mirror of
https://github.com/fleetdm/fleet
synced 2026-05-18 22:49:19 +00:00
292c23497f
Related to: https://github.com/fleetdm/fleet/issues/33266 Changes: - Added a new helper `sails.helpers.androidProxy.getIsEnterpriseManagedByFleet`. This helper returns `true` if a provided Android Enterprise ID is present in the list of all Android Enterprises managed by Fleet, or `false` if it is not in the list. - Updated `create-android-enrollment-token`, `create-android-signup-url`, and `modify-android-policies` to return a 404 response to the requesting Fleet instance if their Android Enterprise is not managed by Fleet.
85 lines
2.9 KiB
JavaScript
Vendored
85 lines
2.9 KiB
JavaScript
Vendored
module.exports = {
|
|
|
|
|
|
friendlyName: 'Create android enrollment token',
|
|
|
|
|
|
description: 'Creates and returns an enrollment token for an Android enterprise',
|
|
|
|
|
|
inputs: {
|
|
androidEnterpriseId: {
|
|
type: 'string',
|
|
required: true,
|
|
},
|
|
},
|
|
|
|
|
|
exits: {
|
|
|
|
},
|
|
|
|
|
|
fn: async function ({androidEnterpriseId}) {
|
|
// Extract fleetServerSecret from the Authorization header
|
|
let authHeader = this.req.get('authorization');
|
|
let fleetServerSecret;
|
|
|
|
if (authHeader && authHeader.startsWith('Bearer')) {
|
|
fleetServerSecret = authHeader.replace('Bearer', '').trim();
|
|
} else {
|
|
return this.res.unauthorized('Authorization header with Bearer token is required');
|
|
}
|
|
|
|
// Authenticate this request
|
|
let thisAndroidEnterprise = await AndroidEnterprise.findOne({
|
|
androidEnterpriseId: androidEnterpriseId,
|
|
});
|
|
|
|
// Return a 404 response if no records are found.
|
|
if(!thisAndroidEnterprise) {
|
|
return this.res.notFound();
|
|
}
|
|
|
|
// Return an unauthorized response if the provided secret does not match.
|
|
if(thisAndroidEnterprise.fleetServerSecret !== fleetServerSecret) {
|
|
return this.res.unauthorized();
|
|
}
|
|
|
|
// Check the list of Android Enterprises managed by Fleet to see if this Android Enterprise is still managed.
|
|
let isEnterpriseManagedByFleet = await sails.helpers.androidProxy.getIsEnterpriseManagedByFleet(androidEnterpriseId);
|
|
// Return a 404 response if this Android enterprise is no longer managed by Fleet.
|
|
if(!isEnterpriseManagedByFleet) {
|
|
return this.res.notFound();
|
|
}
|
|
|
|
let newEnrollmentToken = await sails.helpers.flow.build(async ()=>{
|
|
let { google } = require('googleapis');
|
|
let androidmanagement = google.androidmanagement('v1');
|
|
let googleAuth = new google.auth.GoogleAuth({
|
|
scopes: ['https://www.googleapis.com/auth/androidmanagement'],
|
|
credentials: {
|
|
client_email: sails.config.custom.androidEnterpriseServiceAccountEmailAddress,// eslint-disable-line camelcase
|
|
private_key: sails.config.custom.androidEnterpriseServiceAccountPrivateKey,// eslint-disable-line camelcase
|
|
},
|
|
});
|
|
// Acquire the google auth client, and bind it to all future calls
|
|
let authClient = await googleAuth.getClient();
|
|
google.options({auth: authClient});
|
|
// [?]: https://googleapis.dev/nodejs/googleapis/latest/androidmanagement/classes/Resource$Enterprises$Enrollmenttokens.html#create
|
|
let enrollmentTokenCreateResponse = await androidmanagement.enterprises.enrollmentTokens.create({
|
|
parent: `enterprises/${androidEnterpriseId}`,
|
|
requestBody: this.req.body,
|
|
});
|
|
return enrollmentTokenCreateResponse.data;
|
|
}).intercept((err)=>{
|
|
return new Error(`When attempting to create an enrollment token for an Android enterprise (${androidEnterpriseId}), an error occurred. Error: ${err}`);
|
|
});
|
|
|
|
|
|
return newEnrollmentToken;
|
|
|
|
}
|
|
|
|
|
|
};
|