SysOps: voice-agy-webbuilder-backup — 2026-06-23 10:04 UTC

cockpit/app/services/agent_approvals.py

@@ -191,3 +191,48 @@ def require_approved(request_id: int) -> dict[str, Any]:
     if req.get("status") != "approved":
         raise PermissionError(f"Request status is {req.get('status')}, approval required")
     return req
+
+
+def _auto_approve_policy() -> dict[str, bool]:
+    try:
+        row = fetch_one("SELECT value FROM app_settings WHERE key = 'sysops_auto_approve'")
+        if row and row.get("value"):
+            val = row["value"]
+            if isinstance(val, str):
+                return json.loads(val)
+            return dict(val)
+    except Exception:
+        pass
+    return {"maintenance_scan": True, "config_backup": True}
+
+
+def try_auto_approve_and_execute(request_id: int) -> dict[str, Any] | None:
+    """Auto-approve low-risk SysOps requests when policy allows."""
+    req = get_request(request_id)
+    if not req or req.get("status") != "pending":
+        return None
+    key = str(req.get("agent_key") or "").lower()
+    action = str(req.get("action_type") or "")
+    policy = _auto_approve_policy()
+    if key != "sysops" or not policy.get(action):
+        return None
+    approved = approve_request(request_id, approved_by="auto_policy")
+    import os
+
+    import httpx
+
+    tools_url = os.getenv("TOOLS_API_URL", "http://tools-api:8700").rstrip("/")
+    result_payload: dict[str, Any] = {}
+    try:
+        if action == "config_backup":
+            with httpx.Client(timeout=180.0) as client:
+                resp = client.post(f"{tools_url}/ops/backup/run", json={"approval_request_id": request_id})
+            result_payload = resp.json() if resp.status_code < 500 else {"ok": False, "detail": resp.text}
+        elif action == "maintenance_scan":
+            with httpx.Client(timeout=120.0) as client:
+                resp = client.post(f"{tools_url}/ops/maintenance/scan")
+            result_payload = resp.json() if resp.status_code < 500 else {"ok": False, "detail": resp.text}
+    except Exception as exc:
+        result_payload = {"ok": False, "detail": str(exc)}
+    executed = mark_executed(request_id, result_payload)
+    return {"approved": approved, "executed": executed, "auto": True}