fix(release): pre-release sweep, 9 findings from long-committed scripts

HIGH: demo.sh banner + generate_demo_guide.py both said v2.0; app
is v1.0.0-rc1. Reworded version-neutral; Demo_Guide.pdf regenerated.

MEDIUM: backup_data.sh excludes were incomplete (top-level _*.json
runtime files, *.lock, .approval_queue.sig, .csv_expected_hashes.json,
.fim_*.json, .presence.json all leaked into archive). Restoring on a
different host would fail HMAC verification. Exclude list expanded.
Inventory step counted only DR*.csv prefix; widened to count every
customer whitelist.

MEDIUM: test_backup_restore.sh only compared DR*-prefixed files
(PASS despite 14-file archives). Now mirrors backup_data.sh exclude
set so the smoke verifies full archive contents.

MEDIUM: test_integration.sh save_csv test was stale (no expected_content_hash;
mandatory since hardening round 6). Verified live: 11/11 PASS post-fix.

MEDIUM: test_upgrade_path.sh removed entirely (targeted v2.0 to v3.0,
neither valid; would have destroyed wl_manager_test container).

LOW: auto-expire banner verified working at code + audit level
(wl_save.js shows banner; auto_removed event fires). No code fix needed.

Author: RelativisticJet

demo/Demo_Guide.pdf

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 #
 # ═══════════════════════════════════════════════════════════════════════
-# Whitelist Manager v2.0 — Quick Demo
+# Whitelist Manager — Quick Demo
 # ═══════════════════════════════════════════════════════════════════════
 #
 # Spins up a standalone Splunk instance in Docker, installs the
@@ -110,7 +110,7 @@ fi
 
 echo ""
 echo "═══════════════════════════════════════════════════════════════"
-echo "  Whitelist Manager v2.0 — Quick Demo"
+echo "  Whitelist Manager — Quick Demo"
 echo "═══════════════════════════════════════════════════════════════"
 echo ""
 

demo/demo.sh

@@ -287,7 +287,7 @@ def build():
     # -- Approval Workflow --
     pdf.section("4", "Approval Workflow Demo")
     pdf.body(
-        "One of the key v2.0 features is the approval workflow. "
+        "Whitelist Manager enforces an approval workflow for high-impact changes. "
         "Bulk operations above configurable thresholds require admin approval."
     )
 

demo/generate_demo_guide.py

@@ -12,17 +12,24 @@
 # any host other than the original.
 #
 # What gets backed up:
-#   - lookups/DR*.csv                    (active whitelist CSVs)
-#   - lookups/rule_csv_map.csv           (rule↔CSV mapping)
-#   - lookups/_versions/*.csv            (version snapshots)
-#   - lookups/_versions/*_versions.json  (version manifests)
+#   - lookups/*.csv                       (every customer whitelist CSV,
+#                                          regardless of naming convention)
+#   - lookups/rule_csv_map.csv            (rule↔CSV mapping)
+#   - lookups/_versions/*.csv             (version snapshots)
+#   - lookups/_versions/*_versions.json   (version manifests)
 #
 # What does NOT get backed up (rebuild on restore):
-#   - HMAC-signed state (`_action_cooldowns.json`, `wl_cooldowns` KV)
+#   - Top-level runtime JSON state (_approval_queue.json, _daily_limits.json,
+#     _notifications.json, _emergency_lockdown.json, _trash_config.json,
+#     _action_cooldowns.json, _fim_deploy_window.json, _detection_rules.json,
+#     _limit_config.json) — HMAC-signed and/or transient
+#   - Atomic-RMW lock artifacts (*.lock)
+#   - HMAC signatures and host-bound state (.approval_queue.sig,
+#     .csv_expected_hashes.json, .fim_*.json, .presence.json)
+#   - HMAC-signed cooldown state (`wl_cooldowns` KV)
 #   - FIM baselines (`.fim_baseline.json`, `wl_fim_baseline` KV)
-#   - Hash registry (`.csv_expected_hashes.json`) — re-bootstrap
-#   - Lockdown / presence / deploy-window files
-#   - Recovery log (it's append-only; archive separately if needed)
+#   - Recovery log (`_recovery_log.jsonl` — append-only; archive separately
+#     if you need its history)
 #
 # What this script does NOT capture (out of scope):
 #   - The `wl_audit` Splunk index — back up via Splunk's standard
@@ -67,16 +74,30 @@ fi
 mkdir -p "$OUTPUT_DIR"
 
 # ── Step 1: Inventory ─────────────────────────────────────────────────
+# Count every customer-meaningful CSV (any name, not just DR*). Exclude
+# rule_csv_map.csv from this count so the "Mapping file:" line below
+# is unambiguous, and exclude any *.lock files (RMW lock artifacts).
 echo "Step 1/4: Inventorying lookups..."
 CSV_COUNT=$(MSYS_NO_PATHCONV=1 docker exec -u 0 "$CONTAINER" \
-    sh -c "ls $APP_PATH/lookups/DR*.csv 2>/dev/null | wc -l" | tr -d '\r')
+    sh -c "find $APP_PATH/lookups -maxdepth 1 -type f -name '*.csv' ! -name 'rule_csv_map.csv' 2>/dev/null | wc -l" | tr -d '\r')
 VERSION_COUNT=$(MSYS_NO_PATHCONV=1 docker exec -u 0 "$CONTAINER" \
     sh -c "ls $APP_PATH/lookups/_versions/*.csv 2>/dev/null | wc -l" | tr -d '\r')
 echo "  CSVs:               $CSV_COUNT"
 echo "  Version snapshots:  $VERSION_COUNT"
 echo "  Mapping file:       rule_csv_map.csv"
 
 # ── Step 2: Tar inside the container ─────────────────────────────────
+# Excludes cover both runtime state and the HMAC-signed snapshots that
+# would fail signature verification when restored on a different host:
+#   - _versions/_*.json|jsonl   — runtime state inside _versions/
+#   - _*.json|jsonl             — top-level runtime state (approval queue,
+#                                 daily limits, notifications, etc.)
+#   - *.lock                    — atomic-RMW lock artifacts (transient)
+#   - .approval_queue.sig       — HMAC signature, host-bound
+#   - .csv_expected_hashes.json — HMAC-signed registry, host-bound
+#   - .fim_*.json               — FIM baseline / alert state, host-bound
+#   - .presence.json            — runtime presence cache
+#   - *.bak                     — editor backups
 echo ""
 echo "Step 2/4: Creating archive inside container..."
 TMP_INSIDE="/tmp/${BACKUP_NAME}.tar.gz"
@@ -86,6 +107,13 @@ MSYS_NO_PATHCONV=1 docker exec -u 0 "$CONTAINER" \
     --exclude='_versions/.*' \
     --exclude='_versions/_*.json' \
     --exclude='_versions/_*.jsonl' \
+    --exclude='_*.json' \
+    --exclude='_*.jsonl' \
+    --exclude='*.lock' \
+    --exclude='.approval_queue.sig' \
+    --exclude='.csv_expected_hashes.json' \
+    --exclude='.fim_*.json' \
+    --exclude='.presence.json' \
     --exclude='*.bak' \
     .
 

scripts/backup_data.sh

@@ -62,10 +62,22 @@ mkdir -p "$TMPDIR_LIVE"
 TMPDIR_RESTORE=""
 trap 'rm -rf "$TMPDIR_LIVE" "$TMPDIR_RESTORE"' EXIT
 
+# Inventory every customer-meaningful CSV under lookups/, regardless of
+# naming convention. Excludes match the backup_data.sh exclude list so
+# the comparison only spans files the archive is expected to contain.
 LIVE_INVENTORY="$TMPDIR_LIVE/live_inventory.txt"
 MSYS_NO_PATHCONV=1 docker exec -u 0 "$CONTAINER" sh -c \
     "cd $APP_PATH/lookups && \
-     find . -type f \\( -name 'DR*.csv' -o -name 'rule_csv_map.csv' \\) | sort" \
+     find . -type f \
+       ! -name '_*.json' ! -name '_*.jsonl' \
+       ! -name '*.lock' ! -name '*.bak' \
+       ! -name '.approval_queue.sig' \
+       ! -name '.csv_expected_hashes.json' \
+       ! -name '.fim_*.json' \
+       ! -name '.presence.json' \
+       ! -path './_versions/_*.json' ! -path './_versions/_*.jsonl' \
+       ! -path './_versions/.*' \
+       | sort" \
     > "$LIVE_INVENTORY"
 
 LIVE_FILE_COUNT=$(wc -l < "$LIVE_INVENTORY" | tr -d ' ')
@@ -124,7 +136,16 @@ mkdir -p "$TMPDIR_RESTORE"
 tar -xzf "$ARCHIVE" -C "$TMPDIR_RESTORE"
 
 RESTORED_INVENTORY="$TMPDIR_LIVE/restored_inventory.txt"
-(cd "$TMPDIR_RESTORE" && find . -type f \( -name 'DR*.csv' -o -name 'rule_csv_map.csv' \) | sort) \
+(cd "$TMPDIR_RESTORE" && find . -type f \
+   ! -name '_*.json' ! -name '_*.jsonl' \
+   ! -name '*.lock' ! -name '*.bak' \
+   ! -name '.approval_queue.sig' \
+   ! -name '.csv_expected_hashes.json' \
+   ! -name '.fim_*.json' \
+   ! -name '.presence.json' \
+   ! -path './_versions/_*.json' ! -path './_versions/_*.jsonl' \
+   ! -path './_versions/.*' \
+   | sort) \
     > "$RESTORED_INVENTORY"
 
 if ! diff -q "$LIVE_INVENTORY" "$RESTORED_INVENTORY" >/dev/null 2>&1; then

scripts/test_backup_restore.sh

@@ -159,6 +159,12 @@ echo "── REST Endpoint — POST (save + audit) ──"
 echo "  (Setting up test CSV in container...)"
 MSYS_NO_PATHCONV=1 docker exec -u splunk wl_manager_test bash -c 'printf "host,user,CommandLine,Comment\nWKSTN-001,bob,whoami,Legacy entry\nWKSTN-042,alice,net use,Approved\n" > /opt/splunk/etc/apps/wl_manager/lookups/TEST_whitelist.csv' 2>/dev/null || true
 
+# Fetch the current content_hash — save_csv enforces optimistic locking
+# (a security control added in hardening round 6). Without expected_content_hash
+# the save returns HTTP 409 Conflict.
+EXPECTED_HASH=$(splunk_custom GET -d "action=get_csv_content&csv_file=TEST_whitelist.csv" 2>/dev/null \
+    | python3 -c "import sys,json; print(json.load(sys.stdin).get('content_hash',''))" 2>/dev/null)
+
 run_test "POST save_csv writes CSV and returns diff"
 SAVE_BODY=$(splunk_custom POST \
     -H "Content-Type: application/json" \
@@ -167,6 +173,7 @@ SAVE_BODY=$(splunk_custom POST \
         "csv_file": "TEST_whitelist.csv",
         "app_context": "",
         "detection_rule": "TEST_rule",
+        "expected_content_hash": "'"$EXPECTED_HASH"'",
         "headers": ["host","user","CommandLine","Comment"],
         "rows": [
             {"host":"WKSTN-042","user":"alice","CommandLine":"net use","Comment":"Approved"},