jms_version.py

from __future__ import annotations

# JumpServer Skills v3-LTS endpoint profile.
# API facts are derived from JumpServer v3.10.21-lts.

TARGET_VERSION = "v3"
TARGET_VERSION_LABEL = "V3.10 LTS"
REFERENCE_BRANCH = "v3.10.21-lts"
SUPPORTS_XPACK = True

# --- Shared paths (confirmed in v3.10.21-lts) ---

ASSET_PATH = "/api/v1/assets/assets/"
NODE_PATH = "/api/v1/assets/nodes/"
PLATFORM_PATH = "/api/v1/assets/platforms/"
ACCOUNT_PATH = "/api/v1/accounts/accounts/"
ACCOUNT_TEMPLATE_PATH = "/api/v1/accounts/account-templates/"
USER_PATH = "/api/v1/users/users/"
GROUP_PATH = "/api/v1/users/groups/"
ORG_PATH = "/api/v1/orgs/orgs/"
LABEL_PATH = "/api/v1/labels/labels/"
DOMAIN_PATH = "/api/v1/assets/domains/"
PERMISSION_PATH = "/api/v1/perms/asset-permissions/"
TERMINAL_COMMANDS_PATH = "/api/v1/terminal/commands/"
TERMINAL_SESSIONS_PATH = "/api/v1/terminal/sessions/"
TERMINAL_STATUS_PATH = "/api/v1/terminal/status/"
TERMINALS_PATH = "/api/v1/terminal/terminals/"
REPLAY_STORAGES_PATH = "/api/v1/terminal/replay-storages/"
COMMAND_STORAGES_PATH = "/api/v1/terminal/command-storages/"
ENDPOINT_RULES_PATH = "/api/v1/terminal/endpoint-rules/"
ROLE_BINDINGS_PATH = "/api/v1/rbac/role-bindings/"
ORG_ROLE_BINDINGS_PATH = "/api/v1/rbac/org-role-bindings/"
SYSTEM_ROLE_BINDINGS_PATH = "/api/v1/rbac/system-role-bindings/"
ROLES_PATH = "/api/v1/rbac/roles/"
LOGIN_LOGS_PATH = "/api/v1/audits/login-logs/"
OPERATE_LOGS_PATH = "/api/v1/audits/operate-logs/"
FTP_LOGS_PATH = "/api/v1/audits/ftp-logs/"
JOB_LOGS_PATH = "/api/v1/audits/job-logs/"
PASSWORD_CHANGE_LOGS_PATH = "/api/v1/audits/password-change-logs/"
USER_SESSIONS_PATH = "/api/v1/audits/user-sessions/"
SETTINGS_PATH = "/api/v1/settings/setting/"
PUBLIC_SETTINGS_PATH = "/api/v1/settings/public/"
SERVER_INFO_PATH = "/api/v1/settings/server-info/"
LICENSE_DETAIL_PATH = "/api/v1/xpack/license/detail"
TICKETS_PATH = "/api/v1/tickets/tickets/"
TICKET_FLOWS_PATH = "/api/v1/tickets/flows/"
NOTIFICATION_BACKENDS_PATH = "/api/v1/notifications/backends/"
OPS_JOBS_PATH = "/api/v1/ops/jobs/"

# Audit-side job records use job-logs on V3.10 LTS.
JOB_LIST_PATH = JOB_LOGS_PATH

DOMAIN_RESOURCE_ALIASES = ("domain", "domains", "zone", "zones")

V3_ASSET_KIND_PATHS = {
    "host": "/api/v1/assets/hosts/",
    "database": "/api/v1/assets/databases/",
    "device": "/api/v1/assets/devices/",
    "cloud": "/api/v1/assets/clouds/",
    "web": "/api/v1/assets/webs/",
    "website": "/api/v1/assets/webs/",
    "custom": "/api/v1/assets/customs/",
    "customs": "/api/v1/assets/customs/",
    "gpt": "/api/v1/assets/gpts/",
    "gpts": "/api/v1/assets/gpts/",
}

CORE_ENDPOINTS = {
    "users": USER_PATH,
    "groups": GROUP_PATH,
    "nodes": NODE_PATH,
    "hosts": "/api/v1/assets/hosts/",
    "assets": ASSET_PATH,
    "databases": "/api/v1/assets/databases/",
    "accounts": ACCOUNT_PATH,
    "account_templates": ACCOUNT_TEMPLATE_PATH,
    "permissions": PERMISSION_PATH,
    "connect_method_acls": "/api/v1/acls/connect-method-acls/",
    "login_asset_acls": "/api/v1/acls/login-asset-acls/",
    "login_acls": "/api/v1/acls/login-acls/",
    "command_filter_acls": "/api/v1/acls/command-filter-acls/",
    "command_groups": "/api/v1/acls/command-groups/",
    "system_roles": "/api/v1/rbac/system-roles/",
    "org_roles": "/api/v1/rbac/org-roles/",
    "role_bindings": ROLE_BINDINGS_PATH,
    "org_role_bindings": ORG_ROLE_BINDINGS_PATH,
    "system_role_bindings": SYSTEM_ROLE_BINDINGS_PATH,
    "platforms": PLATFORM_PATH,
    "protocols": "/api/v1/assets/protocols/",
    "virtual_accounts": "/api/v1/accounts/virtual-accounts/",
    "labels": LABEL_PATH,
    "domains": DOMAIN_PATH,
    "session_logs": USER_SESSIONS_PATH,
    "terminal_sessions": TERMINAL_SESSIONS_PATH,
    "terminal_commands": TERMINAL_COMMANDS_PATH,
    "operate_logs": OPERATE_LOGS_PATH,
    "login_logs": LOGIN_LOGS_PATH,
    "ftp_logs": FTP_LOGS_PATH,
    "password_change_logs": PASSWORD_CHANGE_LOGS_PATH,
    "job_logs": JOB_LOGS_PATH,
    "ops_jobs": OPS_JOBS_PATH,
    "tickets": TICKETS_PATH,
    "settings": SETTINGS_PATH,
    "license_detail": LICENSE_DETAIL_PATH,
    "blocked_ips": "/api/v1/settings/security/block-ip/",
    "unlock_ip": "/api/v1/settings/security/unlock-ip/",
    "terminals": TERMINALS_PATH,
    "command_storages": COMMAND_STORAGES_PATH,
    "replay_storages": REPLAY_STORAGES_PATH,
}

PERMISSION_RESOURCE_PATHS = {
    "asset-permission": PERMISSION_PATH,
    "connect-method-acl": "/api/v1/acls/connect-method-acls/",
    "login-asset-acl": "/api/v1/acls/login-asset-acls/",
    "login-acl": "/api/v1/acls/login-acls/",
    "command-filter-acl": "/api/v1/acls/command-filter-acls/",
    "command-group": "/api/v1/acls/command-groups/",
    "org-role": "/api/v1/rbac/org-roles/",
    "system-role": "/api/v1/rbac/system-roles/",
    "role-binding": ROLE_BINDINGS_PATH,
    "org-role-binding": ORG_ROLE_BINDINGS_PATH,
    "system-role-binding": SYSTEM_ROLE_BINDINGS_PATH,
}

OBJECT_RESOURCE_PATHS = {
    "node": NODE_PATH,
    "platform": PLATFORM_PATH,
    "account": ACCOUNT_PATH,
    "account-template": ACCOUNT_TEMPLATE_PATH,
    "user": USER_PATH,
    "user-group": GROUP_PATH,
    "organization": ORG_PATH,
    "label": LABEL_PATH,
    "domain": DOMAIN_PATH,
    "zone": DOMAIN_PATH,
}

AUDIT_PATHS = {
    "operate": OPERATE_LOGS_PATH,
    "login": LOGIN_LOGS_PATH,
    "session": USER_SESSIONS_PATH,
    "ftp": FTP_LOGS_PATH,
    "password_change": PASSWORD_CHANGE_LOGS_PATH,
    "jobs": JOB_LOGS_PATH,
    "command": TERMINAL_COMMANDS_PATH,
    "terminal-session": TERMINAL_SESSIONS_PATH,
}

# v3 has no built-in reports app; governance dashboards use account automation APIs instead.
REPORT_PATHS = {}

UNSUPPORTED_REPORT_TYPES = {
    "account-statistic",
    "account-automation",
    "asset-statistic",
    "asset-activity",
    "users",
    "user-change-password",
    "pam-dashboard",
    "change-secret-dashboard",
}

V3_ACCOUNT_AUTOMATION_SPECS = {
    "backup_plans": {"path": "/api/v1/accounts/account-backup-plans/", "mode": "list"},
    "backup_executions": {"path": "/api/v1/accounts/account-backup-plan-executions/", "mode": "list"},
    "change_secret_automations": {"path": "/api/v1/accounts/change-secret-automations/", "mode": "list"},
    "change_secret_executions": {"path": "/api/v1/accounts/change-secret-executions/", "mode": "list"},
    "change_secret_records": {"path": "/api/v1/accounts/change-secret-records/", "mode": "list"},
    "push_account_automations": {"path": "/api/v1/accounts/push-account-automations/", "mode": "list"},
    "push_account_executions": {"path": "/api/v1/accounts/push-account-executions/", "mode": "list"},
    "push_account_records": {"path": "/api/v1/accounts/push-account-records/", "mode": "list"},
    "gather_account_automations": {"path": "/api/v1/accounts/gather-account-automations/", "mode": "list"},
    "gather_account_executions": {"path": "/api/v1/accounts/gather-account-executions/", "mode": "list"},
}

UNSUPPORTED_CAPABILITY_IDS = {
    "report-query",
}

UNSUPPORTED_PERMISSION_RESOURCES = {
    "data-masking-rule",
}

XPACK_ENDPOINTS = {
    "license_detail": LICENSE_DETAIL_PATH,
    "license_import": "/api/v1/xpack/license/import",
    "cloud_accounts": "/api/v1/xpack/cloud/accounts/",
    "cloud_strategies": "/api/v1/xpack/cloud/strategies/",
    "interface_setting": "/api/v1/xpack/interface/setting/",
}


def is_domain_resource(resource):
    return str(resource or "").strip().lower() in DOMAIN_RESOURCE_ALIASES


def normalize_domain_resource(resource):
    value = str(resource or "").strip().lower()
    if value in {"zone", "zones", "domain", "domains"}:
        return "domain"
    return value