Commit graph

116 commits

Author SHA1 Message Date
Victor Vrantchan
41610c1f66 catch sql.ErrNoRows in mysql/invites (#667) 2016-12-20 16:31:09 -05:00
Victor Vrantchan
9d49dbc465 change the implementation of ErrNotFound and AlreadyExists to a struct type (#665)
with an exposed interface.

Not checking for a specific sentinel error reduces coupling between packages
and allows adding context like the resource ID and resource type.
2016-12-20 13:35:22 -05:00
Zachary Wasserman
41120ebc00 Improve user endpoint validations (#642)
- Add empty string checks for NewUser
- Create validations for ModifyUser
- Use GravatarURL when creating new user

Fixes #620
2016-12-15 09:28:53 -08:00
Mike Arpaia
1ada011f37 Remove existing bulk functionality (#641) 2016-12-14 17:22:17 -08:00
Zachary Wasserman
0e783e7887 Add change password endpoint (#628) 2016-12-14 10:11:43 -08:00
Mike Arpaia
bed279b919 Remove "selected" keyword from response (#635) 2016-12-13 15:59:59 -08:00
Mike Arpaia
f109b14f9d Moving query attributes from the query object to the pack-query relationship (#559)
* Moving query attributes from the query object to the pack-query relationship

* some additional tests

* http request parsing test

* QueryOptions in new test_util code

* initial scaffolding of new request structures

* service and datastore

* test outline

* l2 merge conflict scrub

* service tests for scheduled query service

* service and datastore tests

* most endpoints and transports

* order of values are not deterministic with inmem

* transport tests

* rename PackQuery to ScheduledQuery

* removing existing implementation of adding queries to packs

* accounting for the new argument to NewQuery

* fix alignment in sql query

* removing underscore

* add removed to the datastore

* removed differential from the schema
2016-12-13 14:22:05 -08:00
Zachary Wasserman
556cbf43bd Use canPerformActions authZ check appropriately in handlers (#625)
Fixes #282
2016-12-13 08:57:49 -08:00
Zachary Wasserman
0c62bda2f1 Fix session expiration logic with password reset (#619)
- Only expire sessions at reset request time when admin forces reset
- Expire sessions when reset completed

Prior to this, there was a possible DoS vector in which an attacker could
prevent a user from taking actions in the app by constantly requesting password
resets and expiring all the user's active sessions.

Fixes #612
2016-12-12 09:24:51 -08:00
Zachary Wasserman
b362682d90 Add service method for bulk deleting queries (#600)
- New datastore method for bulk deletion
- New service method calling this datastore method
- Endpoint, transport and handler connections for service method

Closes #389
2016-12-09 09:12:45 -08:00
Zachary Wasserman
d9190020fe Record author information with queries (#578) 2016-12-07 12:22:31 -08:00
Victor Vrantchan
6d9ad56e6d use validation error for expired invite tokens. (#587)
Closes #586
2016-12-07 11:25:48 -05:00
Victor Vrantchan
62a5e65c2e use random string instead of JWT for tokens. (#584)
uses a random URL encoded base64 string as the token for password reset
and invites.
2016-12-07 10:42:58 -05:00
John Murphy
7812b2f3bd Fixes host detail updates with MySQL backend (#568) 2016-12-07 03:51:11 +08:00
Zachary Wasserman
bc6109fb56 Fixes for saved queries (#576)
- Only saved queries should be returned by ListQueries
- Bugfixes

Addresses #388
2016-12-06 10:16:04 -08:00
John Murphy
e6b1ed9ade Added MIA status for hosts that haven't been updated for 30 days (#570) 2016-12-07 01:37:22 +08:00
Victor Vrantchan
b1bca7c98c enbable API route after setup is complete (#564)
Fixes #563
2016-12-02 13:46:31 -05:00
Zachary Wasserman
b901c4c0d3 Update models/service method for saving queries (#553)
- Add saved state to query (to differentiate queries explicitly saved from
  those just run as distributed queries)
- Remove unique constraint on query name

Closes #390
2016-12-01 13:21:27 -08:00
Zachary Wasserman
e1db2d4c27 Add cleanup method for distributed queries and metadata (#547)
- New datastore method for expiring queries and deleting metadata
- Start goroutine in serve to run this method on an hourly interval

Closes #392
2016-12-01 10:31:16 -08:00
John Murphy
f66904f240 Host details 405 (#535) 2016-12-02 01:00:00 +08:00
Zachary Wasserman
ed3c696c6e Refactor campaign methods into separate file (#540) 2016-11-29 10:20:06 -08:00
John Murphy
44ef92550f Added built in labels (#526) 2016-11-26 02:08:22 +08:00
Zachary Wasserman
0b612eedab Push query results and metadata over websocket connection (#519)
- New route `/api/v1/kolide/results/{id}` with upgrade to websocket connection
- Query results pushed over websocket as they are received from pubsub
- Target totals updates pushed over websocket every second
- New datastore method to support retrieiving target totals
- Websocket package includes helpers and patterns for communicating over websockets
2016-11-22 16:35:43 -08:00
Mike Arpaia
a036c5da9f Add attributes to packs (#524)
* Adds created_by attribute to packs

This PR also updated the distributed query code to use the pattern
established here (service checks context)

* add enable/disable state to packs

* add query_count to packs API responses

* add host_count to packs API responses (very, very poorly)

* pack description should not be required

* counting hosts in packs via mysql

* removing extraneous newline in test

* Switch case instead of if/if else

* add description to update query for SavePack method

* change AND to WHERE in query as per @zwass

* add ordering and list options as per @murphybytes' suggestion
2016-11-22 13:56:05 -08:00
Mike Arpaia
a8a7be7f20 Packs pages (#426)
* initial scaffolding

* pack info sidebar

* fixing the merge of the routes

* Remove radium from pack info sidepanel

* lint

* cards!

* redux entity config

* pack interface

* wiring up redux with fake dev data

* Add description attribute to packs

* move redux to top level page component to isolate data fetching

* initial scaffolding of all packs table

* adding redux entities back

* minimal

* alpha order in packs.js

* no newlines in HTML

* onclick handler to function on component class

* alpha order in router

* alpha order in paths.js

* no newline in side panel

* removing input field

* lint fixes
2016-11-21 11:49:36 -08:00
Zachary Wasserman
3cd841051b Add online count to target/label responses (#513)
Closes #508
2016-11-18 09:23:44 -08:00
Zachary Wasserman
34625ce4d0 Add service method/endpoint for creating distributed query campaign (#485) 2016-11-16 13:07:50 -08:00
John Murphy
6a825c11e3 Datastore refactor (#439)
Removed Gorm, replaced it with Sqlx

* Added SQL bundling command to Makfile

* Using go-kit logger

* Added soft delete capability

* Changed SearchLabel to accept a variadic param for optional omit list
instead of array

* Gorm removed

* Refactor table structures to use CURRENT_TIMESTAMP mysql function

* Moved Inmem datastore into it's own package

* Updated README

* Implemented code review suggestions from @zwass

* Removed reference to Gorm from glide.yaml
2016-11-16 21:47:49 +08:00
Mike Arpaia
752710ccf1 Return count of hosts in targets search for each label (#480) 2016-11-14 12:10:28 -08:00
Zachary Wasserman
9c38d6d19e Update osquery service methods for distributed queries (#476) 2016-11-14 10:22:54 -08:00
Zachary Wasserman
5d8a42a959 Fix page in RequireSetup check (#465)
The previous value would require setup unless there were at least 2 users. Now
one user is sufficient to proceed past setup.
2016-11-09 16:35:49 -08:00
Victor Vrantchan
ac14215e21 create first time setup endpoint (#436)
The endpoint is only active if there are no users in the datastore.
While the endpoint is active, it also disables all the other API endpoints, and /config returns `{"require_setup":true}`
for #378
2016-11-09 12:19:07 -05:00
Zachary Wasserman
675c40ea15 Cleanup in service_users_test (#460)
- Use subtests where appropriate
- Attempt to fix #445
2016-11-09 08:52:25 -08:00
Victor Vrantchan
def24499b5 store WebAddress config in datastore (#421)
moves web address config to datastore so that it can be configured by a user
in the Web UI.
rename OrgInfo struct to AppConfig.

For #363
For #378
2016-11-04 16:44:38 -04:00
Victor Vrantchan
b518447b31 correctly save user properties during ModifyUser call. (#395)
fixes #351

because RequestPasswordReset does it's own db query/save,
call it at the end, after all properties have already been saved.
2016-11-03 12:50:32 -04:00
Mike Arpaia
97de2bc5aa Label API Updates (#413)
close #403
close #404
close #412
2016-11-02 21:17:23 -04:00
Mike Arpaia
7ebebbb7b1 Target search endpoint (#339) 2016-11-02 10:59:53 -04:00
Zachary Wasserman
0faa3a55fb Make context imports consistent (#359) 2016-10-31 15:18:05 -07:00
Mike Arpaia
c5339ddb76 Fixing bug where non-updated query object is returned (#361) 2016-10-31 18:00:04 -04:00
Mike Arpaia
4f83220870 Add description field to Query (#358) 2016-10-31 17:05:02 -04:00
Zachary Wasserman
d2e31146c6 Fix bugs with password resets (#330)
- Permissions error with admin forced password reset
- Redirecting on successful admin forced password reset
- URL fix for forgot password reset
- Use JWT key for password reset request
2016-10-20 15:09:51 -04:00
Mike Arpaia
bdee0516e6 Removing sqlite from the codebase (#324) 2016-10-19 10:46:33 -04:00
Mike Arpaia
98ca32b783 Complete, working inmem datastore implementation (#319) 2016-10-17 15:30:47 -04:00
Zachary Wasserman
f9bb9de665 Add ordering options for List* methods (#318) 2016-10-17 10:01:14 -04:00
Mike Stone
beda051de2 Show invited users (#297)
* Adds loadAll action to redux entity config

* API Client get invites

* Add invites to the user management page

* Updates user block styles on user management page

* Submit modal form on enter

* Modify details form styles

* Enter submits edit user form

* Removes unused admin dashboard page

* API Client - revoke invites

* Delete invite entities in redux

* Revoke invites from admin manage users page

* Show success flash message after user invite is revoked
2016-10-14 17:08:57 -04:00
Zachary Wasserman
d9b98b22d6 Minor cleanup in service_invites_test (#313) 2016-10-14 09:01:26 -07:00
Zachary Wasserman
4b88ae6e2c Apply consistent naming conventions across server files (#310) 2016-10-14 08:59:27 -07:00
Zachary Wasserman
7f636aef4f Add pagination to List* endpoints (#309)
- Introduce kolide.ListOptions to store pagination params (in the future it can
  also store ordering/filtering params)
- Refactor service/datastore methods to take kolide.ListOptions
- Implement pagination
2016-10-13 11:21:47 -07:00
Zachary Wasserman
f9fa3e289f Return host 'status' with host endpoints (#307) 2016-10-12 14:41:35 -07:00
Victor Vrantchan
93eaae7454 Lowercase strings which should be case insensitive, like email and username. (#302)
Fixes #299
Closes #300
2016-10-12 12:35:34 -04:00
Zachary Wasserman
5d0cac882a Move API responses under top-level keys (#292) 2016-10-11 09:22:11 -07:00
Zachary Wasserman
24bb68b910 Rename GetAll* methods to List* (#291) 2016-10-07 10:26:48 -07:00
Zachary Wasserman
1cce02cf86 Fix bug causing empty lists to return as null in GetAll/List endpoints (#286)
Fixes #285
2016-10-06 09:24:12 -07:00
Victor Vrantchan
7221aac50f only set AdminForcedPasswordReset if payload value is true (#289)
Fixes #287
2016-10-06 08:43:09 -04:00
Zachary Wasserman
d0dcfefd25 Fix incorrect decode function in GetAllQueries (#284) 2016-10-05 17:35:07 -07:00
Zachary Wasserman
85a8e92b96 Implement endpoints for host service methods (#280)
- Remove service methods for modifying hosts
2016-10-05 17:10:44 -07:00
Zachary Wasserman
a1e18abb04 Update host labels in distributed query ingestion (#278) 2016-10-05 08:56:29 -07:00
Zachary Wasserman
19f6eddfeb Update host details in distributed query ingestion (#274)
- Introduce a new pattern for defining/ingesting detail queries
- Add many relevant host details:
  - Platform
  - osquery Version
  - Memory
  - Hostname
  - UUID
  - OS Version
  - Uptime
  - Primary interface MAC
  - Primary interface IP
- Fix parsing for inconsistent JSON schema returned from osquery
- Tests
2016-10-04 17:17:55 -07:00
Mike Arpaia
a03347489c Osquery Configuration Control (#244)
Label management APIs and an osquery config endpoint based on active pack and label state.
2016-10-02 20:14:35 -07:00
Zachary Wasserman
6d1c963bfa Flesh out log ingestion endpoint/service methods (#258) 2016-09-30 19:18:27 -07:00
Zachary Wasserman
74aaa14dde Implement osquery datastore methods for inmem datastore (#255)
- Implement osquery datastore methods
- Update tests for compatibility with inmem

Closes #255
2016-09-29 18:19:51 -07:00
Zachary Wasserman
ba528a46f1 Build endpoints for osquery service methods (#245)
- Establish a pattern for host authentication
- Establish a pattern for error JSON
- Add transport and make endpoint functions
- Fix discovered bugs + update tests
2016-09-28 21:21:39 -07:00
Victor Vrantchan
6fb96d98f7 Adds endpoints to invite new users to the application. (#235)
User service checks that tokens are valid on new user signups.
Closes #230
2016-09-28 22:44:05 -04:00
Mike Stone
738d7253c2 Login form displays error message (#243)
* Login form displays error message

* default bad auth to a generic error for the client
2016-09-28 20:46:45 -04:00
Victor Vrantchan
24b9baec1f add prometheus endpoint (#236)
generate metrics for Users, Appconfig and Session services
2016-09-28 07:35:15 -04:00
Mike Arpaia
0482f12926 Organizing go code (#241) 2016-09-26 11:48:55 -07:00