#1187 Edit Santa rules in place Pull request opened by javuto Edit Santa rules in place Closes #1163 Problem Santa rules could only be created and deleted. Changing a rule's policy or message meant deleting it and creating it again, which threw away the original

created_by

, and Delete removed a rule with a single click. Change API (

osctrl-api

) • New route

PUT /api/v1/santa/{env}/rules/{id}

, which requires environment admin like the other rule routes. • It checks and normalizes input the same way as create: hashes are lowercased, and team IDs and node UUIDs are uppercased. • Returns

409

if the edit would duplicate another rule (same type, identifier and scope). • Returns

404

for a rule in another environment and

400

for invalid input or a non-numeric id. •

created_by

and

environment_id

in the request body are ignored. The rule keeps its original creator. • The audit log records the rule before and after the edit, for example

santa: update rule 7 TEAMID EQHXZ8M8AV ALLOWLIST scope=env -> TEAMID EQHXZ8M8AV BLOCKLIST scope=env

. • The create and delete audit lines now come from the same helper. Their text is unchanged. •

santa.Manager.UpdateRule

writes the fields as a map, so clearing a field (custom message, CEL expression) is saved too. Sync • An edit changes the checksum of the node's effective rule set, so clients do a clean sync on their next sync and get the change. No change to

osctrl-tls

. UI • Each row in the Rules tab has an Edit button. It opens the existing rule form, filled in with the rule and titled "Edit rule". • Delete now asks for confirmation (

confirm()

, as on the log sinks page) and names the rule's identifier. • Three new strings in all 20 locales. Docs •

pkg/santa/README.md

documents the new route. •

osctrl-api.yaml

has been regenerated. Security / operational impact • No schema change. • The route takes the same environment admin check, request body size limit and audit logging as create and delete. It only loads and updates a rule that matches both the id and the environment, so a rule in another environment cannot be edited through this one. • Known limit: the duplicate check runs before the update. If two admins make the same conflicting edit at the same moment, the unique index still stops the duplicate, but the second request gets a

500

instead of a

409

. Validation • `go test ./pkg/santa/ ./cmd/api/handlers/`: • New

TestUpdateRule

(manager) covers: • normalization • clearing a field •

created_by

kept • the checksum changes • duplicate, wrong environment and invalid input • New

TestSantaUpdateRule

(handler) covers: •

created_by

in the request ignored •

409

,

400

and

404

• a rule in another environment • non-admin

403

• the before/after audit line • The route was added to the test that checks every Santa route requires environment admin. •

go vet

and

golangci-lint

(santa package and API): 0 issues.

gofmt

clean. •

make openapi-check

passes. •

cd frontend && npm test

(787 tests) and

npm run check

pass: • New test: editing a rule calls

PUT

with the right body and does not call create. • The delete test now checks that cancelling the confirmation does not delete. Not verified: • The Edit button and the delete confirmation in a browser. • A real Santa client picking up an edited rule. • The new translations, which have not been reviewed by native speakers. jmpsec/osctrl