Upload 46 files

copilot/lexicon/vocab.yaml

@@ -666,6 +666,8 @@ verbs:
            remove public links, kill the link, disable the link, auto revoke, auto-revoke, remove external access,
            remove external shares, take away access]
   ALLOW: [allow, allowed, allows, permit, permitted, let, exempt, whitelist, whitelisted, allowlist, approve,
+          stop blocking, no longer block, dont block anymore, do not block anymore, lift the block on,
+          remove the block on, remove the block from, unban, unrestrict, re-enable, reenable, allow again,
           approved, trust, trusted, unblock, enable access, it is fine, is fine, are fine, is ok, is okay, are ok,
           it is ok, it is okay, fine to use, okay to use, ok to use, can use, may use, can keep using, no problem with]
   ENABLE: [enable, enabled, turn on, switch on, activate, use, add, require, enforce, enforced, apply, start,

copilot/model.py

@@ -49,6 +49,8 @@ class Draft:
     # Set when the draft goes into an existing policy (merge.py): {id, name, active} and the changes.
     mergeInto: dict | None = None
     mergeOps: list[dict] = field(default_factory=list)
+    # Which part of the sentence this draft came from: answers are keyed "<slot>@<requestIndex>".
+    requestIndex: int = 0
 
     @property
     def status(self) -> str:
@@ -76,6 +78,8 @@ class Draft:
             steps.append({'method': 'POST', 'path': '/api/admin/block-lists', 'body': bl['body'],
                           'resultId': 'list.id', 'replaces': bl['placeholder']})
         if self.policyBody is not None and self.mergeInto:
+            if not self.mergeOps:
+                return steps   # still waiting for an answer: nothing to save yet
             # Applied by the dashboard to the policy as it is at save time, then saved with PATCH.
             steps.append({'method': 'PATCH', 'path': f'/api/admin/policies/{self.mergeInto["id"]}',
                           'merge': self.mergeOps})
@@ -92,6 +96,7 @@ class Draft:
             'policyBody': self.policyBody,
             'saveSteps': self.save_steps(),
             'mergeInto': self.mergeInto,
+            'requestIndex': self.requestIndex,
             'questions': [q.to_json() for q in self.questions],
             'issues': [i.to_json() for i in self.issues],
             'spans': self.spans,

copilot/pipeline.py

@@ -16,7 +16,7 @@ import time
 import traceback
 import uuid
 
-from . import check, impact, merge, render
+from . import check, impact, merge, render, unblock
 from .adapters import ADAPTERS
 from .directives import Directives, extract
 from .interpret import Request, interpret
@@ -113,8 +113,9 @@ def _parse(text: object, context: object, answers: dict) -> dict:
     messages: list[str] = []
     for index, req in enumerate(und.requests):
         d = _draft(req, index, ctx, answers, messages, directives, len(und.requests))
-        if d is not None:
-            drafts.append(d)
+        for one in (d if isinstance(d, list) else [d] if d is not None else []):
+            one.requestIndex = index
+            drafts.append(one)
 
     if not drafts:
         return {'status': 'not_a_policy', 'intent': 'CREATE',
@@ -122,7 +123,11 @@ def _parse(text: object, context: object, answers: dict) -> dict:
                 'drafts': [], 'issues': issues, 'examples': examples(), 'understood': understood}
 
     status = 'ready' if all(d.status == 'ready' for d in drafts) else 'needs_input'
-    msg = (f'{len(drafts)} policies proposed.' if len(drafts) > 1 else 'Policy proposed.')
+    changes = sum(1 for d in drafts if d.mergeInto)
+    if changes == len(drafts):
+        msg = f'{changes} changes to existing policies proposed.' if changes > 1 else 'Change to an existing policy proposed.'
+    else:
+        msg = (f'{len(drafts)} policies proposed.' if len(drafts) > 1 else 'Policy proposed.')
     if status == 'needs_input':
         msg += ' Answer the questions before saving.'
     return {'status': status, 'intent': 'CREATE', 'message': ' '.join([msg] + messages),
@@ -135,7 +140,7 @@ def _answer(answers: dict, slot: str, index: int):
 
 
 def _draft(req: Request, index: int, ctx, answers: dict, messages: list[str],
-           directives: Directives | None = None, total: int = 1) -> Draft | None:
+           directives: Directives | None = None, total: int = 1) -> Draft | list[Draft] | None:
     directives = directives or Directives()
     if req.verb == 'UNSUPPORTED':
         can = ['block', 'warn', 'redact', 'alert', 'log'] + [
@@ -180,6 +185,11 @@ def _draft(req: Request, index: int, ctx, answers: dict, messages: list[str],
     if req.type not in ADAPTERS:
         messages.append(_unavailable([req.type]))
         return None
+    if unblock.applies(req):
+        # "unblock usb for finance": switch it off where it is on, never a new "allow" policy
+        found, notes = unblock.build(req, ctx, index, answers)
+        messages.extend(notes)
+        return found
 
     # ---- data the admin excluded ("all PII except names") and data chosen in answers
     data = req.content.data

copilot/platform/context.py

@@ -75,6 +75,13 @@ class PolicySummary:
     connectorIds: list[str]
     provider: str = ''     # email policies: 'google' | 'm365' (one saved before the split is Gmail)
     active: bool = True
+    # Device and browser switches that are on ("agentControl.blockPrint"), for unblock requests.
+    controls: set[str] = field(default_factory=set)
+    # Sites and apps it blocks by name, and the block lists it uses: for "unblock chatgpt".
+    blockedDomains: set[str] = field(default_factory=set)
+    blockedApps: set[str] = field(default_factory=set)
+    webLists: list[str] = field(default_factory=list)
+    appLists: list[str] = field(default_factory=list)
 
 
 @dataclass
@@ -96,6 +103,10 @@ class PlatformContext:
     # Web Filtering categories (tenant-defined). Unknown when the caller sent none.
     webCategories: list[WebCategory] = field(default_factory=list)
     webCategoriesKnown: bool = False
+    # True when the caller sent each policy's switches (PolicySummary.controls).
+    controlsKnown: bool = False
+    # True when the caller sent what each policy blocks (sites, apps, lists).
+    blocksKnown: bool = False
     # The tenant's own regex detectors, and the built-in ones an admin switched off.
     detectors: list[Detector] = field(default_factory=list)
     disabledDetectors: set[str] = field(default_factory=set)
@@ -135,6 +146,7 @@ class PlatformContext:
 
 
 _LABEL = re.compile(r'^[A-Z][A-Z0-9_]{1,63}$')
+_CONTROL = re.compile(r'^(agentControl|extensionControl)\.[A-Za-z][A-Za-z0-9]{1,63}$')
 
 
 def _s(v: Any, limit: int = 300) -> str:
@@ -252,7 +264,16 @@ def load_context(raw: Any) -> PlatformContext:
             connectorIds=_strs(p.get('connectorIds')),
             provider=_email_provider(p) if ptype == 'email' else '',
             active=p.get('active') is not False,
+            controls={c for c in _strs(p.get('controls'), 200) if _CONTROL.match(c)},
         )
+        if isinstance(p.get('controls'), list):
+            ctx.controlsKnown = True
+        if isinstance(p.get('blockedDomains'), list):
+            ctx.blocksKnown = True
+            summary.blockedDomains = {x.lower() for x in _strs(p.get('blockedDomains'), 500)}
+            summary.blockedApps = {x.lower() for x in _strs(p.get('blockedApplications'), 500)}
+            summary.webLists = _strs(p.get('webBlockListIds'), 100)
+            summary.appLists = _strs(p.get('appBlockListIds'), 100)
         ctx.allPolicies.append(summary)
         if summary.active:
             ctx.policies.append(summary)

copilot/unblock.py

@@ -0,0 +1,292 @@
+"""Unblocking a device or browser control: "unblock usb for finance", "allow printing again".
+
+"Allow" needs no NEW policy (nothing is blocked unless a policy blocks it), but it is still a real
+request: switch the control off where it is on. Where it is on decides what can be done:
+
+  - the group's own policy, or any policy for an "everyone" request: offer to switch it off there
+    (a change to that existing policy, through merge.py's save step);
+  - an org-wide policy, for a group: device and browser controls from org-wide policies apply to
+    every group, and a group policy cannot switch them off. Say which policy, and the two real ways
+    out, instead of creating something that would not work;
+  - nowhere: say so.
+
+Needs the controls each policy has on (PolicySummary.controls). Without them (an older server),
+the copilot says it cannot see them rather than guess.
+"""
+from __future__ import annotations
+
+from .lexicon import load
+from .model import Draft, Question
+from .platform import catalog
+from .platform.context import PlatformContext, PolicySummary
+
+MAX_POLICIES = 4
+
+# What the admin calls each switch, for the messages.
+LABEL = {
+    'agentControl.blockRemovableStorage': 'USB storage', 'agentControl.removableStorageReadOnly': 'USB read-only',
+    'agentControl.blockPrint': 'printing', 'agentControl.blockBluetooth': 'Bluetooth transfer',
+    'agentControl.blockScreenCapture': 'screenshots', 'agentControl.blockMobileSync': 'phone sync',
+    'agentControl.blockCloudUpload': 'cloud storage uploads', 'agentControl.blockPersonalEmail': 'personal webmail',
+    'agentControl.blockFileSharing': 'file-sharing sites', 'agentControl.blockWebUpload': 'web and FTP uploads',
+    'agentControl.blockDebugTools': 'debug and proxy tools', 'extensionControl.enforceIncognito': 'incognito windows',
+    'extensionControl.blockGuestMode': 'guest mode', 'extensionControl.blockDevTools': 'browser developer tools',
+    'extensionControl.blockDeveloperMode': 'browser developer mode', 'extensionControl.blockDownloads': 'downloads',
+    'extensionControl.blockOtherBrowsers': 'other browsers',
+}
+
+
+def _label(paths: list[str], name: str) -> str:
+    return next((LABEL[p] for p in paths if p in LABEL), name.replace('_', ' '))
+
+
+def _scope(gid: str, ctx: PlatformContext) -> str:
+    if gid == 'default':
+        return 'everyone'
+    g = ctx.group(gid)
+    return g.name if g else gid
+
+
+HOST_ALIASES = {'chatgpt.com': ['chatgpt.com', 'chat.openai.com']}
+
+
+def applies(req) -> bool:
+    """An "allow X" request about device / browser switches, sites, apps or block lists, with no data."""
+    if req.type != 'endpoint' or req.verb not in ('ALLOW', 'ENABLE') or req.only:
+        return False
+    if not req.content.data.empty():
+        return False
+    c = req.content
+    lx = load()
+    return any(lx.controls.get(n, {}).get('polarity') == 'restrict' and _paths(n) for n in c.controls) \
+        or bool(c.sites or c.ai_sites or c.apps or c.blists)
+
+
+def _app(x: str) -> str:
+    x = x.lower().strip()
+    return x[:-4] if x.endswith('.exe') else x
+
+
+def _site_hit(host: str, entry: str) -> bool:
+    """A web entry blocks the domain and every subdomain (PAC dnsDomainIs)."""
+    return host == entry or host.endswith('.' + entry)
+
+
+def _paths(name: str) -> list[str]:
+    spec = load().controls.get(name) or {}
+    return [p for p, v in (spec.get('set') or {}).items() if v is True]
+
+
+def build(req, ctx: PlatformContext, index: int = 0, answers: dict | None = None) -> tuple[list[Draft], list[str]]:
+    """Drafts that switch the controls off in the policies that have them on, and/or messages."""
+    names = [n for n in req.content.controls if load().controls.get(n, {}).get('polarity') == 'restrict' and _paths(n)]
+    gids = [g for g in req.content.groups if ctx.group(g)] or ['default']
+    gid = gids[0]
+    who = _scope(gid, ctx)
+    messages: list[str] = []
+    site_drafts, site_msgs = _sites_and_lists(req, ctx, gid, index, answers or {})
+    messages += site_msgs
+    if not names:
+        return _combine(site_drafts), messages
+    if not ctx.controlsKnown:
+        what = ', '.join(_label(_paths(n), n) for n in names)
+        return [], [f'I cannot see which policies block {what}, so I cannot unblock it from here. Open the '
+                    f'Devices & Browsers policies on the Policies page and switch it off there.']
+
+    ops_by_policy: dict[str, list[dict]] = {}
+    labels_by_policy: dict[str, list[str]] = {}
+    for n in names:
+        paths = _paths(n)
+        label = _label(paths, n)
+        on = [p for p in ctx.policies if p.type == 'endpoint' and any(x in p.controls for x in paths)]
+        if gid != 'default':
+            org = [p for p in on if p.groupId == 'default']
+            if org:
+                names_ = ', '.join(f'"{p.name}"' for p in org[:3])
+                first = org[0].name
+                extra = (f', or keep it blocked and allow {who}\'s approved drives by serial number '
+                         f'("allow usb serial ABC123 in {first}")') if 'agentControl.blockRemovableStorage' in paths else ''
+                messages.append(
+                    f'{label[0].upper() + label[1:]} is blocked for everyone by {names_}. Device and browser controls '
+                    f'in org-wide policies apply to every group, so a policy for {who} cannot switch it off for {who}. '
+                    f'To let {who} use it, switch it off in {names_} and block it again in policies for the groups '
+                    f'that should keep it{extra}.')
+                continue
+            targets = [p for p in on if p.groupId == gid]
+        else:
+            targets = on
+        if not targets:
+            messages.append(f'{label[0].upper() + label[1:]} is not blocked for {who} by any active policy, so there '
+                            f'is nothing to unblock.')
+            continue
+        for p in targets[:MAX_POLICIES]:
+            ops_by_policy.setdefault(p.id, []).extend(
+                {'op': 'set', 'path': x, 'value': False} for x in paths if x in p.controls)
+            labels_by_policy.setdefault(p.id, []).append(label)
+
+    drafts = [_draft(ctx.policy(pid), ops, labels_by_policy[pid], ctx)
+              for pid, ops in ops_by_policy.items() if ctx.policy(pid)]
+    return _combine(site_drafts + drafts), messages
+
+
+def _combine(drafts: list[Draft]) -> list[Draft]:
+    """One draft per policy, however many things in it are unblocked."""
+    out: dict[str, Draft] = {}
+    for d in drafts:
+        pid = d.mergeInto['id']
+        if pid not in out:
+            out[pid] = d
+            continue
+        keep = out[pid]
+        keep.mergeOps += [o for o in d.mergeOps if o not in keep.mergeOps]
+        what = d.summary.split(': ', 1)[-1].rstrip('.')
+        if what not in keep.summary:
+            keep.summary = keep.summary.rstrip('.') + '; ' + what + '.'
+        for i in d.issues:
+            keep.issue(i.code, i.level, i.message, **i.detail)
+        for q in d.questions:
+            keep.ask(q)
+    return list(out.values())
+
+
+def _sites_and_lists(req, ctx: PlatformContext, gid: str, index: int, answers: dict) -> tuple[list[Draft], list[str]]:
+    c = req.content
+    if not (c.sites or c.ai_sites or c.apps or c.blists):
+        return [], []
+    who = _scope(gid, ctx)
+    if not ctx.blocksKnown:
+        return [], ['I cannot see which policies block these sites or apps, so I cannot unblock them from here. '
+                    'Open the Devices & Browsers policies on the Policies page.']
+    hosts = list(dict.fromkeys(h for s in c.sites + c.ai_sites for h in HOST_ALIASES.get(s, [s])))
+    apps = list(dict.fromkeys(_app(a) for a in c.apps))
+    lists = list(dict.fromkeys(c.blists))
+    in_scope = [p for p in ctx.policies if p.type == 'endpoint']
+    drafts: list[Draft] = []
+    messages: list[str] = []
+
+    def scoped(on: list[PolicySummary], what: str) -> list[PolicySummary] | None:
+        if gid == 'default':
+            return on
+        org = [p for p in on if p.groupId == 'default']
+        if org:
+            messages.append(f'{what} is blocked for everyone by {", ".join(f"{chr(34)}{p.name}{chr(34)}" for p in org[:3])}. '
+                            f'Block lists and blocked sites in org-wide policies apply to every group, so a policy for '
+                            f'{who} cannot unblock it for {who}. Unblock it there, and block it again in policies for the '
+                            f'groups that should keep it.')
+            return None
+        return [p for p in on if p.groupId == gid]
+
+    # Whole lists the admin named: "allow social media again"
+    for lid in lists:
+        bl = ctx.block_list(lid)
+        if not bl:
+            continue
+        field_ = 'agentControl.webBlockListIds' if bl.kind == 'web' else 'agentControl.appBlockListIds'
+        on = [p for p in in_scope if lid in (p.webLists if bl.kind == 'web' else p.appLists)]
+        targets = scoped(on, f'"{bl.name}"')
+        if targets is None:
+            continue
+        if not targets:
+            messages.append(f'"{bl.name}" is not used by any active policy for {who}, so there is nothing to unblock.')
+        for p in targets[:MAX_POLICIES]:
+            drafts.append(_change(p, [{'op': 'remove', 'path': field_, 'value': [lid]}],
+                                  f'stop using the block list "{bl.name}"', ctx))
+
+    # Single sites and apps: "unblock chatgpt", "allow whatsapp"
+    for kind, names_ in (('web', hosts), ('app', apps)):
+        for name in names_:
+            label = name if kind == 'web' else f'{name}.exe'
+            direct: dict[str, list[str]] = {}
+            via: dict[str, list[str]] = {}
+            for p in in_scope:
+                own = [e for e in (p.blockedDomains if kind == 'web' else p.blockedApps)
+                       if (_site_hit(name, e) if kind == 'web' else _app(e) == name)]
+                if own:
+                    direct[p.id] = own
+                for lid in (p.webLists if kind == 'web' else p.appLists):
+                    bl = ctx.block_list(lid)
+                    if bl and bl.kind == kind and any(_site_hit(name, e) if kind == 'web' else _app(e) == name
+                                                      for e in bl.entries):
+                        via.setdefault(p.id, []).append(lid)
+            on = [p for p in in_scope if p.id in direct or p.id in via]
+            targets = scoped(on, label)
+            if targets is None:
+                continue
+            if not targets:
+                msg = f'{label} is not blocked for {who} by any active policy, so there is nothing to unblock.'
+                if kind == 'web' and name in catalog.ai_hosts():
+                    # The site itself is reachable; what users meet is probably a prompt rule.
+                    msg += (' If prompts to it are being blocked, that comes from an AI prompt rule: the event on '
+                            'the Activity page names the policy and rule.')
+                messages.append(msg)
+                continue
+            for p in targets[:MAX_POLICIES]:
+                ops: list[dict] = []
+                if p.id in direct:
+                    path = 'agentControl.blockedDomains' if kind == 'web' else 'agentControl.blockedApplications'
+                    ops.append({'op': 'remove', 'path': path, 'value': direct[p.id]})
+                d = _change(p, ops, f'stop blocking {label}', ctx) if ops else None
+                for lid in via.get(p.id, []):
+                    bl = ctx.block_list(lid)
+                    if not bl.builtin:
+                        messages.append(f'{label} is in your block list "{bl.name}", used by "{p.name}". Remove it '
+                                        f'from that list on the Block lists page (every policy using the list changes).')
+                        continue
+                    others = len(bl.entries) - 1
+                    field_ = 'agentControl.webBlockListIds' if kind == 'web' else 'agentControl.appBlockListIds'
+                    dd = d or _change(p, [], f'stop blocking {label}', ctx)
+                    slot = f'detach_{lid}'
+                    if answers.get(f'{slot}@{index}', answers.get(slot)) == 'yes':
+                        dd.mergeOps.append({'op': 'remove', 'path': field_, 'value': [lid]})
+                    else:
+                        dd.issue('UNBLOCK_NEEDS_LIST', 'blocking',
+                                 f'{label} is blocked by the built-in list "{bl.name}" in "{p.name}". A built-in list '
+                                 f'cannot be edited, so unblocking it means removing the whole list from the policy, '
+                                 f'which also unblocks its {others} other entries.', list=bl.name, policy=p.name)
+                        dd.ask(Question(slot, f'Remove "{bl.name}" from "{p.name}"? This unblocks all {others + 1} '
+                                              f'of its entries.',
+                                        [{'value': 'yes', 'label': f'Yes, remove "{bl.name}"'},
+                                         {'value': 'cancel', 'label': 'Cancel'}], True, None))
+                    d = dd
+                if d is not None:
+                    drafts.append(d)
+    return drafts, messages
+
+
+def _change(p: PolicySummary, ops: list[dict], what: str, ctx: PlatformContext) -> Draft:
+    body = catalog.default_body('endpoint')
+    body['groupId'] = p.groupId
+    body['name'] = p.name
+    d = Draft('endpoint', body)
+    d.mergeInto = {'id': p.id, 'name': p.name, 'active': p.active}
+    d.mergeOps = list(ops)
+    d.summary = f'In "{p.name}" ({_scope(p.groupId, ctx)}): {what}.'
+    d.issue('MERGE_INTO', 'info', f'This changes the existing policy "{p.name}"; no new policy is created.',
+            policy=p.name)
+    if p.groupId == 'default':
+        d.issue('UNBLOCK_EVERYONE', 'warning', f'"{p.name}" applies to everyone, so this is unblocked for every '
+                                              f'group that has no other policy blocking it.', policy=p.name)
+    if p.active:
+        d.issue('MERGE_LIVE', 'warning', f'"{p.name}" is on, so the change applies as soon as you save.',
+                policy=p.name)
+    return d
+
+
+def _draft(p: PolicySummary, ops: list[dict], labels: list[str], ctx: PlatformContext) -> Draft:
+    body = catalog.default_body('endpoint')
+    body['groupId'] = p.groupId
+    body['name'] = p.name
+    d = Draft('endpoint', body)
+    d.mergeInto = {'id': p.id, 'name': p.name, 'active': p.active}
+    d.mergeOps = ops
+    what = ', '.join(dict.fromkeys(labels))
+    d.summary = f'In "{p.name}" ({_scope(p.groupId, ctx)}): stop blocking {what}.'
+    d.issue('MERGE_INTO', 'info', f'This changes the existing policy "{p.name}"; no new policy is created.',
+            policy=p.name)
+    if p.groupId == 'default':
+        d.issue('UNBLOCK_EVERYONE', 'warning', f'"{p.name}" applies to everyone, so {what} is unblocked for every '
+                                              f'group that has no other policy blocking it.', policy=p.name)
+    if p.active:
+        d.issue('MERGE_LIVE', 'warning', f'"{p.name}" is on, so the change applies as soon as you save.',
+                policy=p.name)
+    return d