#1189 Bulk import and export of Santa rules Pull request opened by javuto Bulk import and export of Santa rules Closes #1164 Problem Santa rules can only be entered one at a time. Large rule sets, such as vendor allowlists or a migration from another sync server, are impractical to load, and there is no way to keep a rule set in git. Change Rules can be exported as JSON and imported in bulk from the API, the CLI and the Rules tab. • Import classification: each rule is validated and normalized like a single create, then classified: • new: no rule with the same type, identifier and scope exists. • duplicate: an identical rule exists, or appears earlier in the file. Skipped. • conflict: a rule with the same type, identifier and scope exists with a different policy, message, URL or CEL expression. • invalid: the rule fails validation. • Apply: new rules are stored in one transaction, and only when no rule is conflicting or invalid. One bad rule blocks the whole import, and existing rules are never changed. Re-importing an export is a no-op. • API:

POST /api/v1/santa/{env}/rules/import

takes a JSON list of rules and returns the report (

new

,

duplicate

,

conflicts

,

invalid

,

applied

). With

?dry_run=true

nothing is stored. A blocked import returns

200

with

applied: false

. • Export format: the eight portable rule fields, sorted by type, identifier and scope so the file diffs cleanly. The import ignores extra fields, so the output of

GET /api/v1/santa/{env}/rules

can be imported as is. • UI: the Rules tab gets Export (downloads

santa-rules-<env>.json

) and Import. Import runs the dry run first and shows the report; the confirm button is disabled when a rule is conflicting or invalid. • CLI:

osctrl-cli santa rules-export -e ENV [-f FILE]

and

osctrl-cli santa rules-import -e ENV -f FILE [--dry-run]

, in API and DB mode.

rules-import

exits non-zero when the import is blocked, dry run included, so it can gate a review pipeline. • Docs:

pkg/santa/README.md

has a new "Bulk import and export" section, and

osctrl-api.yaml

is regenerated. Security and operational impact • The import route goes through

santaEnvironment

, so it requires environment admin. •

environment_id

and

created_by

come from the URL and the session;

id

,

environment_id

and

created_by

in the body are ignored. • The request body is limited to 4 MiB. The CLI applies the same limit to the file in both modes. • An applied import writes one audit line with the counts (

santa: import rules new=N duplicate=N

). A dry run and a blocked import write none. • In DB mode the first

santa

CLI command creates the Santa tables if they do not exist, even when Santa is disabled on the services. The

alert

commands already do the same for their tables. •

cmd/api/main.go

gains an

apiSantaPath

constant and the Santa routes use it. Paths are unchanged; the CLI route guard test only recognises named path constants. • No schema change, and no change to the sync protocol or

osctrl-tls

. Imported rules change the rule digest, so clients get a clean sync on their next sync, as with any rule change. Not included • CSV export. The issue listed it as "if cheap", and JSON covers the round trip. • An option to import the clean rules and skip the conflicting ones. Validation •

go test ./pkg/santa/... ./pkg/apiclient/... ./cmd/api/... ./cmd/tls/... ./cmd/cli/...

•

go vet

,

gofmt -l

,

golangci-lint run ./pkg/santa/... ./pkg/apiclient/... ./cmd/api/... ./cmd/cli/...

(0 issues) •

make openapi-check

•

npm --prefix frontend run check

and

npm --prefix frontend test

(792 tests) New tests cover: • Manager: classification of every case, blocking on conflicts and invalid rules, dry run storing nothing, other environments left untouched, and the export and re-import no-op. • Handler: bad and oversized bodies, ignored body fields,

dry_run

, a single audit line, and the env-admin requirement. • CLI: the import and export round trip in DB and API mode, the non-zero exit on a conflict, and the audit lines. • Frontend: preview then apply, a blocked import, a file that is not a rule list, and the export contents. Not verified: the UI in a browser, and the import transaction on PostgreSQL or MySQL (tests run on SQLite). The new strings in the 19 non-English locales are machine-written and not reviewed by native speakers. jmpsec/osctrl