Documentation
¶
Overview ¶
Package proxyclient forwards MDM declarative check-ins to a separately deployed declaration engine.
Design ¶
The service.DMHandler forwards original plist bytes, applies configured request signing and response verification, and bounds response size and time. Device-facing 200, empty status responses and declaration 404 responses are preserved. Transport, authentication and upstream server failures become internal service errors rather than declaration-removal responses. URL joining preserves a configured path prefix.
Callers configure authentication and transport protection. The reference server requires both request and response HMAC keys for the split hop.
References ¶
- Decision record 0023: https://github.com/deploymenttheory/go-apple-dm/blob/main/docs/research/decisions/0023-ddm-adapters-and-wire-contract.md
- Decision record 0025: https://github.com/deploymenttheory/go-apple-dm/blob/main/docs/research/decisions/0025-reference-server-roles-and-container.md
- Threat model: https://github.com/deploymenttheory/go-apple-dm/blob/main/docs/security/threat-model.md (private DDM proxy)
- E2E scenarios: https://github.com/deploymenttheory/go-apple-dm/blob/main/docs/testing/e2e-scenarios.md (E2E-010)
- Apple: https://developer.apple.com/documentation/devicemanagement/declarativemanagementrequest
Index ¶
Constants ¶
View Source
const DefaultTimeout = 30 * time.Second
DefaultTimeout bounds one forwarded check-in.
Variables ¶
View Source
var ( // ErrUpstream wraps every failure of the ddm role or the network. ErrUpstream = errors.New("proxyclient: upstream failure") // ErrBadURL is returned by Handler for an empty or unusable URL. ErrBadURL = errors.New("proxyclient: invalid URL") )
Errors.
Functions ¶
Types ¶
type Config ¶
type Config struct {
// AllowInsecureForTests permits HTTP only to a literal loopback address.
AllowInsecureForTests bool
// URL is the base URL of the ddm role; proxywire.Path is appended.
URL string
// Client defaults to an http.Client with DefaultTimeout. Set TLS
// client certificates on its transport for mutual TLS.
Client *http.Client
// Timeout bounds each request through its context; default
// DefaultTimeout.
Timeout time.Duration
// SendKey signs every request; RecvKey verifies every response.
SendKey, RecvKey []byte
// MaxBody bounds the response body; default proxywire.DefaultMaxBody.
MaxBody int64
// Auth, when set, adds headers to every request (a bearer token, for
// example).
Auth func(*http.Request)
}
Config builds a Handler.
Source Files
Click to show internal directories.
Click to hide internal directories.