#1188 Per-tag and per-node Santa client mode override Pull request opened by javuto Per-tag and per-node Santa client mode override Closes #1162 Problem The Santa client mode (MONITOR or LOCKDOWN) is set per environment. Piloting LOCKDOWN on a few Macs means moving them to a separate environment, with its own enrollment, token and rules. Change A tag or a single node can now be given a different client mode than its environment. • Precedence: a node override wins over a tag override, which wins over the environment mode. If a node has several tags with different modes, LOCKDOWN wins, so the result does not depend on tag order. • Sync: preflight sends the effective mode instead of the environment mode. A change, or the removal of an override, takes effect on the client's next sync. It does not force a clean rule sync, because the mode is not part of the rule digest. • API (environment admin, audited): •

GET /api/v1/santa/{env}/modes

lists the overrides. •

PUT /api/v1/santa/{env}/modes

with

scope

(

tag

or

node

),

scope_value

and

client_mode

. Setting the same tag or node again replaces its mode. •

DELETE /api/v1/santa/{env}/modes/{id}

removes one. An override in another environment returns

404

. • UI: • Settings tab: a new Mode overrides card lists the overrides, with an inline form to add one and a confirmation on delete. • Machines tab: the Mode column shows the mode osctrl last sent, with "Tag override" or "Node override" underneath when it did not come from the environment. • Docs:

pkg/santa/README.md

documents the overrides, and the rollout steps now pilot LOCKDOWN through a tag or node override.

osctrl-api.yaml

is regenerated. Schema Applied by

AutoMigrate

at startup, only when Santa is enabled: • New table

santa_mode_overrides

, unique on (

environment_id

,

scope

,

scope_value

). • Two new columns on `santa_machines`:

assigned_mode

and

mode_source

(

env

,

tag

or

node

). They stay empty for a machine until its next sync; the Machines tab shows the client-reported mode until then. Security and operational impact • All three routes go through

santaEnvironment

, so they require environment admin, and each set and delete writes an audit line. •

environment_id

and

created_by

come from the URL and the session; values in the request body are ignored. • The mode must be MONITOR or LOCKDOWN. A node scope value must be a UUID and is stored uppercase. A tag scope value must be non-empty and at most 255 characters. • An override can move a node out of LOCKDOWN as well as into it. That takes the same permission as changing the environment mode. • The tag name or node UUID is not checked against existing tags or enrolled nodes, the same as rule scopes. An override for an unknown node has no effect, because it only applies when that node syncs in that environment. • No change to the sync authentication model or to

osctrl-tls

routes. Not included • No override control on the node page; overrides are managed from the Santa page only. Validation •

go test ./pkg/santa/... ./cmd/api/... ./cmd/tls/...

•

go vet

,

gofmt -l

,

golangci-lint run ./pkg/santa/... ./cmd/api/...

(0 issues) •

make openapi-check

•

npm --prefix frontend run check

and

npm --prefix frontend test

(789 tests) New tests cover precedence (environment default, tag, node over tag, conflicting tags, other environment ignored), the preflight round trip including removal, request validation, replacing an existing override, cross-environment delete, audit lines, and the env-admin requirement on the three routes. Frontend tests cover adding and removing an override and the Machines column. Not verified: the UI in a browser, a real Santa client, and the migration on PostgreSQL or MySQL (tests run on SQLite). The new strings in the 19 non-English locales are machine-written and not reviewed by native speakers. jmpsec/osctrl