gtiandClaude Sonnet 5
8d6122c096
One universal Windows Agent package per version (agent_releases: version/ platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary lives on a local release-storage volume, never in PostgreSQL). An operator creates a pending installation (agent_enrollments) from Agents / Servidores -> + Nova instalação, then either downloads it directly or generates a one-time HTTPS link (short TTL, single use). Either path streams the package plus a freshly minted enrollment.json whose token is never written to storage in plaintext, only its SHA-256 hash. On the client host, gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non- HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment token immediately after, success or failure), writes an ACL-restricted .env with the newly issued permanent Agent token, and registers the Windows Service without starting it (Firebird stays unconfigured on purpose). Idempotent, replay-proof, rate-limited per IP, fully audited, never logs a secret. Migration 0022_agent_releases_enrollment (verified fresh-DB == upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION bumped to 1.1.0 as the single source of truth across code, packages, the release manifest and every published AgentRelease row. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
36 lines
1.4 KiB
Python
36 lines
1.4 KiB
Python
"""Local, non-web-served storage for published Agent release zips.
|
|
|
|
Binaries never live in PostgreSQL — only their metadata (AgentRelease rows)
|
|
do. The storage root is a plain directory outside `central/static`, so it is
|
|
never directly reachable by a URL; every download goes through the
|
|
authenticated or token-gated routes in agent_distribution.py.
|
|
"""
|
|
from pathlib import Path
|
|
|
|
from . import config
|
|
|
|
_SAFE_COMPONENT = __import__("re").compile(r"^[A-Za-z0-9._-]+$")
|
|
|
|
|
|
def storage_root() -> Path:
|
|
root = Path(config.settings.agent_release_storage_path)
|
|
root.mkdir(parents=True, exist_ok=True)
|
|
return root
|
|
|
|
|
|
def release_filename(version: str, platform: str, architecture: str) -> str:
|
|
return f"GTIFiscalAgent-{version}-{platform}-{architecture}.zip"
|
|
|
|
|
|
def safe_path_for(storage_path: str) -> Path:
|
|
"""Resolve a release's storage_path against the root, refusing anything
|
|
that could escape it (path traversal). storage_path is DB-controlled
|
|
(never derived from an HTTP request), but this stays fail-closed anyway."""
|
|
if not storage_path or not _SAFE_COMPONENT.match(storage_path):
|
|
raise ValueError(f"unsafe release storage_path: {storage_path!r}")
|
|
root = storage_root().resolve()
|
|
candidate = (root / storage_path).resolve()
|
|
if candidate.parent != root:
|
|
raise ValueError(f"release storage_path escapes storage root: {storage_path!r}")
|
|
return candidate
|