fleet/server/mdm/android/android.go

84 lines
2.4 KiB
Go
Raw Normal View History

package android
import (
"database/sql"
"time"
)
const DefaultAndroidPolicyID = 1
type SignupDetails struct {
Url string
Name string
}
type Enterprise struct {
ID uint `db:"id"`
EnterpriseID string `db:"enterprise_id"`
}
func (e Enterprise) Name() string {
return "enterprises/" + e.EnterpriseID
}
func (e Enterprise) IsValid() bool {
return e.EnterpriseID != ""
}
func (e Enterprise) AuthzType() string {
return "android_enterprise"
}
type EnterpriseDetails struct {
Enterprise
SignupName string `db:"signup_name"`
SignupToken string `db:"signup_token"`
TopicID string `db:"pubsub_topic_id"`
UserID uint `db:"user_id"`
}
type EnrollmentToken struct {
EnrollmentToken string `json:"android_enrollment_token"`
EnrollmentURL string `json:"android_enrollment_url"`
}
type Device struct {
ID uint `db:"id"`
HostID uint `db:"host_id"`
DeviceID string `db:"device_id"`
EnterpriseSpecificID *string `db:"enterprise_specific_id"`
LastPolicySyncTime *time.Time `db:"last_policy_sync_time"`
AppliedPolicyID *string `db:"applied_policy_id"`
AppliedPolicyVersion *int64 `db:"applied_policy_version"`
}
Install Fleet android agent on device enrollment. (#36050) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #35434 Feature is largely behind feature flag `FLEET_DEV_ANDROID_AGENT_PACKAGE` Set it like: `export FLEET_DEV_ANDROID_AGENT_PACKAGE=com.fleetdm.agent.private.victor` Rough set up: 1. Change the applicationId of your Android app in `build.gradle.kts`: ```kt defaultConfig { applicationId = "com.fleetdm.agent.private.you" ``` 2. Build a release version of your app (use dummy signing key). Build -> Generate Signed App Bundle or APK ... 3. Get the super secret Google Play URL like: `go run tools/android/android.go --command enterprises.webTokens.create --enterprise_id 'XXXX'` 4. Upload your signed app. 5. Wait ~10 minutes 6. Enroll your Android device. 7. The agent should start installing pretty soon. Check your Google Play in Work profile. Mine was pending for a while the last time I tried it and I restarted the device before it actually started installing. @ksykulev you can use this Android service method for "notification": `AddFleetAgentToAndroidPolicy(ctx context.Context, enterpriseName string, hostConfigs map[string]AgentManagedConfiguration) error` You'll need to update `AgentManagedConfiguration` struct to define what to send down to the device. It includes the enroll secret, so I think we need to send it down every time just to be safe. # Checklist for submitter - Changes file will be updated when full feature is done. ## Testing - [x] QA'd all new/changed functionality manually
2025-11-21 20:42:24 +00:00
type AgentManagedConfiguration struct {
ServerURL string `json:"server_url"`
HostUUID string `json:"host_uuid"`
EnrollSecret string `json:"enroll_secret"`
Sync app with server vars, fix retry logic (#36923) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36591 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added automatic retry mechanism for failed certificate installations with up to 3 retry attempts. * Enhanced certificate installation status tracking and visibility. * **Bug Fixes** * Improved error handling and detailed error reporting for certificate enrollment failures. * **Tests** * Added comprehensive test coverage for certificate enrollment and status tracking workflows. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
2025-12-10 23:50:38 +00:00
CertificateTemplateIDs []AgentCertificateTemplate `json:"certificate_templates,omitempty"`
}
type AgentCertificateTemplate struct {
ID uint `json:"id"`
Status string `json:"status"`
Operation string `json:"operation"`
UUID string `json:"uuid"`
Install Fleet android agent on device enrollment. (#36050) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #35434 Feature is largely behind feature flag `FLEET_DEV_ANDROID_AGENT_PACKAGE` Set it like: `export FLEET_DEV_ANDROID_AGENT_PACKAGE=com.fleetdm.agent.private.victor` Rough set up: 1. Change the applicationId of your Android app in `build.gradle.kts`: ```kt defaultConfig { applicationId = "com.fleetdm.agent.private.you" ``` 2. Build a release version of your app (use dummy signing key). Build -> Generate Signed App Bundle or APK ... 3. Get the super secret Google Play URL like: `go run tools/android/android.go --command enterprises.webTokens.create --enterprise_id 'XXXX'` 4. Upload your signed app. 5. Wait ~10 minutes 6. Enroll your Android device. 7. The agent should start installing pretty soon. Check your Google Play in Work profile. Mine was pending for a while the last time I tried it and I restarted the device before it actually started installing. @ksykulev you can use this Android service method for "notification": `AddFleetAgentToAndroidPolicy(ctx context.Context, enterpriseName string, hostConfigs map[string]AgentManagedConfiguration) error` You'll need to update `AgentManagedConfiguration` struct to define what to send down to the device. It includes the enroll secret, so I think we need to send it down every time just to be safe. # Checklist for submitter - Changes file will be updated when full feature is done. ## Testing - [x] QA'd all new/changed functionality manually
2025-11-21 20:42:24 +00:00
}
// MDMAndroidPolicyRequest represents a request made to the Android Management
// API (AMAPI) to patch the policy or the device (as made by
// androidsvc.ReconcileProfiles).
type MDMAndroidPolicyRequest struct {
RequestUUID string `db:"request_uuid"`
RequestName string `db:"request_name"`
PolicyID string `db:"policy_id"`
Payload []byte `db:"payload"`
StatusCode int `db:"status_code"`
ErrorDetails sql.Null[string] `db:"error_details"`
AppliedPolicyVersion sql.Null[int64] `db:"applied_policy_version"`
PolicyVersion sql.Null[int64] `db:"policy_version"`
}
const AppStatusAvailable = "AVAILABLE"