From 07a0a3472b6011792cc97011f2ae709a22fe5437 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Thu, 3 Sep 2026 12:26:39 -0500
Subject: [PATCH] =?UTF-8?q?fix(cmdb):=20GLPI=20import=20fixes=20=E2=80=94?=
 =?UTF-8?q?=20input=20wrapper=20+=20Read-Only=20agent=20profile=20[#705]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Import executed live: 87 CIs seeded, scoped cmdb user (Read-Only)
verified read-ok / write-denied. Fixes: POST body needs {input:[...]}
(ERROR_BAD_ARRAY on bare array), profile swapped Technician ->
Read-Only per least-priv ruling, shape-tolerant user-exists check.

Detail: https://projects.knownelement.com/issues/705
---
 cmdb/seed/to-glpi.sh | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/cmdb/seed/to-glpi.sh b/cmdb/seed/to-glpi.sh
index e967aa8..e6fd428 100644
--- a/cmdb/seed/to-glpi.sh
+++ b/cmdb/seed/to-glpi.sh
@@ -11,7 +11,7 @@
 #
 # What it does:
 #   1. initSession as the admin user token.
-#   2. Creates local user 'cmdb' (Technician profile, random password +
+#   2. Creates local user 'cmdb' (Read-Only profile, random password +
 #      random api_token) — the scoped agent identity per Charles's ruling.
 #      Writes ~/.creds/glpi-agent.env (0600). Skipped if the user exists.
 #   3. Imports systems.csv rows as GLPI Computers (batch; skips names that
@@ -35,12 +35,12 @@ hdr() { printf 'Content-Type: application/json\nApp-Token: %s\nSession-Token: %s
 echo "— initSession"
 SESSION=$(curl -sS --max-time 20 -H "Content-Type: application/json" \
   -H "App-Token: $GLPI_APP_TOKEN" \
-  -H "Authorization: user_token $(printf %s "$GLPI_USER_TOKEN" | base64 -w0)" \
+  -H "Authorization: user_token $GLPI_USER_TOKEN" \
   "$API/initSession" | jq -re '.session_token')
 echo "  session ok (${#SESSION} chars)"
 
 # --- 2. scoped agent user -------------------------------------------------
-if curl -sS -H "$(hdr)" "$API/User?searchText%5Bname%5D=cmdb" | jq -e '.totalcount > 0' >/dev/null; then
+if curl -sS -H "$(hdr)" "$API/User?searchText%5Bname%5D=cmdb" | jq -e 'if type=="object" then (.totalcount > 0) else (length > 0) end' >/dev/null; then
   echo "— user 'cmdb' already exists (skipping create)"
 else
   AGENT_PASS=$(head -c 24 /dev/urandom | base64 | tr -d '/+=')
@@ -51,10 +51,10 @@ else
     UID_JSON=$(curl -sS -X POST -H "$(hdr)" -d '{"input":{"name":"cmdb","realname":"CMDB agent (core-IT)","password":"'"$AGENT_PASS"'","api_token":"'"$AGENT_TOKEN"'"}}' "$API/User")
     NEWUID=$(echo "$UID_JSON" | jq -r '.id // .users_id // empty')
     echo "  created users_id=$NEWUID"
-    PROF_ID=$(curl -sS -H "$(hdr)" "$API/Profile?range=0-50" | jq -r '.[] | select(.name=="Technician") | .id' | head -1)
+    PROF_ID=$(curl -sS -H "$(hdr)" "$API/Profile?range=0-50" | jq -r '.[] | select(.name=="Read-Only") | .id' | head -1)
     [ -n "$PROF_ID" ] && curl -sS -X POST -H "$(hdr)" \
       -d '{"input":{"users_id":"'"$NEWUID"'","profiles_id":"'"$PROF_ID"'","entities_id":0,"is_recursive":1}}' \
-      "$API/Profile_User" > /dev/null && echo "  profile Technician ($PROF_ID) @ root entity"
+      "$API/Profile_User" > /dev/null && echo "  profile Read-Only ($PROF_ID) @ root entity"
     umask 077
     printf 'GLPI_URL=%s\nGLPI_APP_TOKEN=%s\nGLPI_USER_TOKEN=%s\n' \
       "$GLPI_URL" "$GLPI_APP_TOKEN" "$AGENT_TOKEN" > "${HOME}/.creds/glpi-agent.env"
@@ -96,8 +96,9 @@ if [ "$DRY" = "1" ]; then echo "— DRY: no changes made"; exit 0; fi
 SPLIT=25; i=0
 while [ "$i" -lt "$TOTAL" ]; do
   jq ".[$i:$((i+SPLIT))]" /tmp/glpi-batch.json > /tmp/glpi-chunk.json
-  curl -sS -X POST -H "$(hdr)" -d @/tmp/glpi-chunk.json "$API/Computer" \
-    | jq -r 'if type=="array" then "  +\(.length) created" else "  ERR: \(.)" end'
+  curl -sS -X POST -H "$(hdr)" \
+    -d "$(jq -c '{input: .}' /tmp/glpi-chunk.json)" "$API/Computer" \
+    | jq -r 'if type=="array" then "  +\(length) created" else "  ERR: \(tostring)" end'
   i=$((i+SPLIT))
 done
 echo "done — verify count via GET /Computer?range=0-200"