hansjone/netx
1
0
Fork 0
mirror of https://github.com/hansjone/netx.git synced 2026-10-09 04:20:45 +08:00
Code Issues Projects Releases 1 Packages Wiki Activity Actions 2

Skip CLI startup when device credentials are incomplete.

Browse source 
Reject non-interactive CLI work early across exec, LLDP, config sync, collection, traffic, and connect-test flows so tasks record a clear reason instead of launching a doomed session.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-08-11 15:11:59 +08:00
parent dcdf4147a6
commit b6a579ec02
12 changed files with 317 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

72
netx_api/cli_creds.py Normal file
View file

@ -0,0 +1,72 @@
"""Shared CLI credential readiness checks (non-interactive exec vs WebCRT)."""
from __future__ import annotations
from typing import Any
from fastapi import HTTPException
# Reasons surfaced in job rows / execManagedNe responses (grep-friendly).
REASON_IP_REQUIRED = "ip_address_required"
REASON_USERNAME_REQUIRED = "cli_username_required"
REASON_NO_PASSWORD = "no_password"
REASON_HOP_INCOMPLETE = "hop_credentials_incomplete"
REASON_INCOMPLETE = "credentials_incomplete"
def cli_creds_ready(creds: dict[str, Any], *, interactive: bool = False) -> tuple[bool, str]:
"""Return (ready, reason). ``reason`` is empty when ready.
Non-interactive paths (LLDP, config sync, collection, MCP exec) require
enough credentials to authenticate without a human at the terminal.
Interactive WebCRT allows telnet without saved username/password so the user
can type credentials in the terminal (SecureCRT-style).
"""
ip = str(creds.get("ip_address") or "").strip()
if not ip:
return False, REASON_IP_REQUIRED
hop_enabled = bool(creds.get("hop_enabled"))
hop_vendor = str(creds.get("hop_vendor") or "").strip().lower()
auth_mode = str(creds.get("hop_target_auth_mode") or "bastion_managed").strip().lower()
protocol = str(creds.get("protocol") or "ssh").strip().lower()
username = str(creds.get("username") or "").strip()
password = str(creds.get("password") or "")
if hop_enabled:
hop_host = str(creds.get("hop_host") or "").strip()
hop_user = str(creds.get("hop_username") or "").strip()
hop_pass = str(creds.get("hop_password") or "")
if not hop_host or not hop_user or not hop_pass:
return False, REASON_HOP_INCOMPLETE
# Bastion-managed: target password may live on the bastion side.
if hop_vendor == "bastion" and auth_mode == "bastion_managed":
return True, ""
if not username:
return False, REASON_USERNAME_REQUIRED
if not password:
return False, REASON_NO_PASSWORD
return True, ""
if interactive and protocol == "telnet":
return True, ""
if not username:
return False, REASON_USERNAME_REQUIRED
if not password:
return False, REASON_NO_PASSWORD
return True, ""
def cli_creds_skip_reason(creds: dict[str, Any], *, interactive: bool = False) -> str | None:
"""Return a skip/fail reason, or None when CLI may proceed."""
ready, reason = cli_creds_ready(creds, interactive=interactive)
return None if ready else reason
def require_cli_creds_ready(creds: dict[str, Any], *, interactive: bool = False) -> None:
"""Raise HTTP 400 when credentials cannot support the requested CLI mode."""
ready, reason = cli_creds_ready(creds, interactive=interactive)
if not ready:
raise HTTPException(status_code=400, detail=reason or REASON_INCOMPLETE)

14
netx_api/config_sync_runner.py
View file

@ -13,6 +13,7 @@ from uuid import uuid4
from fastapi import HTTPException
from .cli_creds import cli_creds_skip_reason
from .cli_resolve import resolve_cli_target
from .config import settings
from .config_sync_codec import compress_text
@ -318,6 +319,19 @@ def _run_single(cycle_id: str, task_id: str) -> None:
_update_task(task_id, status="fail", message=_format_error(exc), ended_at=_utcnow())
return
skip = cli_creds_skip_reason(creds, interactive=False)
if skip:
_update_task(
task_id,
status="fail",
message=skip[:1020],
vendor=str(device.get("vendor") or vendor_hint or ""),
ne_name=str(device.get("name") or task.ne_name or ""),
ne_ip=str(device.get("ip_address") or task.ne_ip or ""),
ended_at=_utcnow(),
)
return
vendor = str(device.get("vendor") or vendor_hint or "")
device_type = str(device.get("device_type") or "")
ne_name = str(device.get("name") or task.ne_name or "")

5
netx_api/ne_collect_runner.py
View file

@ -14,6 +14,7 @@ from .config import settings
from .db import SessionLocal
from fastapi import HTTPException
from .cli_creds import cli_creds_skip_reason
from .cli_budget import clamp_cli_workers
from .cli_resolve import resolve_cli_target
from .models import NeCollectionJob, NeCollectionRun
@ -205,6 +206,10 @@ def _run_single(job_id: str, run_id: str, commands: list[str]) -> None:
creds, _device = resolve_cli_target(db, ume_ne_id=tid)
else:
creds, _device = resolve_cli_target(db, managed_ne_id=tid)
skip = cli_creds_skip_reason(creds, interactive=False)
if skip:
_update_run(run_id, status="fail", message=skip[:1020], ended_at=datetime.now())
return
output = _collect_with_timeout(creds, commands)
finished_at = datetime.now()
name_part = _safe_filename_part(str(run.ne_name or creds.get("name") or "ne"))

15
netx_api/ne_connect.py
View file

@ -11,6 +11,7 @@ from .config import settings
from .db import SessionLocal
from .models import ManagedNE, UmeCliOverride, UmeInventoryNE
from .ne_crypto import CredentialCryptoError
from .cli_creds import cli_creds_skip_reason
from .cli_resolve import resolve_cli_target
from .ne_service import get_device_credentials
from .ne_netmiko import send_show_command
@ -361,6 +362,13 @@ def _run_single(ne_id: str) -> None:
)
_update_row(ne_id, "fail", str(exc), detail=detail)
return
skip = cli_creds_skip_reason(creds, interactive=False)
if skip:
detail = _truncate_detail(
"\n".join(_connect_context_lines(creds)) + f"\nresult=fail\nerror={skip}"
)
_update_row(ne_id, "fail", skip, detail=detail)
return
status, message, discovered, detail = _probe_device(creds)
_update_row(ne_id, status, message, discovered, detail=detail)
except Exception as exc:
@ -418,6 +426,13 @@ def _run_single_ume(ume_ne_id: str) -> None:
detail = _truncate_detail(traceback.format_exc())
_update_ume_override_row(uid, "fail", str(exc)[:480], detail=detail)
return
skip = cli_creds_skip_reason(creds, interactive=False)
if skip:
detail = _truncate_detail(
"\n".join(_connect_context_lines(creds)) + f"\nresult=fail\nerror={skip}"
)
_update_ume_override_row(uid, "fail", skip, detail=detail)
return
status, message, discovered, detail = _probe_device(creds)
_update_ume_override_row(uid, status, message, discovered, detail=detail)
except Exception as exc:

11
netx_api/ne_exec.py
View file

@ -8,6 +8,7 @@ from typing import Any
from fastapi import HTTPException
from sqlalchemy.orm import Session
from .cli_creds import cli_creds_skip_reason
from .cli_resolve import resolve_cli_target
from .config import settings
from .db import SessionLocal
@ -65,6 +66,16 @@ def execute_managed_ne_commands(
validate_ne_exec_command(c)
creds, device = resolve_cli_target(db, managed_ne_id=mid or None, ume_ne_id=uid or None)
skip = cli_creds_skip_reason(creds, interactive=False)
if skip:
return {
"ok": False,
"device": device,
"commands": cmds,
"read_timeout_sec": _normalize_read_timeout(read_timeout_sec),
"error": skip,
"detail": skip,
}
read_timeout = _normalize_read_timeout(read_timeout_sec)
try:

3
netx_api/port_traffic_devices.py
View file

@ -9,6 +9,7 @@ from uuid import uuid4
from fastapi import HTTPException
from sqlalchemy.orm import Session
from .cli_creds import require_cli_creds_ready
from .cli_resolve import resolve_cli_target
from .config import settings
from .models import (
@ -470,6 +471,8 @@ def discover_ports(db: Session, body: DiscoverPortsRequest) -> DiscoverPortsResp
except Exception as exc:
raise HTTPException(status_code=400, detail=f"resolve_failed: {exc}") from exc
require_cli_creds_ready(creds, interactive=False)
vendor = str(device.get("vendor") or creds.get("vendor") or "")
device_type = str(device.get("device_type") or creds.get("device_type") or "")
ne_name = str(device.get("name") or creds.get("host") or "")

7
netx_api/port_traffic_runner.py
View file

@ -10,6 +10,7 @@ from uuid import uuid4
from fastapi import HTTPException
from .cli_creds import cli_creds_skip_reason
from .cli_resolve import resolve_cli_target
from .cli_timeout import run_cli_with_timeout
from .config import settings
@ -228,6 +229,12 @@ def _sample_targets_shared_session(device_id: str, target_ids: list[str]) -> tup
_set_target_error(tid, msg)
return len(target_ids), msg
skip = cli_creds_skip_reason(creds, interactive=False)
if skip:
for tid in target_ids:
_set_target_error(tid, skip)
return len(target_ids), skip
vendor = str(info.get("vendor") or vendor_hint or "")
device_type = str(info.get("device_type") or "")
cmds = commands_for_vendor(vendor, device_type)

24
netx_api/topology_discover_scan.py
View file

@ -8,6 +8,8 @@ from sqlalchemy.orm import Session
from .db import SessionLocal
from .models import ManagedNE, TopoFabricNode, UmeInventoryNE
from .cli_creds import cli_creds_skip_reason
from .cli_resolve import resolve_cli_target
from .ne_exec import execute_managed_ne_commands
from .topology_common import (
_DISCOVER_DEADLOCK_RETRIES,
@ -96,6 +98,22 @@ def _discover_one_target(
exec_kwargs["ume_ne_id"] = target["ume_ne_id"]
else:
exec_kwargs["ne_id"] = target["ne_id"]
try:
creds, _device = resolve_cli_target(
db,
managed_ne_id=exec_kwargs.get("ne_id"),
ume_ne_id=exec_kwargs.get("ume_ne_id"),
)
except HTTPException as exc:
return {
**base,
"ok": False,
"command": cmd,
"error": str(exc.detail or "resolve_failed")[:500],
}
skip = cli_creds_skip_reason(creds, interactive=False)
if skip:
return {**base, "ok": False, "command": cmd, "error": skip}
try:
from .cli_budget import acquire_cli_slot
@ -104,18 +122,20 @@ def _discover_one_target(
return {**base, "ok": False, "command": cmd, "error": "cli_budget_unavailable"}
exec_out = execute_managed_ne_commands(db, [cmd], **exec_kwargs)
except HTTPException as exc:
detail = str(exc.detail or "exec_failed")[:500]
return {
**base,
"ok": False,
"command": cmd,
"error": str(exc.detail or "exec_failed")[:500],
"error": detail,
}
if not exec_out.get("ok"):
err = str(exec_out.get("error") or exec_out.get("detail") or "exec_failed")[:500]
return {
**base,
"ok": False,
"command": cmd,
"error": str(exec_out.get("detail") or exec_out.get("error") or "exec_failed")[:500],
"error": err,
}
raw = str(exec_out.get("output") or "")

30
netx_api/webcrt_session_registry.py
View file

@ -205,31 +205,13 @@ def wait_session_ready(session_id: str, *, timeout: float = 120.0) -> WebcrtSess
raise HTTPException(status_code=504, detail="connect_timeout")
from .cli_creds import cli_creds_ready as _cli_creds_ready
def _webcrt_creds_ready(creds: dict[str, Any]) -> bool:
"""True when WebCRT can open a session with the resolved credentials.
Bastion-managed hops store the target password on the bastion side, so an empty
NE password is valid (same as connectivity test). Direct / manual / Linux hops
still require a target password for SSH.
Telnet (no hop) allows empty username/password so the user can authenticate
interactively in the terminal (SecureCRT-style).
"""
hop_enabled = bool(creds.get("hop_enabled"))
hop_vendor = str(creds.get("hop_vendor") or "").strip().lower()
auth_mode = str(creds.get("hop_target_auth_mode") or "bastion_managed").strip().lower()
protocol = str(creds.get("protocol") or "ssh").strip().lower()
if hop_enabled and hop_vendor == "bastion" and auth_mode == "bastion_managed":
return bool(
str(creds.get("hop_host") or "").strip()
and str(creds.get("hop_username") or "").strip()
and str(creds.get("hop_password") or "")
)
if protocol == "telnet" and not hop_enabled:
return True
if not str(creds.get("username") or "").strip():
return False
return bool(str(creds.get("password") or ""))
"""True when WebCRT can open a session with the resolved credentials."""
ready, _ = _cli_creds_ready(creds, interactive=True)
return ready
def _finish_connect(