(fn)
| 54 | |
| 55 | @debug_decorator |
| 56 | def policy_check(fn): |
| 57 | @wraps(fn) |
| 58 | def wrapper(*args, **kwargs): |
| 59 | # Skip policy check for GET requests entirely |
| 60 | if request.method == 'GET': |
| 61 | return fn(*args, **kwargs) |
| 62 | |
| 63 | request_data = request.get_json(silent=True) |
| 64 | if not request_data: |
| 65 | return fn(*args, **kwargs) |
| 66 | |
| 67 | api_key = request.headers.get('api-key') |
| 68 | policy = ConfigReader.read_config('command_list', api_key) |
| 69 | command_content = request_data.get("command") |
| 70 | |
| 71 | if command_content is None: |
| 72 | return { |
| 73 | 'status': 'error', |
| 74 | 'error': 'Missing required field "command"' |
| 75 | }, 400 |
| 76 | |
| 77 | if not isinstance(command_content, str): |
| 78 | return { |
| 79 | 'status': 'error', |
| 80 | 'error': 'Command must be a string' |
| 81 | }, 400 |
| 82 | |
| 83 | if len(command_content) > 4096: |
| 84 | return { |
| 85 | 'status': 'error', |
| 86 | 'error': 'Command length exceeded' |
| 87 | }, 400 |
| 88 | command = command_content.split(" ") |
| 89 | if not policy or not policy.strip(): |
| 90 | return { |
| 91 | 'status': 'error', |
| 92 | 'error': 'Not permitted to perform this function' |
| 93 | }, 403 |
| 94 | allowed_commands = split_to_list(policy, ',') |
| 95 | |
| 96 | logger.debug(f"Allowed Commands : {allowed_commands}") |
| 97 | logger.debug(f"Command : {command[0]}") |
| 98 | |
| 99 | if not any(command[0] == cmd.strip() for cmd in allowed_commands): |
| 100 | return { |
| 101 | 'status': 'error', |
| 102 | 'error': 'Not permitted to perform this function' |
| 103 | }, 403 |
| 104 | |
| 105 | # Validate append-notes command |
| 106 | append_error = Verifycommand.validate_append_command(command) |
| 107 | if append_error: |
| 108 | logger.debug(f"Command validation failed: {command[0]} - {append_error}") |
| 109 | return { |
| 110 | 'status': 'error', |
| 111 | 'error': append_error |
| 112 | }, 400 |
| 113 |
no outgoing calls