lussierj
e898f283ab
Disable physical control through legacy HTTP/M30 producers, typed admission, queue dispatch and upgraded Windows executors. Restrict diagnostic transports to exact read-only operations, with ordinal PowerShell validation before sockets. Retire unsupported pending/claimed work with atomic, idempotent security audits. Preserve prior delivery evidence and report unknown outcomes after a prior claim, including explicitly repaired pending rows. Include containment, cancellation, concurrency and malformed-payload regressions and the old-Agent cutover runbook. Validation: independent final application-security revalidation PASS. Two unchanged baseline source-assertion failures are documented as exceptions. Production release still requires native Windows validation and verified fencing/stop/drain/upgrade; server cancellation alone cannot revoke a cached command held by an old Agent.
99 lines
3.7 KiB
Python
99 lines
3.7 KiB
Python
"""Business rules for typed, Agent-routed miner controls."""
|
|
|
|
from uuid import UUID
|
|
|
|
from app.miner_control.exceptions import (
|
|
ControlledMinerNotFound,
|
|
MinerControlActorRequired,
|
|
MinerControlUnavailable,
|
|
)
|
|
from app.miner_control.models import (
|
|
ControlAgentAvailability,
|
|
ControlCapability,
|
|
MinerControlAccepted,
|
|
MinerControlOperation,
|
|
MinerControlProjection,
|
|
)
|
|
from app.miner_control.repository import MinerControlRepository
|
|
from app.agent_commands.policy import PHYSICAL_CONTROL_DISABLED
|
|
|
|
|
|
KNOWN_MODES = {"low", "normal", "high"}
|
|
RUNNING_STATES = {"online", "running"}
|
|
STOPPED_STATES = {"suspended", "stopped"}
|
|
|
|
|
|
class MinerControlService:
|
|
def __init__(self, repository: MinerControlRepository):
|
|
self.repository = repository
|
|
|
|
@staticmethod
|
|
def _capability(context: dict) -> ControlCapability:
|
|
# Credentials and Zone routing are not physical identity authorization.
|
|
return ControlCapability(state="unavailable", reason=PHYSICAL_CONTROL_DISABLED)
|
|
|
|
@staticmethod
|
|
def _operation(miner_id: UUID, row: dict) -> MinerControlOperation:
|
|
request = row.get("request_payload") or {}
|
|
result = row.get("result_payload") or {}
|
|
mode = result.get("observed_performance_mode")
|
|
return MinerControlOperation(
|
|
operation_id=row["operation_id"],
|
|
miner_id=miner_id,
|
|
action=request.get("action"),
|
|
requested_value=request.get("requested_value"),
|
|
status=row["status"],
|
|
verification_status=result.get("verification_status"),
|
|
command_accepted=result.get("command_accepted"),
|
|
observed_performance_mode=mode if mode in KNOWN_MODES else None,
|
|
failure_code=result.get("failure_code"),
|
|
created_at=row["created_at"],
|
|
claimed_at=row.get("claimed_at"),
|
|
completed_at=row.get("completed_at"),
|
|
)
|
|
|
|
def get_controls(self, miner_id: UUID) -> MinerControlProjection:
|
|
context = self.repository.get_control_context(miner_id)
|
|
if not context:
|
|
raise ControlledMinerNotFound("Miner not found")
|
|
capability = self._capability(context)
|
|
runtime = str(context.get("runtime_state") or "").strip().lower() or None
|
|
service_action = None
|
|
if capability.state == "supported":
|
|
if runtime in RUNNING_STATES:
|
|
service_action = "suspend"
|
|
elif runtime in STOPPED_STATES:
|
|
service_action = "resume"
|
|
configured_mode = str(context.get("configured_performance_mode") or "").lower()
|
|
return MinerControlProjection(
|
|
miner_id=miner_id,
|
|
runtime_state=runtime,
|
|
performance_mode=(configured_mode if configured_mode in KNOWN_MODES else None),
|
|
agent=ControlAgentAvailability(
|
|
state=capability.state,
|
|
reason=capability.reason,
|
|
last_checkin_at=context.get("last_checkin_at"),
|
|
version=context.get("agent_version"),
|
|
),
|
|
service_control=capability,
|
|
performance_mode_control=capability,
|
|
available_service_action=service_action,
|
|
recent_operations=[
|
|
self._operation(miner_id, row)
|
|
for row in self.repository.list_recent(miner_id, limit=5)
|
|
],
|
|
)
|
|
|
|
def queue_control(
|
|
self,
|
|
miner_id: UUID,
|
|
action: str,
|
|
*,
|
|
requested_value: str | None,
|
|
actor_user_id: UUID,
|
|
actor_username: str,
|
|
) -> MinerControlAccepted:
|
|
if not actor_user_id:
|
|
raise MinerControlActorRequired("Authenticated actor UUID is required")
|
|
raise MinerControlUnavailable(PHYSICAL_CONTROL_DISABLED)
|