mrcharles
634a8c665e
ci / audit (push) Successful in 48s
Debian shellcheck (CI job container) vs koalaman:stable skew resolved by fixing real findings + exempting ported legacy suites and non-shell agent scripts, mirroring the archive/ treatment. https://projects.knownelement.com/issues/784
177 lines
6.9 KiB
Bash
Executable File
177 lines
6.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# glpi-change.sh — DEPRECATED shim: superseded by mglpi (KNEL connector
|
|
# mopac-glpi-go — Go CLI + MCP, git.knownelement.com/UKRRS/mopac-glpi-go).
|
|
# Charles ruling 2026-09-04: all custom tooling lives in ukrrs/connectors,
|
|
# written in Go, MCP/CLI dual-surface. This bash script still WORKS (kept
|
|
# until callers migrate) — new code must use mglpi:
|
|
# echo "body" | mglpi --config ~/.creds/mglpi-agent.env change create \
|
|
# --title "[#NNN] summary" --content -
|
|
# Exec-host: container mopac-cli-mglpi; shim: ~/.local/bin/mglpi.
|
|
#
|
|
# glpi-change.sh — create GLPI Change entries from the CLI [#769][#767]
|
|
#
|
|
# Charles rulings: questions-v10 OQ7 (2026-09-03) — GLPI Changes are logged
|
|
# from NOW ON for converge/infra work, no Redmine-only exception path.
|
|
# questions-09022206 Q1/Q2/Q3 (2026-09-04) — CRs live in GLPI as Changes;
|
|
# the cmdb agent files CRs itself (least-privilege identity); prod (Tier 2)
|
|
# agent ops carry .crush/active-cr with the Change id (t/325 §5 ladder).
|
|
#
|
|
# Two identities:
|
|
# default ~/.creds/glpi.env — admin session (bootstrap, break-glass)
|
|
# --agent ~/.creds/glpi-agent.env — the cmdb agent (user 7). GLPI's REST
|
|
# API cannot write profile rights, and Self-Service cannot
|
|
# create Changes, so the agent session switches to the built-in
|
|
# Hotliner profile (verified: create+followup+transition OK,
|
|
# CI writes still DENIED). Approved via Q2 ruling 2026-09-04.
|
|
#
|
|
# Ladder status mapping (GLPI Change statuses; ints per GLPI Change::getAllStatusArray):
|
|
# 1 New (draft/filed) 2 Evaluation (review) 3 Approval 4 Acceptance
|
|
# 5 Pending 6 Test 7 Qualification 8 closed 9 solved (verify label in UI
|
|
# on first use — the REST API exposes ints only).
|
|
#
|
|
# Env: GLPI_URL, GLPI_USER_TOKEN, GLPI_APP_TOKEN in the chosen .env
|
|
#
|
|
# Usage:
|
|
# echo "what changed, why, where" | \
|
|
# glpi-change.sh create --title "[#NNN] <change summary>" [--urgency 2] [--impact 2] [--agent]
|
|
# glpi-change.sh transition <change-id> <status-int> [--agent]
|
|
# echo "note text" | glpi-change.sh followup <change-id> [--agent]
|
|
# glpi-change.sh show <change-id> [--agent]
|
|
# glpi-change.sh list [--status N] [--agent]
|
|
set -euo pipefail
|
|
|
|
die() { printf 'FAIL: %s\n' "$*" >&2; exit 1; }
|
|
|
|
ENV_FILE="$HOME/.creds/glpi.env"
|
|
IS_AGENT=0
|
|
|
|
# Pre-scan for --agent / --env before subcommand dispatch so both env files
|
|
# must exist only when actually referenced.
|
|
pre=("$@")
|
|
for a in ${pre[@]+"${pre[@]}"}; do
|
|
case "$a" in
|
|
--agent) IS_AGENT=1 ;;
|
|
esac
|
|
done
|
|
[ "$IS_AGENT" -eq 1 ] && ENV_FILE="$HOME/.creds/glpi-agent.env"
|
|
[ -f "$ENV_FILE" ] || die "'$ENV_FILE' missing"
|
|
|
|
set -a; . "$ENV_FILE"; set +a
|
|
BASE="${GLPI_URL%/}"
|
|
if [ -z "${GLPI_USER_TOKEN:-}" ] || [ -z "${GLPI_APP_TOKEN:-}" ]; then die "tokens missing in $ENV_FILE"; fi
|
|
|
|
sess_request() {
|
|
curl -s -m 30 -H "Content-Type: application/json" \
|
|
-H "App-Token: $GLPI_APP_TOKEN" \
|
|
-H "Authorization: user_token $GLPI_USER_TOKEN" \
|
|
"$BASE/apirest.php/initSession"
|
|
}
|
|
|
|
session="$(sess_request)"
|
|
S_TOKEN="$(printf '%s' "$session" | jq -r '.session_token // empty')"
|
|
[ -n "$S_TOKEN" ] || die "initSession failed: $session"
|
|
cleanup() { curl -s -m 15 -o /dev/null -H "Session-Token: $S_TOKEN" \
|
|
-H "App-Token: $GLPI_APP_TOKEN" "$BASE/apirest.php/killSession" || true; }
|
|
trap cleanup EXIT
|
|
|
|
auth=(-H "Session-Token: $S_TOKEN" -H "App-Token: $GLPI_APP_TOKEN" -H "Content-Type: application/json")
|
|
|
|
# api <method> <path> [body-file]
|
|
api() {
|
|
local method="$1" path="$2" body="${3:-}"
|
|
if [ -n "$body" ]; then
|
|
curl -s -m 30 -X "$method" "${auth[@]}" -d "@$body" "$BASE/apirest.php/$path"
|
|
else
|
|
curl -s -m 30 -X "$method" "${auth[@]}" "$BASE/apirest.php/$path"
|
|
fi
|
|
}
|
|
|
|
# Activate the Hotliner profile for the agent identity (no-op cost for admin).
|
|
if [ "$IS_AGENT" -eq 1 ]; then
|
|
echo '{"profiles_id":5}' > "/tmp/glpi-change-cap.$$"
|
|
api POST changeActiveProfile "/tmp/glpi-change-cap.$$" >/dev/null
|
|
rm -f "/tmp/glpi-change-cap.$$"
|
|
fi
|
|
|
|
cmd="${1:-create}"; shift || true
|
|
|
|
# Strip the shared flags from remaining args.
|
|
args=()
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
--agent) shift ;;
|
|
*) args+=("$1"); shift ;;
|
|
esac
|
|
done
|
|
|
|
case "$cmd" in
|
|
create)
|
|
title=""; urgency=3; impact=3; content=""
|
|
while [ ${#args[@]} -gt 0 ]; do
|
|
case "${args[0]}" in
|
|
--title) title="${args[1]}"; args=("${args[@]:2}") ;;
|
|
--urgency) urgency="${args[1]}"; args=("${args[@]:2}") ;;
|
|
--impact) impact="${args[1]}"; args=("${args[@]:2}") ;;
|
|
*) die "unknown option ${args[0]}" ;;
|
|
esac
|
|
done
|
|
[ -n "$title" ] || die "--title required"
|
|
content="$(cat)"
|
|
[ -n "$content" ] || die "change body required on stdin"
|
|
body="$(mktemp)"
|
|
jq -n --arg t "$title" --arg c "$content" \
|
|
--argjson u "$urgency" --argjson i "$impact" \
|
|
'{input: {name: $t, content: $c, urgency: $u, impact: $i}}' > "$body"
|
|
# GLPI returns an ARRAY on create: [{"id":N,"message":...}] — handle both shapes.
|
|
resp="$(api POST Change "$body")"
|
|
rm -f "$body"
|
|
cid="$(printf '%s' "$resp" | jq -r '.id // .[0].id // empty')"
|
|
[ -n "$cid" ] || die "create failed: $resp"
|
|
echo "created Change id=$cid — $BASE/front/change.form.php?id=$cid"
|
|
;;
|
|
transition)
|
|
cid="${args[0]:-}"; status="${args[1]:-}"
|
|
if [ -z "" ] || [ -z "" ]; then die "usage: transition <change-id> <status-int>"; fi
|
|
body="$(mktemp)"
|
|
jq -n --argjson s "$status" '{input: {status: $s}}' > "$body"
|
|
resp="$(api PUT "Change/$cid" "$body")"
|
|
rm -f "$body"
|
|
printf '%s' "$resp" | jq -e --arg id "$cid" '.[0][$id] == true' >/dev/null \
|
|
|| die "transition failed: $resp"
|
|
echo "Change $cid -> status $status"
|
|
;;
|
|
followup)
|
|
cid="${args[0]:-}"
|
|
[ -n "$cid" ] || die "usage: followup <change-id> (body on stdin)"
|
|
content="$(cat)"
|
|
[ -n "$content" ] || die "followup body required on stdin"
|
|
body="$(mktemp)"
|
|
jq -n --argjson c "$cid" --arg t "$content" \
|
|
'{input: [{itemtype: "Change", items_id: $c, content: $t}]}' > "$body"
|
|
resp="$(api POST ITILFollowup "$body")"
|
|
rm -f "$body"
|
|
printf '%s' "$resp" | jq -e '.[0].id' >/dev/null || die "followup failed: $resp"
|
|
echo "followup added to Change $cid"
|
|
;;
|
|
show)
|
|
cid="${args[0]:?change-id}"
|
|
api GET "Change/$cid" | jq .
|
|
;;
|
|
list)
|
|
status=""
|
|
while [ ${#args[@]} -gt 0 ]; do
|
|
case "${args[0]}" in
|
|
--status) status="${args[1]}"; args=("${args[@]:2}") ;;
|
|
*) die "unknown option ${args[0]}" ;;
|
|
esac
|
|
done
|
|
url="search/Change/?forcedisplay%5B0%5D=1&forcedisplay%5B1%5D=2&forcedisplay%5B2%5D=12&range=0-999"
|
|
[ -n "$status" ] && url="$url&criteria%5B0%5D%5Bfield%5D=12&criteria%5B0%5D%5Bsearchtype%5D=equals&criteria%5B0%5D%5Bvalue%5D=$status"
|
|
# Rows come back as objects keyed by field id: 1=name, 2=id, 12=status.
|
|
api GET "$url" | jq -r '.data[]? | [."2", ."12", ."1"] | @tsv'
|
|
;;
|
|
*)
|
|
die "unknown command $cmd"
|
|
;;
|
|
esac
|