gtiandClaude Sonnet 5
8d6122c096
One universal Windows Agent package per version (agent_releases: version/ platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary lives on a local release-storage volume, never in PostgreSQL). An operator creates a pending installation (agent_enrollments) from Agents / Servidores -> + Nova instalação, then either downloads it directly or generates a one-time HTTPS link (short TTL, single use). Either path streams the package plus a freshly minted enrollment.json whose token is never written to storage in plaintext, only its SHA-256 hash. On the client host, gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non- HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment token immediately after, success or failure), writes an ACL-restricted .env with the newly issued permanent Agent token, and registers the Windows Service without starting it (Firebird stays unconfigured on purpose). Idempotent, replay-proof, rate-limited per IP, fully audited, never logs a secret. Migration 0022_agent_releases_enrollment (verified fresh-DB == upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION bumped to 1.1.0 as the single source of truth across code, packages, the release manifest and every published AgentRelease row. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
89 lines
5.2 KiB
Python
89 lines
5.2 KiB
Python
"""Agent distribution: releases + secure enrollment.
|
|
|
|
agent_releases catalogs published builds of the universal Windows Agent
|
|
package (the binary itself lives in local release storage, never in
|
|
Postgres). agent_enrollments tracks one pending-or-completed installation
|
|
per row, carrying two distinct hashed, single-use, short-TTL secrets: a
|
|
download token (the shareable package link) and an enrollment token
|
|
(embedded in the downloaded bundle, consumed once by POST /v1/agents/enroll).
|
|
Neither secret is ever stored in plaintext.
|
|
|
|
Revision ID: 0022_agent_releases_enrollment
|
|
Revises: 0021_sso_federated_identity
|
|
"""
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
|
|
revision = "0022_agent_releases_enrollment"
|
|
down_revision = "0021_sso_federated_identity"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
|
|
def upgrade():
|
|
op.create_table(
|
|
"agent_releases",
|
|
sa.Column("id", sa.Integer(), primary_key=True),
|
|
sa.Column("version", sa.String(32), nullable=False),
|
|
sa.Column("platform", sa.String(16), nullable=False, server_default="windows"),
|
|
sa.Column("architecture", sa.String(16), nullable=False, server_default="x64"),
|
|
sa.Column("filename", sa.String(255), nullable=False),
|
|
sa.Column("size_bytes", sa.Integer(), nullable=False),
|
|
sa.Column("sha256", sa.String(64), nullable=False),
|
|
sa.Column("storage_path", sa.String(512), nullable=False),
|
|
sa.Column("status", sa.String(16), nullable=False, server_default="DRAFT"),
|
|
sa.Column("release_notes", sa.Text(), nullable=True),
|
|
sa.Column("created_by", sa.Integer(), sa.ForeignKey("admin_users.id"), nullable=True),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
|
sa.Column("published_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.UniqueConstraint("version", "platform", "architecture", name="uq_agent_release_version"),
|
|
)
|
|
op.create_index("ix_agent_releases_version", "agent_releases", ["version"])
|
|
op.create_index("ix_agent_releases_sha256", "agent_releases", ["sha256"])
|
|
op.create_index("ix_agent_releases_status", "agent_releases", ["status"])
|
|
|
|
op.create_table(
|
|
"agent_enrollments",
|
|
sa.Column("id", sa.Integer(), primary_key=True),
|
|
sa.Column("enrollment_uuid", sa.String(36), nullable=False),
|
|
sa.Column("tenant_id", sa.Integer(), sa.ForeignKey("tenants.id"), nullable=False),
|
|
sa.Column("display_name", sa.String(160), nullable=False),
|
|
sa.Column("expected_hostname", sa.String(255), nullable=True),
|
|
sa.Column("release_id", sa.Integer(), sa.ForeignKey("agent_releases.id"), nullable=False),
|
|
sa.Column("status", sa.String(16), nullable=False, server_default="PENDING"),
|
|
sa.Column("created_by", sa.Integer(), sa.ForeignKey("admin_users.id"), nullable=True),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
|
sa.Column("download_token_hash", sa.String(64), nullable=True),
|
|
sa.Column("download_token_expires_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.Column("download_max_uses", sa.Integer(), nullable=False, server_default="1"),
|
|
sa.Column("download_uses", sa.Integer(), nullable=False, server_default="0"),
|
|
sa.Column("downloaded_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.Column("enrollment_token_hash", sa.String(64), nullable=True),
|
|
sa.Column("enrollment_token_expires_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.Column("enrollment_used_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.Column("machine_fingerprint_seen", sa.String(128), nullable=True),
|
|
sa.Column("hostname_seen", sa.String(255), nullable=True),
|
|
sa.Column("hostname_mismatch", sa.Boolean(), nullable=False, server_default="false"),
|
|
sa.Column("agent_id", sa.Integer(), sa.ForeignKey("agents.id"), nullable=True),
|
|
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
|
sa.UniqueConstraint("enrollment_uuid", name="uq_agent_enrollment_uuid"),
|
|
)
|
|
op.create_index("ix_agent_enrollments_uuid", "agent_enrollments", ["enrollment_uuid"])
|
|
op.create_index("ix_agent_enrollments_tenant", "agent_enrollments", ["tenant_id"])
|
|
op.create_index("ix_agent_enrollments_release", "agent_enrollments", ["release_id"])
|
|
op.create_index("ix_agent_enrollments_status", "agent_enrollments", ["status"])
|
|
op.create_index("ix_agent_enrollments_agent", "agent_enrollments", ["agent_id"])
|
|
|
|
|
|
def downgrade():
|
|
op.drop_index("ix_agent_enrollments_agent", table_name="agent_enrollments")
|
|
op.drop_index("ix_agent_enrollments_status", table_name="agent_enrollments")
|
|
op.drop_index("ix_agent_enrollments_release", table_name="agent_enrollments")
|
|
op.drop_index("ix_agent_enrollments_tenant", table_name="agent_enrollments")
|
|
op.drop_index("ix_agent_enrollments_uuid", table_name="agent_enrollments")
|
|
op.drop_table("agent_enrollments")
|
|
op.drop_index("ix_agent_releases_status", table_name="agent_releases")
|
|
op.drop_index("ix_agent_releases_sha256", table_name="agent_releases")
|
|
op.drop_index("ix_agent_releases_version", table_name="agent_releases")
|
|
op.drop_table("agent_releases")
|