* Add audit events for approving & denying an `EnrollPairing`
* Add web changes
* Drop `device.enroll_pairing.approve` from `eventGroupTypes`
* "not approved" -> "denied"
* Update wording around `device.enroll_pairing.approve` emitted on failure
While working on the RPC handler implementation, I realized that
`TV011W` is not emitted on MFA failures. This commit updates the godoc
and the fixture accordingly.
* Update `deny` audit event wording around expiry
In a typical scenario there will be no one to observe expiry, so this
event won't be emitted on enroll pairing expiry. I'll update the RFD
accordingly soon. For now just putting this here since I have no other
outstanding OSS PRs.
* Remove no longer necessary TODO comment
"Retryability" will be implemented one level above the storage layer, in
the RPC handler, so the comment here is no longer necessary.
* Remove `error` field from `device.enroll_pairing.deny`
Now that it's only going to be used for an explicit user denial, there's
no need to carry the `error` field.
* Add audit events for CreatePairedDeviceEnrollToken
* Add Web UI formatter for new audit events
* Update audit events reference
* Use `OSType` from generated protos
* Deprecate `TrustedDeviceOSType` in favor of `TrustedDevice['osType']`
This is because in another commit we're going to introduce `OsType`
which mirrors the teleport.devicetrust.v1.OSType proto enum and has
numeric values as member values.
`TrustedDevice['osType']` is `OSType` converted into a string on the API
layer.
* Add type imports
* Atomically create index by token for `EnrollPairing`
* Add methods for getting enroll pairing by token and requesting approval
* Use table tests
* Validate enroll pairing device if it's not nil
* Use `indexItem.key` instead of hashing the token again
* Add messages to `trace.Wrap`
* Use const for error message
* Add TODO comment about making the call retryable
* Use smaller scope
* Add `mobile_device` kind for `mobile_device.create_enroll_token` permission
* Update preset-roles.json
* Add `mobile_device.create_enroll_token` to user ACL
* Make boombuler/barcode a direct dep
It's used in teleport.e to generate the QR code that's going to be
consumed by the mobile app.
* Enable defaultAllowRules to return roles which need `buildType`
* Backfill device-admin role
* Add `mobile_device.create_enroll_token` to admin role
* Add RPCs for creating and getting EnrollPairing
* Add storage service for EnrollPairing
* `AWAITING_UNAUTHORIZED_CLIENT` -> `AWAITING_DEVICE`
* Mention RFD 32e in the comment for EnrollPairing message
* Use generic service to implement service for `EnrollPairing`
* Remove fake clock from tests
* Use a want object in tests
* Use `ErrorAs` for error-type assertions
* Add workaround for DynamoDB issue
* Capture just clock as a field
* Do not set PageLimit
* Copy fields to `want` rather than adding ignores
* Log and ignore error from GetResource on CreateEnrollPairing
* Update the workaround comment to refer to #68038
* Fix imports
* Add `TestLoginShell` to avoid lib/web tests polluting shell history
* Use `go:embed` to avoid problems with cwd
* Add regression test to make sure `noHistoryShell` works
* Remove unnecessary comment
* Generate Xcode project for Verify
* Set Swift version to 6; remove macOS and Vision as destinations
* Handle `teleport://` links and add enrollment screen
* Avoid building macOS-specific stuff on iOS
This is needed for gomobile to build our stuff from lib/mobile from the
next commit.
* Add `lib/mobile/verify/enroll` compiled with gomobile
* `lib/mobile`: Temporarily use private Device Trust service
The public gRPC service exists on the demo branch but not on this
branch. In order to make it possible to compile
`lib/mobile/verify/enroll`, temporarily use the private service which
has similar RPCs.
* Run `make go-mod-tidy-all`
* Make Swift app connect to public DT service on "Request Now" tap
* mobile: Add sheet for enroll request status
* Revert go.mod changes
This reverts commit b9af7a7614 and
2c00ecd7fa.
* Add `build.assets/tools/gomobile`
* Move gomobile back to main go.mod
This reverts commits 9b2a6c4ea3 and
a83c2959fa.
* Update Jamf docs with new conf fields and how to sync mobile devices
* Mention in Jamf docs how to update the plugin
* Mention iOS and iPadOS devices in Intune docs
* Mention that "Read Mobile Devices" is needed for mobile devices only
* Use subheadings rather than tabs
* Add an example serial number to docs/cspell.json
* Deprecate async state hooks
* Ban imports of async state hooks across packages
* Exempt legacy call sites from the ban
* Update RFD 197's number and state
* Add iOS and iPadOS as new OSType values
* lib/msgraph: Add `Model` field back to `ManagedDevice`
We need it to differentiate between iPhones and iPads in e/lib/intune.
* Add device_type to JamfInventoryEntry
* Use a separate block for computer types
* Add godoc and examples for `ManagedDevice.Model`
* Add os_types to SyncInventoryStart
* Make `VnetContext` tests depend on action order rather than no of calls
* Explain the idea behind acknowledgement/dismissal being "sticky"
* Update Jest mock outside of `act`
* Fix typo in T1014W (`headdless` -> `headless`)
* Use snapshot tests in gen-event-reference.test.ts
* audit-events.mdx: Update instructions on how to regenerate file
* Improve look of ReAuthenticate in Connect
* Display `<Text>` for reason only if reason is present.
* Drop "from trusted cluster" being appended to reason. This will be
moved to api/mfa/prompt.go.
* Center text for browsermfa and sso so it matches webauthn.
* Consistent comma at the end of text for each method.
* Add leaf cluster name to prompt reason for MFA
* Fix resource type casing in MFA prompt
* Assert MFA prompt in tests
* Extract gRPC proxy func to separate package
* Use debug logs for err on `stream.Recv()`
* Add regression test for treating server response as authoritative
The current buggy code path: `forwardServerToClient` returns nil on
server trailer, main waits on `<-errCh`, `forwardClientToServer` is
parked in `client.Recv()` until either the connection is torn down
(hang) or the client happens to send another message whose `server.Send`
fails on the half-closed upstream (reshape: server's nil becomes a
proxy-side error).
* Treat server response as authoritative & propagate client-side errors
* Migrate tests to use a custom gRPC service
* Test if errs from client.Recv and server.Send are surfaced
* Fix flaky `TestProxyBidiStream_ReturnsEOFWhenServerReturnsEarly`
* Don't set `clientErrCh` to `nil`
* Use existing gRPC service instead of special one for tests
* Forward header and trailer to client; use bufconn in tests
Co-authored-by: Tiago Silva <[email protected]>
---------
Co-authored-by: Tiago Silva <[email protected]>
* Add regression test
* Add regression test for waiting for correctly waiting for upstream
* Fix ReportSecrets hanging on upstream error
* Replace `context.AfterFunc` with `defer`
Maja Cieślak