Documentation
¶
Overview ¶
Package security implements a client for the Jamf Security Cloud APIs (Risk, Device Lifecycle, and Shared Signals & Events). Unlike Jamf Pro/Protect/Platform, Security Cloud has no product Go SDK and uses its own auth model: a Basic-auth login exchange (POST /v1/login with base64(clientId:clientSecret)) returns a short-lived (15 minute) JWT bearer token — not an OAuth2 client-credentials grant. Critically, each of the three APIs is provisioned as its own "Security Integration" in the Radar portal with its own application ID/secret pair, and the resulting JWT is scoped to exactly one API via its `aud` claim (RISK_API, DEVICE_LIFECYCLE_API, ...) — a Risk credential cannot mint a token that Device Lifecycle or SSE will accept. So this client tracks three independent credential pairs and token caches, one per scope, any subset of which may be configured. The Risk and Device Lifecycle APIs share one host (api.wandera.com, which also serves /v1/login); Shared Signals & Events lives on a separate host (sse.jamf.com) per its own OpenID SSE framework discovery document.
Index ¶
- Constants
- func ConfirmAction(action, target string, yes bool) error
- func ReadBody(file string, sets []string) (any, error)
- type Client
- func (c *Client) DoExpectLifecycle(ctx context.Context, method, path string, body any, result any) error
- func (c *Client) DoExpectRisk(ctx context.Context, method, path string, body any, result any) error
- func (c *Client) DoExpectSSE(ctx context.Context, method, path string, body any, result any) error
- func (c *Client) HasLifecycleCredentials() bool
- func (c *Client) HasRiskCredentials() bool
- func (c *Client) HasSSECredentials() bool
- func (c *Client) LifecycleCustomerID(ctx context.Context) (string, error)
- type Option
- func WithAPIBaseURL(url string) Option
- func WithHTTPClient(c *http.Client) Option
- func WithLifecycleCredentials(clientID, clientSecret string) Option
- func WithRiskCredentials(clientID, clientSecret string) Option
- func WithSSEBaseURL(url string) Option
- func WithSSECredentials(clientID, clientSecret string) Option
- func WithUserAgent(ua string) Option
Constants ¶
const ( // DefaultAPIBaseURL is the shared production host for the Risk and Device // Lifecycle APIs, and for the /v1/login token exchange used by all three. DefaultAPIBaseURL = "https://api.wandera.com" // DefaultSSEBaseURL is the production host for the Shared Signals & Events API. DefaultSSEBaseURL = "https://sse.jamf.com" )
Variables ¶
This section is empty.
Functions ¶
func ConfirmAction ¶
ConfirmAction prompts the user to confirm a destructive action. Returns nil on confirmation, an error otherwise. When stdin is not a terminal (e.g. CI), requires the --yes flag (yes==true) and returns an error if it isn't set.
Generated security commands call this for destructive actions (purge, delete) before performing the request.
func ReadBody ¶
ReadBody assembles a JSON-marshallable request body from --file (JSON file path) and --set overrides ("key=value", "nested.key=value"). When file is empty an empty object is the starting point. Set values are JSON-decoded when they look like JSON (true/false/null/number/[]/{}/"...") and treated as strings otherwise. Dot-separated keys descend into nested maps.
Generated security commands call this for PUT/POST bodies. Returns nil when there's nothing to send (no file, no overrides) so callers can decide whether the op accepts an empty body or should error.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client is an authenticated HTTP client for the Jamf Security Cloud APIs.
func NewClient ¶
NewClient creates a Client. Any of the three scopes' credentials may be left unconfigured via the With*Credentials options; login is deferred until the first request for that scope, so construction never makes a network call.
func (*Client) DoExpectLifecycle ¶
func (c *Client) DoExpectLifecycle(ctx context.Context, method, path string, body any, result any) error
DoExpectLifecycle performs an authenticated JSON request against the Device Lifecycle API.
func (*Client) DoExpectRisk ¶
DoExpectRisk performs an authenticated JSON request against the Risk API. body is marshalled to JSON when non-nil; result is unmarshalled from the response body when both result and the body are non-nil/non-empty.
Unlike jamfplatform-go-sdk's Transport.DoExpect, there's no single expected-status parameter: the three Security Cloud APIs are inconsistent about success codes (the SSE stream/status "set" endpoints document both 200 and 202 as success), so any response do() didn't already reject (HTTP >= 400) is treated as success here — do() still surfaces the usual structured 401/403/404/429 errors.
func (*Client) DoExpectSSE ¶
DoExpectSSE performs an authenticated JSON request against the Shared Signals & Events API.
func (*Client) HasLifecycleCredentials ¶
HasLifecycleCredentials reports whether Device Lifecycle API credentials were configured.
func (*Client) HasRiskCredentials ¶
HasRiskCredentials reports whether Risk API credentials were configured.
func (*Client) HasSSECredentials ¶
HasSSECredentials reports whether Shared Signals & Events credentials were configured.
func (*Client) LifecycleCustomerID ¶
LifecycleCustomerID returns the Jamf Security Cloud customer/account identifier embedded in the Device Lifecycle JWT, logging in first if needed. Used to fill the {customerId} path parameter on Device Lifecycle endpoints without requiring the caller to supply it separately.
type Option ¶
type Option func(*Client)
Option configures a Client.
func WithAPIBaseURL ¶
WithAPIBaseURL overrides the Risk/Device Lifecycle/login host.
func WithHTTPClient ¶
WithHTTPClient overrides the underlying *http.Client (default: http.DefaultClient).
func WithLifecycleCredentials ¶
WithLifecycleCredentials configures the Device Lifecycle API application ID/secret.
func WithRiskCredentials ¶
WithRiskCredentials configures the Risk API application ID/secret. Omit (or pass empty strings) to leave the Risk API unconfigured — Risk calls then fail with a clear "not configured" error instead of a login failure.
func WithSSEBaseURL ¶
WithSSEBaseURL overrides the Shared Signals & Events host.
func WithSSECredentials ¶
WithSSECredentials configures the Shared Signals & Events application ID/secret.
func WithUserAgent ¶
WithUserAgent sets the User-Agent header sent with every request.
Source Files