTeam1, err = ds.GetTeamHostsPolicyMemberships(ctx, "example.com", team1.ID, []uint{team1Policies[0].ID})
require.NoError(t, err)
require.Len(t, hostsTeam1, 2)
sort.Slice(hostsTeam1, func(i, j int) bool {
return hostsTeam1[i].HostID < hostsTeam1[j].HostID
})
require.Len(t, hostsTeam1, 1)
require.Equal(t, host5.ID, hostsTeam1[0].HostID)
require.Empty(t, hostsTeam1[0].Email)
require.False(t, hostsTeam1[0].Passing)
require.Equal(t, "serial5", hostsTeam1[0].HostHardwareSerial)
require.Equal(t, "display_name5", hostsTeam1[0].HostDisplayName)
//
// Create a calendar event on host1 and host6.
//
now := time.Now()
_, err = ds.CreateOrUpdateCalendarEvent(ctx, "foo@example.com", now, now.Add(30*time.Minute), []byte(`{"foo": "bar"}`), host1.ID, fleet.CalendarWebhookStatusPending)
require.NoError(t, err)
_, err = ds.CreateOrUpdateCalendarEvent(ctx, "bar@example.com", now, now.Add(30*time.Minute), []byte(`{"foo": "bar"}`), host6.ID, fleet.CalendarWebhookStatusPending)
require.NoError(t, err)
hostsTeam1, err = ds.GetTeamHostsPolicyMemberships(ctx, "example.com", team1.ID, []uint{team1Policies[0].ID})
require.NoError(t, err)
sort.Slice(hostsTeam1, func(i, j int) bool {
return hostsTeam1[i].HostID < hostsTeam1[j].HostID
})
require.Len(t, hostsTeam1, 3)
require.Equal(t, host1.ID, hostsTeam1[0].HostID)
require.Equal(t, "foo@example.com", hostsTeam1[0].Email)
require.True(t, hostsTeam1[0].Passing)
@ -3018,6 +3103,15 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
require.False(t, hostsTeam1[1].Passing)
require.Equal(t, "serial5", hostsTeam1[1].HostHardwareSerial)
require.Equal(t, "display_name5", hostsTeam1[1].HostDisplayName)
require.Equal(t, host6.ID, hostsTeam1[2].HostID)
require.Equal(t, "bar@example.com", hostsTeam1[2].Email)
require.True(t, hostsTeam1[2].Passing)
require.Equal(t, "serial6", hostsTeam1[2].HostHardwareSerial)
require.Equal(t, "display_name6", hostsTeam1[2].HostDisplayName)
//
// Move host 4 to team1 and have it fail all team1 policies.
//
err = ds.AddHostsToTeam(ctx, &team1.ID, []uint{host4.ID})
require.NoError(t, err)
@ -3029,7 +3123,10 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
hostsTeam1, err = ds.GetTeamHostsPolicyMemberships(ctx, "example.com", team1.ID, []uint{team1Policies[0].ID})
require.NoError(t, err)
require.Len(t, hostsTeam1, 3)
require.Len(t, hostsTeam1, 4)
sort.Slice(hostsTeam1, func(i, j int) bool {
return hostsTeam1[i].HostID < hostsTeam1[j].HostID
})
require.Equal(t, host1.ID, hostsTeam1[0].HostID)
require.Equal(t, "foo@example.com", hostsTeam1[0].Email)
require.True(t, hostsTeam1[0].Passing)
@ -3045,10 +3142,44 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
require.False(t, hostsTeam1[2].Passing)
require.Equal(t, "serial5", hostsTeam1[2].HostHardwareSerial)
require.Equal(t, "display_name5", hostsTeam1[2].HostDisplayName)
require.Equal(t, host6.ID, hostsTeam1[3].HostID)
require.Equal(t, "bar@example.com", hostsTeam1[3].Email)
require.True(t, hostsTeam1[3].Passing)
require.Equal(t, "serial6", hostsTeam1[3].HostHardwareSerial)
require.Equal(t, "display_name6", hostsTeam1[3].HostDisplayName)
//
// host3 doesn't have a calendar event so it's not returned by GetTeamHostsPolicyMemberships.
//
hostsTeam2, err := ds.GetTeamHostsPolicyMemberships(ctx, "example.com", team2.ID, []uint{team2Policies[0].ID, team2Policies[1].ID})
require.NoError(t, err)
require.Len(t, hostsTeam2, 1)
require.Equal(t, host2.ID, hostsTeam2[0].HostID)
require.Equal(t, "foo@example.com", hostsTeam2[0].Email)
require.False(t, hostsTeam2[0].Passing)
require.Equal(t, "serial2", hostsTeam2[0].HostHardwareSerial)
require.Equal(t, "display_name2", hostsTeam2[0].HostDisplayName)
//
// Create a calendar event on host2 and host3.
//
now = time.Now()
_, err = ds.CreateOrUpdateCalendarEvent(ctx, "foo@example.com", now, now.Add(30*time.Minute), []byte(`{"foo": "bar"}`), host2.ID, fleet.CalendarWebhookStatusPending)
require.NoError(t, err)
calendarEventHost3, err := ds.CreateOrUpdateCalendarEvent(ctx, "zoo@example.com", now, now.Add(30*time.Minute), []byte(`{"foo": "bar"}`), host3.ID, fleet.CalendarWebhookStatusPending)
require.NoError(t, err)
//
// Now it should return host3 because it's passing and has a calendar event.
//
hostsTeam2, err = ds.GetTeamHostsPolicyMemberships(ctx, "example.com", team2.ID, []uint{team2Policies[0].ID, team2Policies[1].ID})
require.NoError(t, err)
require.Len(t, hostsTeam2, 2)
sort.Slice(hostsTeam2, func(i, j int) bool {
return hostsTeam2[i].HostID < hostsTeam1[j].HostID
})
require.Equal(t, host2.ID, hostsTeam2[0].HostID)
require.Equal(t, "foo@example.com", hostsTeam2[0].Email)
require.False(t, hostsTeam2[0].Passing)
@ -3059,4 +3190,71 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
require.True(t, hostsTeam2[1].Passing)
require.Equal(t, "serial3", hostsTeam2[1].HostHardwareSerial)
require.Equal(t, "display_name3", hostsTeam2[1].HostDisplayName)
//
// Make host2 pass all policies.
//
err = ds.RecordPolicyQueryExecutions(ctx, host2, map[uint]*bool{
team2Policy1.ID: ptr.Bool(true),
team2Policy2.ID: ptr.Bool(true),
}, time.Now(), false)
require.NoError(t, err)
hostsTeam2, err = ds.GetTeamHostsPolicyMemberships(ctx, "example.com", team2.ID, []uint{team2Policies[0].ID, team2Policies[1].ID})
require.NoError(t, err)
require.Len(t, hostsTeam2, 2)
sort.Slice(hostsTeam2, func(i, j int) bool {
return hostsTeam2[i].HostID < hostsTeam1[j].HostID
})
require.Equal(t, host2.ID, hostsTeam2[0].HostID)
require.Equal(t, "foo@example.com", hostsTeam2[0].Email)
require.True(t, hostsTeam2[0].Passing)
require.Equal(t, "serial2", hostsTeam2[0].HostHardwareSerial)
require.Equal(t, "display_name2", hostsTeam2[0].HostDisplayName)
require.Equal(t, host3.ID, hostsTeam2[1].HostID)
require.Equal(t, "zoo@example.com", hostsTeam2[1].Email)
require.True(t, hostsTeam2[1].Passing)
require.Equal(t, "serial3", hostsTeam2[1].HostHardwareSerial)
require.Equal(t, "display_name3", hostsTeam2[1].HostDisplayName)
//
// Delete host3 calendar event
//
err = ds.DeleteCalendarEvent(ctx, calendarEventHost3.ID)
require.NoError(t, err)
hostsTeam2, err = ds.GetTeamHostsPolicyMemberships(ctx, "example.com", team2.ID, []uint{team2Policies[0].ID, team2Policies[1].ID})
require.NoError(t, err)
require.Len(t, hostsTeam2, 1)
require.Equal(t, host2.ID, hostsTeam2[0].HostID)
require.Equal(t, "foo@example.com", hostsTeam2[0].Email)
require.True(t, hostsTeam2[0].Passing)
require.Equal(t, "serial2", hostsTeam2[0].HostHardwareSerial)
require.Equal(t, "display_name2", hostsTeam2[0].HostDisplayName)
//
// Edit team2Policy1 platform (which removes all its policy_membership entries).
//
team2Policy1.Platform = "darwin"
err = ds.SavePolicy(ctx, team1Policy1, false)
require.NoError(t, err)
team1Policy1.Platform = "darwin"
err = ds.SavePolicy(ctx, team2Policy1, false)
require.NoError(t, err)
//
// We should still get host2 as passing because it has an associated calendar event.
//
hostsTeam2, err = ds.GetTeamHostsPolicyMemberships(ctx, "example.com", team2.ID, []uint{team2Policies[0].ID, team2Policies[1].ID})
require.NoError(t, err)
require.Len(t, hostsTeam2, 1)
require.Equal(t, host2.ID, hostsTeam2[0].HostID)
require.Equal(t, "foo@example.com", hostsTeam2[0].Email)
require.True(t, hostsTeam2[0].Passing)
require.Equal(t, "serial2", hostsTeam2[0].HostHardwareSerial)
require.Equal(t, "display_name2", hostsTeam2[0].HostDisplayName)
}