mirror of
https://github.com/fleetdm/fleet
synced 2026-05-18 22:49:19 +00:00
9360128942
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #26879 We decided to opt for a sticky enrollment approach, and I opted for using redis, so this PR also adds a redis key value store to the free service to use. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Bug Fixes - Prevents Orbit enrollment from undoing team transfers triggered during MDM enrollment, preserving the correct team assignment on re-enrollment. - Introduces a temporary “sticky” enrollment period (~30 minutes) during Apple MDM check-in and Orbit enrollment to reduce unintended team changes. - Improves reliability of team-scoped enroll secrets and host transfers in short re-enrollment windows. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
87 lines
2.6 KiB
Go
87 lines
2.6 KiB
Go
//go:build !windows
|
|
|
|
// Windows is disabled because the TPM simulator requires CGO, which causes lint failures on Windows.
|
|
|
|
package hostidentity
|
|
|
|
import (
|
|
"os"
|
|
"testing"
|
|
|
|
"github.com/fleetdm/fleet/v4/server/config"
|
|
"github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/fleetdm/fleet/v4/server/service"
|
|
"github.com/fleetdm/fleet/v4/server/service/integrationtest"
|
|
"github.com/go-kit/kit/log"
|
|
kitlog "github.com/go-kit/log"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// enrollOrbitResponse is the response structure for orbit enrollment
|
|
type enrollOrbitResponse struct {
|
|
OrbitNodeKey string `json:"orbit_node_key,omitempty"`
|
|
Err error `json:"error,omitempty"`
|
|
}
|
|
|
|
// orbitConfigRequest is used for orbit config endpoint requests
|
|
type orbitConfigRequest struct {
|
|
OrbitNodeKey string `json:"orbit_node_key"`
|
|
}
|
|
|
|
// osqueryConfigRequest is used for osquery config endpoint requests
|
|
type osqueryConfigRequest struct {
|
|
NodeKey string `json:"node_key"`
|
|
}
|
|
|
|
type Suite struct {
|
|
integrationtest.BaseSuite
|
|
}
|
|
|
|
func SetUpSuite(t *testing.T, uniqueTestName string, requireSignature bool) *Suite {
|
|
return SetUpSuiteWithConfig(t, uniqueTestName, requireSignature, nil)
|
|
}
|
|
|
|
func SetUpSuiteWithConfig(t *testing.T, uniqueTestName string, requireSignature bool, configModifier func(cfg *config.FleetConfig)) *Suite {
|
|
// Note: t.Parallel() is called when MySQL datastore options are processed
|
|
license := &fleet.LicenseInfo{
|
|
Tier: fleet.TierPremium,
|
|
}
|
|
ds, fleetCfg, fleetSvc, ctx := integrationtest.SetUpMySQLAndService(t, uniqueTestName, &service.TestServerOpts{
|
|
License: license,
|
|
Pool: redistest.SetupRedis(t, t.Name(), false, false, false),
|
|
})
|
|
|
|
// Apply config modifications
|
|
if configModifier != nil {
|
|
configModifier(&fleetCfg)
|
|
}
|
|
|
|
logger := log.NewLogfmtLogger(os.Stdout)
|
|
hostIdentitySCEPDepot, err := ds.NewHostIdentitySCEPDepot(kitlog.With(logger, "component", "host-id-scep-depot"), &fleetCfg)
|
|
require.NoError(t, err)
|
|
users, server := service.RunServerForTestsWithServiceWithDS(t, ctx, ds, fleetSvc, &service.TestServerOpts{
|
|
License: license,
|
|
FleetConfig: &fleetCfg,
|
|
Logger: logger,
|
|
HostIdentity: &service.HostIdentity{
|
|
SCEPStorage: hostIdentitySCEPDepot,
|
|
RequireHTTPMessageSignature: requireSignature,
|
|
},
|
|
})
|
|
|
|
s := &Suite{
|
|
BaseSuite: integrationtest.BaseSuite{
|
|
Logger: logger,
|
|
DS: ds,
|
|
FleetCfg: fleetCfg,
|
|
Users: users,
|
|
Server: server,
|
|
},
|
|
}
|
|
|
|
integrationtest.SetUpServerURL(t, ds, server)
|
|
|
|
s.BaseSuite.Token = s.BaseSuite.GetTestAdminToken(t)
|
|
return s
|
|
}
|