lussierj
8b0d32cd6b
Bind Agent observations, review, enrichment and telemetry to current Zone
and inventory authority. Preserve immutable MAC ownership and historical
snapshots with stale-result rejection and transactional security audits.
Retire unbound direct/range/scheduled discovery and one/bulk legacy summary
writes in both modes. Require reconciled exact inventory identity or
explicit Zone-scoped IP selection for CSV metadata imports.
Independent Blocker #1 application-security re-audit: PASS on tree
cf863aadc9. Evidence: 141 focused PostgreSQL/HTTP
tests passed; Chromium and PowerShell checks passed. Two documented baseline
source assertions remain unchanged. Production deployment is not approved.
41 lines
2.1 KiB
Bash
Executable File
41 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Run ONLY from the isolated review candidate. No .env files or published DB ports.
|
|
set -euo pipefail
|
|
review_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
: "${MINEROPS_REVIEW_BACKEND_IMAGE:?Set an existing Python backend image with requirements installed}"
|
|
docker image inspect "$MINEROPS_REVIEW_BACKEND_IMAGE" >/dev/null
|
|
review_id="minerops-discovery-review-$$-$RANDOM"
|
|
review_network="$review_id-network"
|
|
review_db="$review_id-postgres"
|
|
cleanup() {
|
|
docker rm -f "$review_db" >/dev/null 2>&1 || true
|
|
docker network rm "$review_network" >/dev/null 2>&1 || true
|
|
}
|
|
trap cleanup EXIT
|
|
docker network create --internal "$review_network" >/dev/null
|
|
docker run -d --name "$review_db" --network "$review_network" --network-alias postgres \
|
|
--tmpfs /var/lib/postgresql/data \
|
|
-e POSTGRES_DB=discovery_review -e POSTGRES_USER=reviewer \
|
|
-e POSTGRES_PASSWORD=disposable-review-only postgres:16-alpine >/dev/null
|
|
review_ready=0
|
|
for _ in $(seq 1 40); do
|
|
if docker exec "$review_db" pg_isready -U reviewer -d discovery_review >/dev/null 2>&1; then review_ready=1; break; fi
|
|
sleep 0.5
|
|
done
|
|
[[ "$review_ready" == 1 ]]
|
|
run_backend() {
|
|
docker run --rm --network "$review_network" -v "$review_root:/review:ro" \
|
|
-w /review/backend -e PYTHONDONTWRITEBYTECODE=1 -e PYTHONPATH=/review/backend \
|
|
-e POSTGRES_HOST=postgres -e POSTGRES_DB=discovery_review -e POSTGRES_USER=reviewer \
|
|
-e POSTGRES_PASSWORD=disposable-review-only -e JWT_SECRET_KEY=disposable-review-only \
|
|
-e MINEROPS_DISCOVERY_DISPOSABLE=1 -e MINEROPS_HUB_MODE=true \
|
|
-e SCHEDULED_SCAN_ENABLED=false -e MINEROPS_WINDOWS_AGENT_SOURCE=/review/agents/windows \
|
|
"$MINEROPS_REVIEW_BACKEND_IMAGE" "$@"
|
|
}
|
|
run_backend alembic upgrade head
|
|
run_backend python -m unittest -v tests.test_discovery_security_postgres \
|
|
tests.test_agent_discovery_isolation_postgres \
|
|
tests.test_legacy_inventory_security_postgres
|
|
# Browser and PowerShell suites use their own intercepted/loopback transports.
|
|
# See docs/operations/BLOCKER_1_DISCOVERY_REVIEW.txt for exact commands and baseline exceptions.
|