service

type Call = dmhook.Call

type CertReusePolicy func(ctx context.Context, r *mdm.Request, previous []storage.CertAssociation) error

type CheckinResult struct {
	Body        []byte
	ContentType string
	// Status overrides the HTTP status when non-zero.
	Status int
}

type Code int

type Config struct {
	Store storage.Store
	// EnableReplacements enables authorized profile updates on stores implementing
	// storage.ReplacementStore. Ordinary re-enrollment policy remains independent.
	EnableReplacements bool
	// Bus receives events; nil disables publishing.
	Bus event.Publisher
	// Clock defaults to the real clock.
	Clock clock.Clock
	Hooks []Hook
	// CertificateStatus is optional and independent of Pinning. It runs before
	// hooks or side effects on all device requests, including Authenticate and DDM.
	CertificateStatus func(context.Context, *x509.Certificate) error
	// Logger defaults to slog.Default.
	Logger *slog.Logger
	// Pinning defaults to PinEnforce.
	Pinning PinMode
	// Reenroll defaults to DenyReenroll.
	Reenroll ReenrollPolicy
	// CertReuse defaults to DenyCertReuse. It is consulted when an
	// Authenticate presents a certificate whose hash appears in another
	// enrollment's history and is ignored under PinOff. AllowCertReuse only
	// permits certificates that are in history but not currently pinned: a
	// live pin held by another enrollment still yields ErrCertMismatch with
	// CodeForbidden, because the pin exists to stop a second device using
	// the identity.
	CertReuse CertReusePolicy
	// RequireUserAuth makes a user channel's TokenUpdate depend on a
	// completed UserAuthenticate session (a token issued by DigestUserAuth):
	// without one the TokenUpdate is CodeForbidden (decision record 0029).
	// Shared iPad and User Enrollment user channels are exempt because
	// Apple never sends UserAuthenticate for them.
	RequireUserAuth bool
	// ValidateTargets checks every Enqueue target against the request
	// type and populated fields' support metadata (channel, Shared iPad,
	// User Enrollment) from schema/commands and reports unsupported targets in
	// EnqueueResult.Skipped instead of queuing them. Default true.
	// Required fields and value constraints are checked even when false.
	ValidateTargets *bool
	// Optional message handlers.
	DeclarativeManagement DMHandler
	GetToken              GetTokenHandler
	UserAuthenticate      UserAuthenticateHandler
	// ReturnToService is optional. With no handler the service answers
	// Enabled false, which is a valid answer meaning "do not erase": the
	// safe reading of an unconfigured server.
	ReturnToService ReturnToServiceHandler
}

type Core struct {
	// contains filtered or unexported fields
}

type DMHandler func(ctx context.Context, r *mdm.Request, ck *mdm.Checkin, m *checkin.DeclarativeManagement) (DMResponse, error)

type DMResponse struct {
	Body        []byte
	ContentType string
	// Status overrides the HTTP status when non-zero (for example 404 for
	// an unknown declaration).
	Status int
}

type DigestUserAuth struct {
	Store    storage.UserAuthStore
	Verifier UserVerifier
	// Realm defaults to DefaultUserAuthRealm.
	Realm string
	// ChallengeTTL defaults to DefaultUserAuthChallengeTTL.
	ChallengeTTL time.Duration
	// Manage decides whether the user is managed at all. Returning
	// ErrUserNotManaged answers 410 (CodeGone) for this login session; any
	// other error is CodeInternal. Nil manages everyone.
	Manage func(ctx context.Context, r *mdm.Request, m *checkin.UserAuthenticate) error
	// Clock defaults to the real clock.
	Clock clock.Clock
	// Bus receives UserAuthenticated and UserAuthFailed; nil disables it.
	Bus event.Publisher
	// Rand defaults to crypto/rand.
	Rand io.Reader
}

type Error struct {
	Code Code
	Err  error
}

type GetTokenHandler func(ctx context.Context, r *mdm.Request, m *checkin.GetToken) (*checkin.GetTokenResponse, error)

type Hook = dmhook.Hook

type PinMode int

type ReenrollPolicy func(ctx context.Context, r *mdm.Request, existing *storage.Enrollment) error

type ReturnToServiceHandler func(ctx context.Context, r *mdm.Request, m *checkin.ReturnToService) (*checkin.ReturnToServiceResponse, error)

type UserAuthenticateHandler func(ctx context.Context, r *mdm.Request, m *checkin.UserAuthenticate) (*mdm.UserAuthenticateResponse, error)

type UserVerifier interface {
	Verify(ctx context.Context, r *mdm.Request, in VerifyInput) (bool, error)
}

type UserVerifierFunc func(ctx context.Context, r *mdm.Request, in VerifyInput) (bool, error)

type VerifyInput struct {
	// UserID is the GUID from the UserAuthenticate message.
	UserID string
	// Realm is the realm the challenge was issued for.
	Realm string
	// Challenge is the full DigestChallenge string that was issued.
	Challenge string
	// DigestResponse is the client's Authorization-style parameter list.
	DigestResponse string
}