[javuto]

Edit Santa rules in place

Closes #1163

Problem

Santa rules could only be created and deleted. Changing a rule's policy or message meant deleting it and creating it again, which threw away the original created_by, and Delete removed a rule with a single click.

Change

API (osctrl-api)

• New route PUT /api/v1/santa/{env}/rules/{id}, which requires environment admin like the other rule routes.
  • It checks and normalizes input the same way as create: hashes are lowercased, and team IDs and node UUIDs are uppercased.
  • Returns 409 if the edit would duplicate another rule (same type, identifier and scope).
  • Returns 404 for a rule in another environment and 400 for invalid input or a non-numeric id.
  • created_by and environment_id in the request body are ignored. The rule keeps its original creator.
  • The audit log records the rule before and after the edit, for example santa: update rule 7 TEAMID EQHXZ8M8AV ALLOWLIST scope=env -> TEAMID EQHXZ8M8AV BLOCKLIST scope=env.
• The create and delete audit lines now come from the same helper. Their text is unchanged.
• santa.Manager.UpdateRule writes the fields as a map, so clearing a field (custom message, CEL expression) is saved too.

Sync

• An edit changes the checksum of the node's effective rule set, so clients do a clean sync on their next sync and get the change. No change to osctrl-tls.

UI

• Each row in the Rules tab has an Edit button. It opens the existing rule form, filled in with the rule and titled "Edit rule".
• Delete now asks for confirmation (confirm(), as on the log sinks page) and names the rule's identifier.
• Three new strings in all 20 locales.

Docs

• pkg/santa/README.md documents the new route.
• osctrl-api.yaml has been regenerated.

Security / operational impact

• No schema change.
• The route takes the same environment admin check, request body size limit and audit logging as create and delete. It only loads and updates a rule that matches both the id and the environment, so a rule in another environment cannot be edited through this one.
• Known limit: the duplicate check runs before the update. If two admins make the same conflicting edit at the same moment, the unique index still stops the duplicate, but the second request gets a 500 instead of a 409.

Validation

• go test ./pkg/santa/ ./cmd/api/handlers/:
  • New TestUpdateRule (manager) covers:
    • normalization
    • clearing a field
    • created_by kept
    • the checksum changes
    • duplicate, wrong environment and invalid input
  • New TestSantaUpdateRule (handler) covers:
    • created_by in the request ignored
    • 409, 400 and 404
    • a rule in another environment
    • non-admin 403
    • the before/after audit line
  • The route was added to the test that checks every Santa route requires environment admin.
• go vet and golangci-lint (santa package and API): 0 issues. gofmt clean.
• make openapi-check passes.
• cd frontend && npm test (787 tests) and npm run check pass:
  • New test: editing a rule calls PUT with the right body and does not call create.
  • The delete test now checks that cancelling the confirmation does not delete.

Not verified:

• The Edit button and the delete confirmation in a browser.
• A real Santa client picking up an edited rule.
• The new translations, which have not been reviewed by native speakers.