Source ingest gating: allow / ignore / deny#384
Merged
Conversation
Adds source_policies.ingest (allow/ignore/deny, default allow), IngestMode in commons-types::source, and SourcePolicy ingest field + ingest_modes / ingest_for / set_ingest. list_sources returns the ingest mode. schema.rs hand-edited.
Public-server push handler gates on the source's ingest mode: deny rejects (403 AppError::IngestDenied), ignore accepts but records nothing, allow ingests. The reachability sweep excludes non-allow sources (no fresh data). sources endpoint + set_source_ingest; Sources table gains an ingest toggle that greys reachability when not allow. Tests: reachability exclusion, push gating (deny/ignore/allow), Playwright ingest toggle.
An ignored push must skip only recording, not the response: backup instructions, tags, and check severities come from server state, so an ignored reporter (e.g. a legacy alertd) still needs them. Gate just the write transaction on the ingest mode; compute and return the response as normal. Test asserts the backflow (a catalogued severity) survives ignore.
passcod
force-pushed
the
claude/source-ingest
branch
from
July 20, 2026 23:40
bb932cc to
6cfae7d
Compare
CHK says severity rules evaluate against the server's effective tags, but the push handler was feeding only the raw merged server+group tags. Feed file_health_events the effective tags (the same set returned to the device: merged tags + synthetic canopy:* + computed billing.*), computed once and reused for the response — so a rule can predicate on any of them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 Adds the second dimension of source policy — an ingest mode — building on the source-reachability PR.
Each source carries an ingest mode governing whether the device API accepts its reports:
200) but the source's data is discarded, recording nothing;403).Gating is per source, so other sources on the same server are unaffected; the reserved
canopy/manualsources are never gated.Reachability interaction. A source that isn't ingested has no fresh data to judge, so it's excluded from reachability regardless of its reachability mode. In the Sources table, setting a source to
ignore/denydisables its reachability control (shown asoff).Changes.
source_policies.ingest(allow/ignore/deny, defaultallow) +IngestMode.AppError::IngestDenied→ 403, documented in ERRORS.md).allowsources from the expected set.set_source_ingestendpoint; the Sources table gains an ingest toggle.