From f60f1eaadb096c94fe5f3d05b2d7685cba52b47e Mon Sep 17 00:00:00 2001 From: Friedrich Zahn Date: Wed, 27 May 2026 16:38:24 +0200 Subject: [PATCH 1/2] Align documentation and code for /status endpoint Signed-off-by: Friedrich Zahn --- compliance-monitor/README.md | 18 ++++++------------ compliance-monitor/monitor.py | 1 - 2 files changed, 6 insertions(+), 13 deletions(-) diff --git a/compliance-monitor/README.md b/compliance-monitor/README.md index 3a487ad7b..dcb248fc1 100644 --- a/compliance-monitor/README.md +++ b/compliance-monitor/README.md @@ -183,23 +183,17 @@ The final field is the desired state; the other fields are used to determine the (within one report, version and check uniquely determine a result; the scope is given here as well in case reports at some point contain multiple scopes). -### GET /status/{subject} +### GET /status -Returns the current status of the subject. Use the `Accept` header to select desired content type: - -- `text/html` (default): a snippet of HTML suitable for the end user; -- `image/png`: a PNG image of a badge; -- `application/json`: a short summary in JSON format. +Returns the current status of all subjects in JSON format. +The request needs to be authenticated via basic auth, either with the role `read_any` for all subjects, +or for the requested subject. Query parameters: +- `subject` (optional): restrict subject - `scopeuuid` (optional): restrict scope -- `version` (optional): restrict version -- `privileged_view` (optional `0` or `1`, default `0`): request privileged view (see below) - -If the privileged view is requested, then this request needs to be authenticated (via basic auth), -either for the same subject or for some account with role `read_any`. This view will immediately -show any non-pass result, whereas otherwise, such a result needs to be verified manually. +- `version` (optional): restrict version ([Currently bugged](https://github.com/SovereignCloudStack/standards/issues/1181)) ### GET /metrics/{subject} diff --git a/compliance-monitor/monitor.py b/compliance-monitor/monitor.py index 9d759d2b0..c27cc0839 100755 --- a/compliance-monitor/monitor.py +++ b/compliance-monitor/monitor.py @@ -553,7 +553,6 @@ async def get_status( subject: str = None, scopeuuid: str = None, version: str = None, ): check_role(account, subject, ROLES['read_any']) - # note: text/html will be the default, but let's start with json to get the logic right accept = request.headers['accept'] if 'application/json' not in accept and '*/*' not in accept: # see https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/406 From 4d0b1575a5589744cfbc97e762ab87d29b704e04 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20B=C3=BCchse?= Date: Tue, 2 Jun 2026 17:22:05 +0200 Subject: [PATCH 2/2] Remove authentication from status endpoint; remove defunct version filter MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Matthias Büchse --- compliance-monitor/README.md | 3 --- compliance-monitor/monitor.py | 6 ++---- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/compliance-monitor/README.md b/compliance-monitor/README.md index dcb248fc1..12e5f97db 100644 --- a/compliance-monitor/README.md +++ b/compliance-monitor/README.md @@ -186,14 +186,11 @@ in case reports at some point contain multiple scopes). ### GET /status Returns the current status of all subjects in JSON format. -The request needs to be authenticated via basic auth, either with the role `read_any` for all subjects, -or for the requested subject. Query parameters: - `subject` (optional): restrict subject - `scopeuuid` (optional): restrict scope -- `version` (optional): restrict version ([Currently bugged](https://github.com/SovereignCloudStack/standards/issues/1181)) ### GET /metrics/{subject} diff --git a/compliance-monitor/monitor.py b/compliance-monitor/monitor.py index c27cc0839..dbe26b78d 100755 --- a/compliance-monitor/monitor.py +++ b/compliance-monitor/monitor.py @@ -548,17 +548,15 @@ def convert_result_rows_to_dict2( @app.get("/status") async def get_status( request: Request, - account: Annotated[Optional[tuple[str, str]], Depends(auth)], conn: Annotated[connection, Depends(get_conn)], - subject: str = None, scopeuuid: str = None, version: str = None, + subject: str = None, scopeuuid: str = None, ): - check_role(account, subject, ROLES['read_any']) accept = request.headers['accept'] if 'application/json' not in accept and '*/*' not in accept: # see https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/406 raise HTTPException(status_code=406, detail="client needs to accept application/json") with conn.cursor() as cur: - rows2 = db_get_relevant_results2(cur, subject, scopeuuid, version, approved_only=False) + rows2 = db_get_relevant_results2(cur, subject, scopeuuid, approved_only=False) return convert_result_rows_to_dict2(rows2, get_scopes(), include_report=True)