hansjone/netx
1
0
Fork 0
mirror of https://github.com/hansjone/netx.git synced 2026-10-09 02:00:46 +08:00
Code Issues Projects Releases 1 Packages Wiki Activity Actions 2

Persist cutover evidence cards with device-raw A/B keys for board and AI.

Browse source 
Evaluate keeps match keys for normalize/map pairing while diffs, reds, and the board show collected ports plus show-command provenance; add monitor-context and command-raw read APIs with biz-monitor:read scope.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-09-19 22:48:37 +08:00
parent 285c19e5a3
commit c1b1c0f75d
17 changed files with 1141 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

14
netx_api/auth_scopes.py
View file

@ -16,6 +16,7 @@ SCOPE_WEBCRT = "webcrt:session"
SCOPE_SQL = "sql:query"
SCOPE_ADMIN_USERS = "admin:users"
SCOPE_OPS_WRITE = "ops:write"
SCOPE_BIZ_MONITOR_READ = "biz-monitor:read"
ALL_SCOPES: frozenset[str] = frozenset(
{
@ -27,20 +28,22 @@ ALL_SCOPES: frozenset[str] = frozenset(
SCOPE_SQL,
SCOPE_ADMIN_USERS,
SCOPE_OPS_WRITE,
SCOPE_BIZ_MONITOR_READ,
}
)
ROLE_DEFAULT_SCOPES: dict[str, frozenset[str]] = {
"admin": ALL_SCOPES,
# Read-only operator by default (alarms + inventory).
"user": frozenset({SCOPE_ALARMS_READ, SCOPE_NE_READ}),
# Read-only operator by default (alarms + inventory + biz monitor read).
"user": frozenset({SCOPE_ALARMS_READ, SCOPE_NE_READ, SCOPE_BIZ_MONITOR_READ}),
}
# Default MCP bootstrap token: diagnostics CLI allowed; no interactive shell / SQL / writes.
# Default MCP bootstrap token: diagnostics CLI + biz monitor read; no SQL / writes.
MCP_DEFAULT_SCOPES: tuple[str, ...] = (
SCOPE_ALARMS_READ,
SCOPE_NE_READ,
SCOPE_NE_EXEC,
SCOPE_BIZ_MONITOR_READ,
)
@ -178,5 +181,10 @@ def required_scope_for_request(method: str, path: str) -> str | None:
if p.startswith("/v1/integrations"):
return SCOPE_ALARMS_READ
if p.startswith("/v1/biz-migration") or p.startswith("/v1/biz-state"):
if m in ("POST", "PUT", "PATCH", "DELETE"):
return SCOPE_OPS_WRITE
return SCOPE_BIZ_MONITOR_READ
# Auth self-service, api-tokens, audit: any authenticated user
return None