app

type ACMEConfig struct {
	// MacHardware resolves trusted inventory capabilities. Unknown leaves initial
	// profile flags explicit; secondary credentials use software keys until known.
	// T2 supports hardware keys, but only Apple silicon supports attestation.
	MacHardware func(context.Context, acme.Binding) (enroll.MacHardware, error)
	// Policy is which devices may enroll: ACMEPolicyAny, ACMEPolicyDEP, or
	// ACMEPolicySIP. Empty means ACMEPolicyAny.
	Policy string
	// AllowUnattested issues on the client identifier alone to a device
	// that produced no attestation. Off by default.
	AllowUnattested bool
	// KeyType and KeySize are what the profile asks the device to generate.
	// Empty means an attestable elliptic curve key of 384 bits.
	KeyType string
	KeySize int64
	// HMACKey mints client identifiers. Empty falls back to the SCEP HMAC
	// key, and then to a key generated at startup, which is fine for one
	// process and wrong for several.
	HMACKey []byte
	// IdentifierTTL is how long a client identifier in a profile stays
	// usable. It has to cover the gap between handing a device its profile
	// and the device acting on it.
	IdentifierTTL time.Duration
	// AnchorFile is a PEM bundle of attestation anchors, for a lab with a
	// simulated device. Empty trusts Apple alone.
	AnchorFile string
	// Anchors is the parsed AnchorFile; tests set it directly.
	Anchors []*x509.Certificate
	// Store overrides the ACME store; default follows the storage backend.
	Store acme.Store
	// NonceTTL and OrderTTL default to the acme package's values.
	NonceTTL, OrderTTL time.Duration
}

type AccountAdmissionRule struct {
	Issuer              string   `json:"issuer"`
	Subject             string   `json:"subject"`
	Email               string   `json:"email"`
	ManagedAppleAccount string   `json:"managedAppleAccount"`
	Groups              []string `json:"groups"`
}

type AdmissionGrant struct {
	Account   string           `json:"account,omitempty"`
	ExpiresAt time.Time        `json:"expiresAt"`
	Identity  AdmissionRequest `json:"identity"`
	Mode      string           `json:"mode"`
}

type AdmissionPolicy struct {
	Devices     []DeviceAdmissionRule  `json:"devices"`
	DEPAccounts []string               `json:"depAccounts"`
	Accounts    []AccountAdmissionRule `json:"accounts"`
}

type AdmissionRequest struct {
	Serial        string   `json:"serial,omitempty"`
	UDID          string   `json:"udid,omitempty"`
	Issuer        string   `json:"issuer,omitempty"`
	Subject       string   `json:"subject,omitempty"`
	Email         string   `json:"email,omitempty"`
	EmailVerified bool     `json:"emailVerified,omitempty"`
	Groups        []string `json:"groups,omitempty"`
}

type App struct {
	Certificates *lifecycle.Manager

	Handler  http.Handler
	Core     *service.Core
	Engine   *ddm.Engine
	Notifier *ddmsync.Notifier
	Store    storage.Store

	// AxM is the Business Manager client when configured.
	AxM *axm.Client
	// DEP is the device enrollment service; nil on the mdm role.
	DEP *dep.Client
	// Push wakes devices; nil when no push source is configured.
	Push *pushnotify.Notifier
	// contains filtered or unexported fields
}

type AppPushConfig struct{ DevelopmentHost, ProductionHost, RootCAFile string }

type AxMConfig struct {
	ClientID string
	KeyID    string
	// KeyFile is the PEM private key downloaded from the portal; KeyPEM is
	// its content (tests set it directly).
	KeyFile string
	KeyPEM  []byte
	// Scope, BaseURL, and TokenURL override the defaults derived from the
	// client id (tests point them at a fake).
	Scope, BaseURL, TokenURL string
	HTTPClient               *http.Client
	// RootCAFile supplies private HTTPS trust instead of HTTPClient.
	RootCAFile string
}

type Config struct {
	Setup *SetupConfig

	PKI                     PKIConfig
	RateLimits              RateLimitConfig
	Role                    Role
	TLSCertFile, TLSKeyFile string
	Listen                  string
	Storage                 string // sqlite, postgres, mysql, inmem
	DSN                     string // file path for sqlite
	// DDMURL, on the mdm role, forwards DeclarativeManagement check-ins to
	// a ddm role through proxyclient; empty means the local engine.
	DDMURL string
	// DDMRootCAFile configures HTTPS trust for the private DDM server.
	DDMRootCAFile string
	// DDMAllowInsecureForTests enables loopback-only cleartext adapters.
	DDMAllowInsecureForTests bool
	// DDMSendKey signs what this role sends across the hop; DDMRecvKey
	// verifies what it receives.
	DDMSendKey, DDMRecvKey []byte
	// AllowReenroll accepts Authenticate with a different certificate and replaces
	// the enrollment pin. The library defaults to allowing this; the reference
	// server defaults to DenyReenroll.
	//
	// Enable only with appropriate enrollment admission. CA trust alone does not
	// bind a certificate to an enrollment identifier; account-driven issuance
	// associations provide an additional binding for those sessions.
	AllowReenroll bool
	// StorageKeys names the keys that seal the secret columns of a persistent
	// store: unlock tokens, bootstrap tokens, APNs push keys and user auth
	// tokens. The first is the active key every write seals under, and the
	// rest are retired keys reads still accept, so a rotation is a prepended
	// name followed by Rewrap.
	//
	// Without a keyring those columns are written in clear, and a stolen
	// backup, replica or volume yields the push key, which wakes and
	// impersonates the whole fleet. A persistent store therefore requires one.
	StorageKeys []string
	// StorageKeysStrict refuses to read a secret column that is not sealed.
	// It belongs on once Rewrap has run everywhere; before that it would
	// reject rows written before the keyring existed.
	StorageKeysStrict bool
	// SecretsDir resolves StorageKeys from files in one directory, the shape
	// Docker and Kubernetes secret mounts take. Empty reads them from the
	// environment as DM_STORAGE_KEY_<NAME>.
	SecretsDir string
	// Secrets overrides both, for tests and embedding.
	Secrets secrets.Provider
	// AdminToken enables the admin API on the ddm and all roles with a single
	// static credential that authenticates as root and bypasses policy.
	//
	// Alongside a principal store it is the break-glass credential, and it
	// keeps working rather than being superseded: an empty principal store
	// authenticates nobody, and the route that creates the first principal is
	// itself authorized, so without it there is no way in. Its use is audited
	// under the actor "break-glass" and logged at warn on every request.
	//
	// It has no expiry and cannot be revoked without restarting the process.
	// While it is set, every least-privilege property record 0034 claims is
	// void for whoever holds it, so a deployment sets it to create real
	// principals and then unsets it. An audit record with the actor
	// "break-glass" after that point is an incident. See
	// docs/operations/deployment.md.
	AdminToken string
	// AdminStore holds admin principals and Cedar policies. When set, an admin
	// request that does not present AdminToken is authenticated against it and
	// authorized by policy (decision record 0034). Injecting a store here
	// overrides AdminStoreEnabled, which is how tests supply a fake.
	AdminStore adminauth.Store
	// AdminStoreEnabled opens the principal and policy store on the process's
	// own database, so principals work in the shipped binary rather than only
	// where a caller injects AdminStore. Off by default: turning it on mounts
	// the admin API, which is a security change rather than a convenience.
	AdminStoreEnabled bool
	// CAFile is a PEM bundle of roots that device identities chain to;
	// the mdm role then verifies Mdm-Signature on every check-in and
	// connect. CARoots is the parsed form (tests set it directly).
	CAFile  string
	CARoots *x509.CertPool
	// CertHeader names a header carrying the client certificate from a
	// TLS-terminating proxy (httpapi.CertFromHeader). Used when no CA is
	// configured. With neither, the certificate must come from TLS on
	// this process (httpapi.CertFromTLS).
	CertHeader string
	// TrustedProxies are socket peers allowed to assert client certificates and IPs.
	TrustedProxies []netip.Prefix
	// Subscriptions enables the synthesised status-subscriptions
	// declaration (decision record 0021).
	Subscriptions bool
	// Enroll turns the enrollment routes on (SCEP, discovery,
	// account-driven, ADE).
	Enroll EnrollConfig
	// AxM connects Apple Business Manager or Apple School Manager; its
	// admin routes live under the admin API on the ddm and all roles.
	AxM AxMConfig
	// DEP configures the device enrollment service client and worker;
	// its admin routes live under the admin API too.
	DEP DEPConfig
	// Push selects where APNs credentials come from. With no source the
	// server queues commands and never wakes a device.
	AppPush AppPushConfig
	Push    PushConfig
	Logger  *slog.Logger
	Clock   clock.Clock
	// Bus carries the typed events every state change publishes. When nil,
	// Build creates one so the sinks below have something to subscribe to;
	// pass one to observe events from outside the process.
	Bus *event.Bus
	// Sinks configures what subscribes to the bus.
	Sinks SinkConfig
	// contains filtered or unexported fields
}

type DEPConfig struct {
	// BaseURL overrides https://mdmenrollment.apple.com (tests point it
	// at the fake service).
	BaseURL string
	// SyncInterval and AssignInterval drive the background worker;
	// zero disables it (the admin API can still sync and assign).
	SyncInterval, AssignInterval time.Duration
	// ProfileURL is the DEP profile url; default PublicURL + /enroll/ade.
	ProfileURL string
	// UsePUT sends PUT for profile assignment (simulators).
	UsePUT     bool
	HTTPClient *http.Client
	// RootCAFile supplies private HTTPS trust instead of HTTPClient.
	RootCAFile string
	// Store overrides the DEP store (embedders with their own backend,
	// tests with a failing one); default follows Storage.
	Store dep.Store
}

type DeviceAdmissionRule struct {
	Serial string `json:"serial"`
	UDID   string `json:"udid"`
}

type EnrollConfig struct {
	Admission                   EnrollmentAdmission
	AdmissionFile               string
	UserAuthHA1File             string
	OTAAnchorFile, OTAChallenge string
	// PublicURL is the https base devices reach (profiles, discovery,
	// redirects).
	PublicURL string
	// Topic is the APNs topic written into enrollment profiles.
	Topic string
	// CACertFile and CAKeyFile are the PEM files of the enrollment CA that
	// issues device identities through SCEP; both empty means a
	// self-signed CA is generated at start (development only) and logged.
	CACertFile, CAKeyFile string
	// TLSAnchorFile contains public CA certificates needed to trust the HTTPS
	// enrollment endpoints. Empty means publicly trusted HTTPS. It is independent
	// of the identity issuer and the incoming ADE/OTA signing anchors.
	TLSAnchorFile string
	// SCEPChallenge does not authorize reference-server certificate issuance.
	// SCEPHMACKey also supplies the fallback key for ACME client identifiers.
	SCEPChallenge     string
	SCEPHMACKey       []byte
	ProfileIdentifier string
	Organization      string
	// Discovery maps a model family to a discovery version, for example
	// Mac=mdm-adde,iPhone=mdm-byod. Families absent are rejected.
	Discovery map[discovery.ModelFamily]string
	// AccountDrivenMethod is apple-as-web (default) or apple-oauth2.
	AccountDrivenMethod string
	// OIDC is the identity provider behind the web view, the apple-as-web
	// page, and the apple-oauth2 sign-in. Unset leaves only the
	// token-based ADE lane.
	OIDC OIDCConfig
	// ADEAnchorFile is a PEM bundle of MachineInfo signing anchors; empty
	// uses Apple's. ADEAudit logs verification failures and continues.
	ADEAnchorFile string
	ADEAudit      bool
	// RequireUserAuth gates user channels on UserAuthenticate (0029).
	RequireUserAuth bool
	// ReturnToService allows a supervised Automated Device Enrollment device
	// that asks to erase itself and re-enrol. Off by default: the answer to a
	// return-to-service request erases a device, so it is not something a
	// server should agree to because nobody said otherwise (0045).
	ReturnToService bool
	// Identity is where an enrolled device's identity certificate comes
	// from: IdentitySCEP (the default) or IdentityACME. The ACME endpoints
	// are mounted either way, so a declarative credential can use them even
	// when enrollment profiles still carry SCEP.
	Identity string
	// ACME configures the ACME server and the identities it issues.
	ACME ACMEConfig
	// Anchors is the parsed ADEAnchorFile (tests set it directly).
	Anchors []*x509.Certificate
}

type EnrollmentAdmission func(context.Context, AdmissionRequest) (AdmissionGrant, error)

type EnrollmentProfileRequest struct {
	DeviceID     string              `json:"DeviceID"`
	Serial       string              `json:"Serial"`
	Product      string              `json:"Product"`
	OSVersion    string              `json:"OSVersion"`
	MacHardware  enroll.MacHardware  `json:"MacHardware"`
	Identity     string              `json:"Identity"`
	AccessRights enroll.AccessRights `json:"AccessRights"`
	Scope        string              `json:"Scope"`
}

type IssuerFiles struct {
	Certificate string `json:"certificate"`
	Key         string `json:"key"`
}

type OIDCConfig struct {
	RootCAFile                     string
	Issuer, ClientID, ClientSecret string
	// HTTPClient reaches the provider; tests point it at a fake.
	HTTPClient *http.Client
}

type PKIConfig struct {
	// Disabled explicitly opts out of issuer status enforcement.
	Disabled                    bool
	Enabled                     bool
	CRLTTL, CRLRefresh, OCSPTTL time.Duration
	// Retired holds old issuer keys while their issued certificates remain valid.
	Retired []IssuerFiles
}

type PushConfig struct {
	// Source is off, file, or store.
	Source string
	// CertFile and KeyFile are the PEM pair for the file source.
	CertFile, KeyFile string
	// Topic is the APNs topic for the file source. Empty derives it from the
	// certificate, which is what an operator should prefer: the topic lives
	// in the certificate's subject and typing it by hand is how it goes
	// wrong.
	Topic string
	// Host overrides the APNs endpoint, for the lab and for tests.
	Host       string
	RootCAFile string
	// Coalesce is the window repeated pushes collapse into; zero uses
	// DefaultPushCoalesce, negative disables coalescing.
	Coalesce time.Duration
	// CertTTL is how long a store-backed certificate is cached before its
	// version is rechecked.
	CertTTL time.Duration
	// Transport overrides the HTTP client per certificate, for tests.
	Transport func(tls.Certificate) *http.Client
	// Pusher overrides everything, for tests and for an embedder with its
	// own APNs path.
	Pusher push.Pusher
}

type RateLimitConfig struct {
	Routes     map[string]RouteQuota
	MaxEntries int
}

type Role string

type RouteQuota struct {
	Interval       time.Duration
	Burst          int
	GlobalInterval time.Duration
	GlobalBurst    int
}

type SetupConfig struct {
	HTTP01Listen    string `json:"http01Listen,omitempty"`
	Role            string `json:"role"`
	VendorID        string `json:"vendorId"`
	PushID          string `json:"pushId"`
	HTTPSID         string `json:"httpsId"`
	IssuerID        string `json:"issuerId"`
	HTTPSCAID       string `json:"httpsCaId,omitempty"`
	VendorURL       string `json:"vendorUrl,omitempty"`
	VendorTokenFile string `json:"vendorTokenFile,omitempty"`
}

type SetupFile struct {
	Version     int               `json:"version"`
	Environment map[string]string `json:"environment"`
	SecretFiles map[string]string `json:"secretFiles"`
	Setup       SetupConfig       `json:"setup"`
}

type SetupInitOptions struct {
	Directory, Role, Storage, DSN, PublicURL, Listen, Organization string
	StorageKeyFile, StorageKeyName                                 string
	HTTP01Listen                                                   string
	AdminTokenFile, IssuanceKeyFile, ACMEKeyFile                   string
	// AdditionalSecrets preserves deployment settings during an explicit import.
	// Values are written to protected files and referenced by environment name.
	AdditionalSecrets map[string][]byte
	StorageKeyAliases []string
}

type SetupRequest struct {
	Force      bool                         `json:"force,omitempty"`
	PublicACME *lifecycle.PublicACMEOptions `json:"publicAcme,omitempty"`
	lifecycle.Request
	Device        string `json:"device,omitempty"`
	Cursor        string `json:"cursor,omitempty"`
	Limit         int    `json:"limit,omitempty"`
	Revision      string `json:"revision,omitempty"`
	Certificate   []byte `json:"certificate,omitempty"`
	Key           []byte `json:"key,omitempty"`
	CSR           []byte `json:"csr,omitempty"`
	SignedRequest []byte `json:"signedRequest,omitempty"`
	Vendor        string `json:"vendor,omitempty"`
	Artifact      string `json:"artifact,omitempty"`
	ValidityDays  int    `json:"validityDays,omitempty"`
}

type SetupResult struct {
	History    []lifecycle.Activity  `json:"history,omitempty"`
	Rollover   *lifecycle.Rollover   `json:"rollover,omitempty"`
	Migrations []lifecycle.Migration `json:"migrations,omitempty"`
	NextCursor string                `json:"nextCursor,omitempty"`
	Identity   *lifecycle.Identity   `json:"identity,omitempty"`
	Data       []byte                `json:"data,omitempty"`
}

type SetupStatus struct {
	Role              string                      `json:"role"`
	Ready             bool                        `json:"ready"`
	EnrollmentEnabled bool                        `json:"enrollmentEnabled"`
	Issues            []string                    `json:"issues"`
	Identities        []lifecycle.Identity        `json:"identities"`
	PublicACME        *lifecycle.PublicACMEStatus `json:"publicAcme,omitempty"`
}

type SinkConfig struct {
	// Dispatch bounds the application-owned in-process event bus.
	// It does not configure DDM synchronization or device command workers.
	Dispatch event.AsyncConfig
	// Audit writes a projected slog record for each event delivered to the sink.
	// Retention depends on the configured log destination.
	Audit bool
	// WebhookURL receives projected events in a MicroMDM-compatible envelope without
	// raw_payload.
	WebhookURL string
	// WebhookRootCAFile configures private HTTPS trust for the receiver.
	WebhookRootCAFile string
	// WebhookHMACKey signs the webhook body when set.
	WebhookHMACKey []byte
	// Persist delivers captured occurrences to the SQL audit trail. The event
	// store retains pending deliveries until this destination acknowledges them.
	Persist bool
	// AuditStore overrides Persist with a caller's own trail.
	AuditStore audit.Store
	// Retention is the maximum record age. Zero disables age-based pruning.
	Retention time.Duration
	// PruneInterval is how often retention runs; DefaultAuditPruneInterval
	// when unset.
	PruneInterval time.Duration
}

type WorkerState struct {
	Name    string
	Running bool
}