Establish attended telemetry Grafana custody and record private activation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

scripts/telemetry_grafana_access.py

@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Silent attended Grafana API probe through a fixed localhost tunnel."""
+import argparse
+import base64
+import json
+import os
+import urllib.error
+import urllib.request
+
+from state_hub_preflight_lane import LaneError, bao, data
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--receipt', required=True)
+    args = parser.parse_args()
+    fd = os.open(args.receipt, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+    receipt = {'schema': 'rapp-telemetry.access.v1', 'status': 'failed'}
+    try:
+        policies = data(bao(['token', 'lookup', '-format=json']))['data']['policies']
+        if 'platform-admin' not in policies or 'root' in policies:
+            raise LaneError('attended_platform_admin_required')
+        opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
+        def request(path, headers=None):
+            req = urllib.request.Request('http://127.0.0.1:13001' + path, headers=headers or {})
+            try:
+                with opener.open(req, timeout=10) as response:
+                    return response.status, json.load(response)
+            except urllib.error.HTTPError as error:
+                return error.code, None
+        for label, headers in [('anonymous_denied', {}), ('forged_proxy_denied', {
+                'X-WEBAUTH-USER': 'admin', 'Remote-User': 'admin', 'Remote-Groups': 'admins'})]:
+            if request('/api/user', headers)[0] != 401:
+                raise LaneError('negative_access_failed')
+            receipt[label] = True
+        native = data(bao(['read', '-format=json', 'platform/data/workloads/telemetry/grafana-admin']))['data']['data']
+        credential = base64.b64encode((native['ADMIN_USERNAME'] + ':' + native['ADMIN_PASSWORD']).encode()).decode()
+        headers = {'Authorization': 'Basic ' + credential}
+        status, user = request('/api/user', headers)
+        if status != 200 or user.get('login') != 'admin' or not user.get('isGrafanaAdmin'):
+            raise LaneError('positive_access_failed')
+        receipt['native_admin_authenticated'] = True
+        status, sources = request('/api/datasources', headers)
+        if status != 200 or not any(s['type'] == 'prometheus' for s in sources):
+            raise LaneError('datasource_missing')
+        receipt['prometheus_datasource_present'] = True
+        status, dashboards = request('/api/search?type=dash-db', headers)
+        if status != 200 or not dashboards:
+            raise LaneError('dashboards_missing')
+        receipt.update(status='verified', dashboard_count=len(dashboards))
+    except Exception:
+        receipt['error'] = 'access_verification_failed'
+    finally:
+        with os.fdopen(fd, 'w') as output:
+            json.dump(receipt, output, indent=2)
+    return 0 if receipt['status'] == 'verified' else 1
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())