Add deviceagent (WIP)#1197
Draft
gearnode wants to merge 21 commits into
Draft
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // hashSecret hashes a token/api-key value the same way for storage and | ||
| // lookup. SHA-256 is sufficient: the secret is high-entropy random. | ||
| func hashSecret(secret string) []byte { | ||
| sum := sha256.Sum256([]byte(secret)) |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| import { cookieBannerRoutes } from "./pages/organizations/cookie-banners/routes"; | ||
| import { riskAssessmentRoutes } from "./pages/organizations/risk-assessments/routes"; | ||
| import { riskRoutes } from "./pages/organizations/risks/routes"; | ||
| import { deviceRoutes } from "./pages/organizations/devices/routes"; |
There was a problem hiding this comment.
🚫 [eslint (apps/console)] reported by reviewdog 🐶./pages/organizations/devices/routes import should occur before import of ./pages/organizations/risk-assessments/routes import-x/order
Signed-off-by: Bryan Frimin <[email protected]>
Signed-off-by: Bryan Frimin <[email protected]>
Signed-off-by: Bryan Frimin <[email protected]>
Signed-off-by: Bryan Frimin <[email protected]>
Signed-off-by: Bryan Frimin <[email protected]>
Signed-off-by: Bryan Frimin <[email protected]>
Signed-off-by: Bryan Frimin <[email protected]>
Signed-off-by: Bryan Frimin <[email protected]>
Introduce probo-agent tray with region-aware enrollment prompts, world-readable enrollment state, and elevated install handoff so users enroll from the menu bar or system tray instead of the CLI. Signed-off-by: Bryan Frimin <[email protected]>
Ship a SwiftUI probo-agent-enroll-ui helper bundled in the macOS pkg, defer token entry to post-install tray launch, and polish installer copy for the menu bar enrollment experience. Signed-off-by: Bryan Frimin <[email protected]>
Mirror the macOS enrollment experience with a WinForms probo-agent-enroll-ui helper, shared regions.json manifest, and a Go test that keeps console URLs aligned with server_url.go. Signed-off-by: Bryan Frimin <[email protected]>
Enable CGO tray builds on macOS and Windows runners, bundle enrollment UI helpers in Windows release archives, and document the new install and release paths in the changelog and contrib guide. Signed-off-by: Bryan Frimin <[email protected]>
Add an enrollment_token_id column to devices so an enrolled device can be traced back to the token that provisioned it, and persist it on both initial enrollment and re-enrollment. Surface progress through a new deviceEnrollmentStatus query that reports whether a token has only been created, has produced an enrolled device, or has received its first posture activity. This lets the console drive a browser-based enrollment flow that polls for completion. Batch the device and enrollment-token authorization attribute lookups so the node resolver can authorize devices directly, and add the supporting coredata loaders. Signed-off-by: Bryan Frimin <[email protected]>
Guard the lease_generation/lease_owner changes with IF NOT EXISTS and IF EXISTS so the migration can be re-applied on databases that already ran an earlier version of it, then drop the temporary default once the column is populated. Signed-off-by: Bryan Frimin <[email protected]>
Introduce an /enroll page where an employee picks their organization and clicks a single button to hand off to the locally installed Probo agent via a probo:// deep link, then watches enrollment progress in the browser. Demote the manual token instructions to a collapsible section and point the employee devices page at the new browser flow as the recommended path, keeping CLI/MDM enrollment available for advanced setups. Signed-off-by: Bryan Frimin <[email protected]>
Replace the standalone enrollment UI helpers (the Swift app and the .NET/C# project) with a browser-driven flow. The console opens a probo://enroll?server=...&token=... deep link that the agent handles through a hidden enroll-url command, which starts the elevated install on macOS and Windows. Add ParseEnrollURL to validate the deep link, a macOS URL-handler app bundle, and a register-protocol.ps1 script that registers the probo:// scheme for the current Windows user. The tray helper now opens /enroll in the browser instead of collecting tokens locally, and systray becomes a direct dependency. Signed-off-by: Bryan Frimin <[email protected]>
Drive CGO from the target GOOS instead of the build host so the tray binary cross-compiles correctly, and detect the CPU count portably on macOS and other non-Linux hosts. Drop the dotnet setup and enroll-ui build steps from the release workflow now that the .NET helper is gone, shipping register-protocol.ps1 in Windows archives instead. Signed-off-by: Bryan Frimin <[email protected]>
Go's CrossOriginProtection only denies an unsafe request when the browser reports it as cross-origin via Sec-Fetch-Site, or, as a fallback, when an Origin header is present and untrusted. The probo-agent binary is a plain Go HTTP client that sends neither header, so those requests are allowed by default and never reach the cross-origin check. The four agent-API bypass patterns therefore matched nothing and only added confusion next to the OAuth2, SAML, and cookie-banner bypasses that genuinely handle browser and external origins. Signed-off-by: Bryan Frimin <[email protected]>
The employee devices page listed existing enrollment tokens, but the list provided no real value: tokens are write-once secrets shown only at creation time, and surfacing the stale metadata afterwards just added noise and a revoke control nobody used. Drop the deviceEnrollmentTokens field, its resolver, and the now-orphaned connection types and service lookup. On the frontend, remove the token table and the row component, and simplify the create form so it no longer inserts into a Relay connection that no longer exists. Signed-off-by: Bryan Frimin <[email protected]>
The device column and Go field tracked the identity tied to a device under the misleading name AssignedUserIdentityID, which implied an ongoing assignment relationship. Rename it to OwnerID (db owner_id), including the partial index and all queries, so the name reflects the device owner directly. Signed-off-by: Bryan Frimin <[email protected]>
Signed-off-by: Bryan Frimin <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by cubic
Adds device posture end-to-end with a browser-based enrollment flow using a
probo://deep link. Ships a macOS/Windows tray helper, REST endpoints, new device models, and Console pages; introduces anitamservice, tracks the enrollment token, and removes the token list UI.Tests
+292-0Coredata
+1156-2GraphQL API
+807-9/api/agent/v1for heartbeat and posture (device API key auth).deviceEnrollmentStatusquery.Service
+2026-751pkg/deviceagent: API-key enrollment viaenroll-url, first-boot heartbeat activation, and a macOS/Windows tray helper that opens/enroll; launchd and autostart helpers; enrollment marker.itamservice for devices/tokens/posture with RBAC; wired intoprobod.pkg/llmmodel registry.App: console
+1736-3/enrollpage with org picker and one‑click deep‑link; polling for status.Agents
+19-0Other
+784-83probo-agent.register-protocol.ps1forprobo://;go.modaddsfyne.io/systray.Written for commit 4fc0e83. Summary will update on new commits.