salopensource · grahamgilbert · Feb 6, 2018 · Sep 5, 2017 · Sep 6, 2017 · Sep 6, 2017
diff --git a/3rdpartyclients.md b/3rdpartyclients.md
@@ -0,0 +1,49 @@
+(This will end up in the wiki, this is just here so we can work on it in the meantime)
+
+There are existing agents for Sal for both macOS and Windows, but if you wish to build a reporting agent for another platform, the sent data should be in the following format.
+
+If the server has basic authentication enabled (which is the default), you should use the username `sal` and the password will be the client’s key.
+
+The data here is represented as a Python dictionary, you should extrapolate the data structure for the language you are writing the agent in.
+
+```
+{
+    # This needs to be unique for each run. uuidgen on macOS is great for this
+    'run_uuid': 'e38e3237-50c9-41d7-b0fa-86be834bd766’,
+    # This is the total disk size in
+    'disk_size': 976163048,
+    'name': u'thunderpants',
+    'key': u'yourveryveryverylongkey',
+    'sal_version': '2.0.4',
+    # The serial number must be unique - it is the unique key for a checkin
+    'serial': u'SOMESERIALNUMBERMUSTBEUNIQUE',
+    # Choose one of the following
+    'base64report': 'your base64 encoded report',
+    'base64bz2report': 'your base64, bzip2 compressed report'
+}
+```
+
+## The report
+The report should start life as a plist. How you generate this is up to you (python, go and javascript have libraries for generating these). The plist should then either be just base 64 encoded, or b2zipped, then base 64 encoded. If your platform supports b2zip, it is suggested that you utilize it.
+
+Sal supports two formats for `MachineInfo` - this can either be in the data structure you get from System Profiler on macOS (under the `SystemProfile` key), or you can use the following fields within a `HardwareInfo` dictionary.
+
+```
+'MachineInfo':
+{   
+    'os_vers': 'Windows ABC Release l33t',
+    # Available disk space, in KB (integer)
+    'AvailableDiskSpace': 1230,
+    # Total disk size, in KB (integer)
+    'disk_size': 50000,
+    # One of 'Darwin', 'Windows', 'Linux'
+    'os_family': 'Windows',
+    'HardwareInfo': {
+        'machine_model': 'The model of your computer',
+        'cpu_type': 'x86 etc',
+        'current_processor_speed': '20Ghz',
+        # This must end with ' KB', ' MB', ' GB' or ' TB' - note the space at the end
+        'physical_memory': '16 GB',
+    }
+}
+```
diff --git a/README.md b/README.md
@@ -34,7 +34,7 @@ There are variants of Sal that support both [SAML](https://hub.docker.com/r/maca
 
 ## Having problems?
 
-You should check out the [troubleshooting](https://github.com/salopensource/sal/wiki/Troubleshooting) page, consider getting in touch via the [Google group](http://groups.google.com/group/sal-discuss), or heading over the the #slack channel on the [macadmins.org Slack](http://macadmins.org).
+You should check out the [troubleshooting](https://github.com/salopensource/sal/wiki/Troubleshooting) page, consider getting in touch via the [Google group](http://groups.google.com/group/sal-discuss), or heading over the the #sal channel on the [macadmins.org Slack](http://macadmins.org).
 
 ## API
 

diff --git a/api/auth.py b/api/auth.py
@@ -2,40 +2,44 @@
 from rest_framework import authentication
 from rest_framework import exceptions
 from rest_framework import permissions
-from server.models import *
+
+from server.models import ApiKey
+
 
 class ApiKeyAuthentication(authentication.BaseAuthentication):
+    """Use publickey/privatekey HTTP headers for authentication"""
+
     def authenticate(self, request):
         public_key = request.META.get('HTTP_PUBLICKEY', False)
         private_key = request.META.get('HTTP_PRIVATEKEY', False)
-        if not public_key or not private_key:
+        if not any((public_key, private_key)):
             return None
 
         try:
-            api_key = ApiKey.objects.get(private_key=private_key, public_key=public_key)
+            api_key = ApiKey.objects.get(
+                private_key=private_key, public_key=public_key)
         except ApiKey.DoesNotExist:
             raise exceptions.AuthenticationFailed('Invalid API Key')
 
         return (api_key, None)
 
+
 class HasRWPermission(permissions.BasePermission):
-    """
-    Only allows RW API keys to write
-    """
+    """Only allow Users with 'Global Admin' level or RW API keys."""
 
-    def has_object_permission(self, request, view, obj):
-        public_key = request.META.get('HTTP_PUBLICKEY', False)
-        private_key = request.META.get('HTTP_PRIVATEKEY', False)
-        if not public_key or not private_key:
+    def has_permission(self, request, view):
+        # Grant Sal 'Global Admin' Users access.
+        if isinstance(request.user, User):
+            return request.user.userprofile.level in ('GA',)
+        # Otherwise, all API tokens that have passed auth can perform
+        # 'safe' methods.
+        elif isinstance(request.user, ApiKey):
+            if request.method in permissions.SAFE_METHODS:
+                return True
+            # Write permissions are only allowed to keys that have RW.
+            return request.user.read_write
+        else:
+            # If authentication fails, the user will be of type
+            # django.contrib.auth.models.AnonymousUser;
+            # reject anonymous users.
             return False
-
-        try:
-            api_key = ApiKey.objects.get(private_key=private_key, public_key=public_key)
-        except ApiKey.DoesNotExist:
-            raise exceptions.AuthenticationFailed('Invalid API Key')
-        # Read permissions are allowed to any request,
-        # so we'll always allow GET, HEAD or OPTIONS requests.
-        if request.method in permissions.SAFE_METHODS:
-            return True
-        # Write permissions are only allowed to keys that have RW.
-        return api_key.read_write
diff --git a/api/fixtures/business_unit_fixtures.json b/api/fixtures/business_unit_fixtures.json
@@ -0,0 +1,18 @@
+[
+{
+    "model": "server.businessunit",
+    "pk": 1,
+    "fields": {
+        "name": "Gandalf",
+        "users": []
+    }
+},
+{
+    "model": "server.businessunit",
+    "pk": 2,
+    "fields": {
+        "name": "You don't want to know",
+        "users": []
+    }
+}
+]
diff --git a/api/fixtures/conditions_fixture.json b/api/fixtures/conditions_fixture.json
@@ -0,0 +1,20 @@
+[
+    {
+        "fields": {
+            "condition_data": "9",
+            "condition_name": "os_vers_minor",
+            "machine": 1
+        },
+        "model": "server.condition",
+        "pk": 1
+    },
+    {
+        "fields": {
+            "condition_data": "True",
+            "condition_name": "x86_64_capable",
+            "machine": 1
+        },
+        "model": "server.condition",
+        "pk": 13105433
+    }
+]
diff --git a/api/fixtures/fact_fixtures.json b/api/fixtures/fact_fixtures.json
@@ -0,0 +1,20 @@
+[
+    {
+        "fields": {
+            "fact_data": "464.79 GiB",
+            "fact_name": "mountpoints=>/=>size",
+            "machine": 1
+        },
+        "model": "server.fact",
+        "pk": 1
+    },
+    {
+        "fields": {
+            "fact_data": "1500",
+            "fact_name": "networking=>interfaces=>en0=>mtu",
+            "machine": 1
+        },
+        "model": "server.fact",
+        "pk": 151681726
+    }
+]
diff --git a/api/fixtures/inventory_fixtures.json b/api/fixtures/inventory_fixtures.json
@@ -0,0 +1,30 @@
+[
+    {
+        "fields": {
+            "bundleid": "com.sheagcraig.tacofortress",
+            "bundlename": "TacoFortress",
+            "name": "TacoFortress"
+        },
+        "model": "inventory.application",
+        "pk": 1
+    },
+    {
+        "fields": {
+            "datestamp": "2018-01-24T17:32:36.519Z",
+            "machine": 1,
+            "sha256hash": "be6d4deb1308ea52ef4c27d2c1b6610c5dae18ddc497360a42e075b5f52697f4"
+        },
+        "model": "inventory.inventory",
+        "pk": 1
+    },
+    {
+        "fields": {
+            "application": 1,
+            "machine": 1,
+            "path": "/Applications/TacoFortress.app",
+            "version": "201.3.6"
+        },
+        "model": "inventory.inventoryitem",
+        "pk": 1
+    }
+]
diff --git a/api/fixtures/machine_fixtures.json b/api/fixtures/machine_fixtures.json
@@ -0,0 +1,78 @@
+[
+{
+    "model": "server.machine",
+    "pk": 1,
+    "fields": {
+        "machine_group": 1,
+        "serial": "C0DEADBEEF",
+        "hostname": "mla680",
+        "operating_system": "10.12",
+        "memory": "16 GB",
+        "memory_kb": 16777216,
+        "munki_version": "2.8.1.2845",
+        "manifest": "C0DEADBEEF",
+        "hd_space": "476429672",
+        "hd_total": "975912960",
+        "hd_percent": "51",
+        "console_user": "shcrai",
+        "machine_model": "MacBookPro11,5",
+        "machine_model_friendly": "MacBook Pro (Retina, 15-inch, Mid 2015)",
+        "cpu_type": "Intel Core i7",
+        "cpu_speed": "2.5 GHz",
+        "os_family": "Darwin",
+        "last_checkin": "2016-10-06T19:29:38.376Z",
+        "first_checkin": "2016-10-06T15:51:21.145Z",
+        "report": "",
+        "report_format": "base64bz2",
+        "errors": 4,
+        "warnings": 7,
+        "activity": "",
+        "puppet_version": "4.7.0",
+        "sal_version": "1.0.6",
+        "last_puppet_run": "2016-10-06T19:06:21Z",
+        "puppet_errors": 0,
+        "install_log_hash": "ed168dbcf43e8c89ec3bc1a5708a7210cfeeedf0fc4e8cbbda2e0b50af782e72",
+        "install_log": "",
+        "deployed": true,
+        "broken_client": false
+    }
+},
+{
+    "model": "server.machine",
+    "pk": 2,
+    "fields": {
+        "machine_group": 1,
+        "serial": "C1DEADBEEF",
+        "hostname": "mla806",
+        "operating_system": "10.12.5",
+        "memory": "16 GB",
+        "memory_kb": 16777216,
+        "munki_version": "2.8.2.2855",
+        "manifest": "C1DEADBEEF",
+        "hd_space": "536276480",
+        "hd_total": "975831040",
+        "hd_percent": "45",
+        "console_user": "shcrai",
+        "machine_model": "MacBookPro13,3",
+        "machine_model_friendly": "MacBook Pro (15-inch, 2016)",
+        "cpu_type": "Intel Core i7",
+        "cpu_speed": "2.7 GHz",
+        "os_family": "Darwin",
+        "last_checkin": "2017-05-16T19:04:51.336Z",
+        "first_checkin": "2017-05-16T19:04:51.728Z",
+        "report": "",
+        "report_format": "base64bz2",
+        "errors": 0,
+        "warnings": 3,
+        "activity": "",
+        "puppet_version": "4.10.1",
+        "sal_version": "2.0.3",
+        "last_puppet_run": "2017-05-16T18:54:56Z",
+        "puppet_errors": 0,
+        "install_log_hash": null,
+        "install_log": null,
+        "deployed": true,
+        "broken_client": false
+    }
+}
+]
diff --git a/api/fixtures/machine_group_fixtures.json b/api/fixtures/machine_group_fixtures.json
@@ -0,0 +1,20 @@
+[
+{
+    "model": "server.machinegroup",
+    "pk": 1,
+    "fields": {
+        "business_unit": 1,
+        "name": "Hai",
+        "key": "11c3qkyht9b88uja3i7v46rztrzejdgechnl8jw5fqv7z84vdgjynrn9czykctfi4quu4uvbwijbrentnmqepx9jw61avepnl2n8talsk37jnkm36tdvpra55311gi03"
+    }
+},
+{
+    "model": "server.machinegroup",
+    "pk": 2,
+    "fields": {
+        "business_unit": 1,
+        "name": "tacos",
+        "key": "tp702yfyw698e7dag786r0ejd99oywwj4ij7egbb4dqm5ghdj9e00zyygppx7okaa4p7vod1h0u7mzeau60yfcji6nnsvbz0y592subwigqa8q3wimebo63cs1d0yj71"
+    }
+}
+]
diff --git a/api/fixtures/pending_apple_update_fixtures.json b/api/fixtures/pending_apple_update_fixtures.json
@@ -0,0 +1,22 @@
+[
+    {
+        "fields": {
+            "display_name": "Safari",
+            "machine": 1,
+            "update": "Safari9.1Mavericks",
+            "update_version": "9.1"
+        },
+        "model": "server.pendingappleupdate",
+        "pk": 1
+    },
+    {
+        "fields": {
+            "display_name": "Remote Desktop Client Update",
+            "machine": 1,
+            "update": "RemoteDesktopClient",
+            "update_version": "3.8.5"
+        },
+        "model": "server.pendingappleupdate",
+        "pk": 1577299
+    }
+]
diff --git a/api/fixtures/pending_update_fixtures.json b/api/fixtures/pending_update_fixtures.json
@@ -0,0 +1,22 @@
+[
+    {
+        "fields": {
+            "display_name": "app_store_prefs-1.0.0",
+            "machine": 1,
+            "update": "app_store_prefs",
+            "update_version": "1.0.0"
+        },
+        "model": "server.pendingupdate",
+        "pk": 1
+    },
+    {
+        "fields": {
+            "display_name": "LyncSetup-1.2",
+            "machine": 1,
+            "update": "LyncSetup",
+            "update_version": "0.1.2"
+        },
+        "model": "server.pendingupdate",
+        "pk": 995286
+    }
+]
diff --git a/api/fixtures/plugin_script_fixtures.json b/api/fixtures/plugin_script_fixtures.json
@@ -0,0 +1,25 @@
+[
+    {
+        "fields": {
+            "historical": false,
+            "machine": 1,
+            "plugin": "Tacos",
+            "recorded": "2016-08-25T15:35:27.328Z"
+        },
+        "model": "server.pluginscriptsubmission",
+        "pk": 1
+    },
+    {
+        "fields": {
+            "pluginscript_data": "Enabled",
+            "pluginscript_data_date": null,
+            "pluginscript_data_int": 0,
+            "pluginscript_data_string": null,
+            "pluginscript_name": "Tacos",
+            "submission": 1,
+            "submission_and_script_name": "MachineDetailSecurity: Tacos"
+        },
+        "model": "server.pluginscriptrow",
+        "pk": 1
+    }
+]