elasticctl 0.6.0

Operate Elastic Security as code with a safety-first CLI for security engineers.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120

//! CLI adapters for Fleet policy administration. API orchestration stays in
//! `elasticctl_api::fleet`; this module only supplies context, the mutation
//! guard, artifact delivery, and renderer values.

use crate::context::Context;
use crate::guard::{self, Preview};
use elasticctl_api::content_codec::ContentFormat;
use elasticctl_api::fleet::agent_policy_ops::{self, AgentPolicyFilter};
use elasticctl_core::{Error, ErrorKind, Result};
use serde_json::{Value, json};
use std::path::Path;

fn to_value<T: serde::Serialize>(value: &T) -> Result<Value> {
    serde_json::to_value(value)
        .map_err(|error| Error::new(ErrorKind::Error, format!("encoding report: {error}")))
}

pub async fn list(ctx: &Context, filter: &AgentPolicyFilter) -> Result<Value> {
    ctx.require_credential()?;
    let transport = ctx.transport().await?;
    let report = agent_policy_ops::list_op(transport, filter).await?;
    if report.truncated {
        eprintln!(
            "capped at {} rows",
            filter.limit.expect("truncated lists have a limit")
        );
    }
    to_value(&report.agent_policies)
}

pub async fn get(ctx: &Context, selector: &str) -> Result<Value> {
    ctx.require_credential()?;
    let transport = ctx.transport().await?;
    to_value(&agent_policy_ops::get_op(transport, selector).await?)
}

/// Check a portable file without building a context or transport.
pub fn validate(path: &Path) -> Result<Value> {
    let specs = agent_policy_ops::validate(path)?;
    Ok(json!({"valid": true, "total": specs.len()}))
}

/// Validate the entire import artifact before configuration is consulted.
pub fn validate_import_artifact(path: &Path) -> Result<()> {
    if agent_policy_ops::validate(path)?.is_empty() {
        return Err(Error::new(
            ErrorKind::Error,
            "agent-policy import needs at least one agent policy",
        ));
    }
    Ok(())
}

pub async fn export(
    ctx: &Context,
    selectors: &[String],
    all_custom: bool,
    out: Option<&Path>,
    format: ContentFormat,
) -> Result<Value> {
    ctx.require_credential()?;
    let transport = ctx.transport().await?;
    let outcome = agent_policy_ops::export(transport, selectors, all_custom, format).await?;
    match out {
        Some(path) => {
            std::fs::write(path, &outcome.body).map_err(|error| {
                Error::new(
                    ErrorKind::Error,
                    format!("writing {}: {error}", path.display()),
                )
            })?;
            Ok(json!({
                "exported": outcome.exported,
                "path": path.display().to_string(),
                "failed": outcome.missing,
            }))
        }
        None => Ok(json!({"text": outcome.body, "failed": outcome.missing})),
    }
}

pub async fn import(
    ctx: &Context,
    path: &Path,
    overwrite: bool,
    skip_existing: bool,
) -> Result<Value> {
    ctx.require_credential()?;
    let transport = ctx.transport().await?;
    let plan = agent_policy_ops::plan_import(transport, path, overwrite, skip_existing).await?;
    let preview = Preview {
        action: plan.preview.preview_action.clone(),
        details: plan.preview.preview_details.clone(),
    };
    if !guard::check(ctx, "fleet agent-policies import", &preview) {
        return Ok(json!({
            "applied": false,
            "total": plan.total,
            "skipped": plan.skipped,
            "pending": plan.preview.targets.len(),
            "package_installs": plan.package_installs,
        }));
    }
    to_value(&agent_policy_ops::apply_import(transport, &plan).await?)
}

pub async fn delete(ctx: &Context, selectors: &[String]) -> Result<Value> {
    ctx.require_credential()?;
    let transport = ctx.transport().await?;
    let plan = agent_policy_ops::plan_delete(transport, selectors).await?;
    let preview = Preview {
        action: plan.preview.preview_action.clone(),
        details: plan.preview.preview_details.clone(),
    };
    if guard::check(ctx, "fleet agent-policies delete", &preview) {
        to_value(&agent_policy_ops::apply_delete(transport, &plan).await?)
    } else {
        Ok(json!({"applied": false, "total": plan.targets.len()}))
    }
}