mirror of
https://github.com/fleetdm/fleet
synced 2026-05-14 20:48:35 +00:00
ff0ba413b7
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #34389 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`).
95 lines
3.5 KiB
JavaScript
Vendored
95 lines
3.5 KiB
JavaScript
Vendored
module.exports = {
|
|
|
|
|
|
friendlyName: 'Modify android enterprise policy applications',
|
|
|
|
|
|
description: 'Modifies applications in an Android enterprise policy',
|
|
|
|
|
|
inputs: {
|
|
androidEnterpriseId: {
|
|
type: 'string',
|
|
required: true,
|
|
},
|
|
policyId: {
|
|
type: 'string',
|
|
required: true,
|
|
},
|
|
},
|
|
|
|
|
|
exits: {
|
|
success: { description: 'The policy applications of an Android enterprise was successfully updated.' },
|
|
missingAuthHeader: { description: 'This request was missing an authorization header.', responseType: 'unauthorized'},
|
|
unauthorized: { description: 'Invalid authentication token.', responseType: 'unauthorized'},
|
|
notFound: { description: 'No Android enterprise found for this Fleet server.', responseType: 'notFound'},
|
|
},
|
|
|
|
|
|
fn: async function ({ androidEnterpriseId, policyId}) {
|
|
|
|
// Extract fleetServerSecret from the Authorization header
|
|
let authHeader = this.req.get('authorization');
|
|
let fleetServerSecret;
|
|
|
|
if (authHeader && authHeader.startsWith('Bearer')) {
|
|
fleetServerSecret = authHeader.replace('Bearer', '').trim();
|
|
} else {
|
|
throw 'missingAuthHeader';
|
|
}
|
|
|
|
// Authenticate this request
|
|
let thisAndroidEnterprise = await AndroidEnterprise.findOne({
|
|
androidEnterpriseId: androidEnterpriseId
|
|
});
|
|
|
|
// Return a 404 response if no records are found.
|
|
if (!thisAndroidEnterprise) {
|
|
throw 'notFound';
|
|
}
|
|
// Return an unauthorized response if the provided secret does not match.
|
|
if (thisAndroidEnterprise.fleetServerSecret !== fleetServerSecret) {
|
|
throw 'unauthorized';
|
|
}
|
|
|
|
// Check the list of Android Enterprises managed by Fleet to see if this Android Enterprise is still managed.
|
|
let isEnterpriseManagedByFleet = await sails.helpers.androidProxy.getIsEnterpriseManagedByFleet(androidEnterpriseId);
|
|
// Return a 404 response if this Android enterprise is no longer managed by Fleet.
|
|
if(!isEnterpriseManagedByFleet) {
|
|
throw 'notFound';
|
|
}
|
|
|
|
// Update the policy applications for this Android enterprise.
|
|
// Note: We're using sails.helpers.flow.build here to handle any errors that occurr using google's node library.
|
|
let modifyApplicationPolicyResponse = await sails.helpers.flow.build(async () => {
|
|
let { google } = require('googleapis');
|
|
let androidmanagement = google.androidmanagement('v1');
|
|
let googleAuth = new google.auth.GoogleAuth({
|
|
scopes: ['https://www.googleapis.com/auth/androidmanagement'],
|
|
credentials: {
|
|
client_email: sails.config.custom.androidEnterpriseServiceAccountEmailAddress,// eslint-disable-line camelcase
|
|
private_key: sails.config.custom.androidEnterpriseServiceAccountPrivateKey,// eslint-disable-line camelcase
|
|
},
|
|
});
|
|
// Acquire the google auth client, and bind it to all future calls
|
|
let authClient = await googleAuth.getClient();
|
|
google.options({ auth: authClient });
|
|
|
|
let patchPoliciesResponse = await androidmanagement.enterprises.policies.modifyPolicyApplications({
|
|
name: `enterprises/${androidEnterpriseId}/policies/${policyId}`,
|
|
requestBody: this.req.body,
|
|
});
|
|
return patchPoliciesResponse.data;
|
|
}).intercept((err) => {
|
|
return new Error(`When attempting to update applications for a policy of Android enterprise (${androidEnterpriseId}), an error occurred. Error: ${err}`);
|
|
});
|
|
|
|
|
|
// Return the modified policy back to the Fleet server.
|
|
return modifyApplicationPolicyResponse;
|
|
|
|
}
|
|
|
|
|
|
};
|