mdm

type Capabilities ¶

type Capabilities struct {
	// ReportsCompliant is true if the provider populates ManagedDevice.Compliant
	// with a meaningful value derived from upstream compliance state. When
	// false, callers should treat Compliant as "unknown" rather than "false".
	ReportsCompliant bool
}

Capabilities advertises optional provider features so callers (UI / API) know what to surface.

func CapabilitiesFor(name string) Capabilities

type EntraDeviceLookup ¶

type EntraDeviceLookup interface {
	LookupByEntraDeviceID(ctx context.Context, entraDeviceID string) (ManagedDevice, error)
}

EntraDeviceLookup is implemented by MDM providers that resolve a host using host.entra_device_id as Graph devices.deviceId. Intune queries GET /v1.0/devices first, then GET /deviceManagement/managedDevices when /devices returns no match. When entra_device_id is absent, Intune falls back to serial_number matching via ListManagedDevices.

type Factory ¶

type Factory func(config json.RawMessage) (Provider, error)

Factory builds a Provider instance from integration config JSON.

type IntuneConfig ¶

type IntuneConfig struct {
	SyncSettings
	ClientID     string `json:"client_id"`
	ClientSecret string `json:"client_secret"`
	TenantID     string `json:"tenant_id"`
}

IntuneConfig is stored in integrations_v1.config for the intune provider.

type IruConfig ¶

type IruConfig struct {
	SyncSettings
	APIURL                   string   `json:"api_url"`
	APIToken                 string   `json:"api_token"`
	ComplianceLibraryItemIDs []string `json:"compliance_library_item_ids,omitempty"`
}

IruConfig is stored in integrations_v1.config for the iru provider (Iru Endpoint Management, formerly Kandji). APIURL is the tenant API hostname from Settings (e.g. https://acme.api.iru.com or https://acme.api.kandji.io).

ComplianceLibraryItemIDs optionally limits compliance evaluation to specific library item IDs from GET /api/v1/devices/{device_id}/status. When empty, all parameters and library items must report a passing status (PASS, REMEDIATED/EXCLUDED/WARNING for parameters; PASS/success/EXCLUDED/AVAILABLE for library items).

type JamfConfig ¶

type JamfConfig struct {
	SyncSettings
	ClientID          string   `json:"client_id"`
	ClientSecret      string   `json:"client_secret"`
	BaseURL           string   `json:"base_url"`
	ComplianceVendors []string `json:"compliance_vendors,omitempty"`
}

JamfConfig is stored in integrations_v1.config for the jamf provider.

ComplianceVendors optionally limits device-trust evaluation to named complianceVendor values from Jamf Conditional Access (e.g. "Jamf", "Intune"). When empty, every applicable compliance record for the device must be COMPLIANT.

type JumpCloudConfig ¶

type JumpCloudConfig struct {
	SyncSettings
	ClientID            string   `json:"client_id"`
	ClientSecret        string   `json:"client_secret"`
	BaseURL             string   `json:"base_url"`
	CompliancePolicyIDs []string `json:"compliance_policy_ids,omitempty"`
}

JumpCloudConfig is stored in integrations_v1.config for the jumpcloud provider. Auth uses a JumpCloud service account (client_id + client_secret) against admin-oauth.id.jumpcloud.com with Basic auth. BaseURL defaults to https://console.jumpcloud.com.

CompliancePolicyIDs optionally limits device-trust evaluation to specific JumpCloud policy object IDs. When empty, all policy statuses returned for each system must pass.

type ManagedDevice ¶

type ManagedDevice struct {
	// ProviderDeviceID is the primary key in the upstream MDM.
	ProviderDeviceID string
	// AzureADDeviceID is filled by Intune; non-Entra MDMs leave it blank.
	AzureADDeviceID string

	SerialNumber      string
	HardwareUUID      string
	DeviceName        string
	UserPrincipalName string // user email

	Enrolled   bool
	Compliant  bool
	LastSeenAt time.Time
}

ManagedDevice is the normalised, provider-agnostic view of a device that an MDM Provider returns. Fields that a given provider can't fill are left as their zero value.

type Provider ¶

type Provider interface {
	// Name returns the stable identifier of this provider (matches integrations_v1.id).
	Name() string
	// Capabilities advertises optional provider features.
	Capabilities() Capabilities
	// Verify confirms credentials and connectivity against the upstream MDM.
	Verify(ctx context.Context) error
	// ListManagedDevices returns every device known to the upstream MDM.
	ListManagedDevices(ctx context.Context) ([]ManagedDevice, error)
}

Provider is the minimal contract every MDM integration must satisfy.

func Build(name string, config json.RawMessage) (Provider, error)

func BuildActive(ctx context.Context) (Provider, error)

type ProviderType ¶

type ProviderType struct {
	Name             string `json:"name"`
	Display          string `json:"display"`
	ReportsCompliant bool   `json:"reports_compliant"`
}

ProviderType describes a provider implementation available at compile time.

func ListProviderTypes() []ProviderType

type SyncSettings ¶

type SyncSettings struct {
	SyncEnabled         bool `json:"sync_enabled"`
	SyncIntervalMinutes int  `json:"sync_interval_minutes"`
}

SyncSettings are shared across MDM provider configs.

func ParseSyncSettings(providerID string, configJSON json.RawMessage) (SyncSettings, error)