mdm

const (
	KeyManagementURL         = "managementURL"
	KeyDisableUpdateSettings = "disableUpdateSettings"
	KeyDisableProfiles       = "disableProfiles"
	KeyDisableNetworks       = "disableNetworks"
	// KeyDisableAdvancedView gates the advanced-view section in the
	// upcoming UI revision. UI-only: NOT stored on Config, not
	// applied by applyMDMPolicy, not rejectable via SetConfig. The
	// daemon surfaces it through GetFeatures (tristate: present
	// true / present false / absent) and the same key appears in
	// GetConfigResponse.mDMManagedFields when set.
	KeyDisableAdvancedView      = "disableAdvancedView"
	KeyDisableClientRoutes      = "disableClientRoutes"
	KeyDisableServerRoutes      = "disableServerRoutes"
	KeyBlockInbound             = "blockInbound"
	KeyDisableMetricsCollection = "disableMetricsCollection"
	KeyAllowServerSSH           = "allowServerSSH"
	KeyDisableAutoConnect       = "disableAutoConnect"
	// KeyDisableAutostart suppresses the GUI's fresh-install
	// launch-on-login default and marks the Settings toggle as
	// MDM-managed. UI-only: NOT stored on Config and not applied by
	// applyMDMPolicy; the GUI reads it directly and it appears in
	// GetConfigResponse.mDMManagedFields when set.
	KeyDisableAutostart    = "disableAutostart"
	KeyPreSharedKey        = "preSharedKey"
	KeyRosenpassEnabled    = "rosenpassEnabled"
	KeyRosenpassPermissive = "rosenpassPermissive"
	KeyWireguardPort       = "wireguardPort"
	KeyEnableLocalMetrics  = "enableLocalMetrics"
	KeyLocalMetricsAddress = "localMetricsAddress"

	// Split tunnel is modeled as a single conceptual policy with two
	// registry/plist values. KeySplitTunnelMode is the discriminator
	// ("allow" or "disallow"); KeySplitTunnelApps is a comma-separated
	// list of package names. The values are mutually exclusive by
	// construction — only one mode can be set at a time.
	KeySplitTunnelMode = "splitTunnelMode"
	KeySplitTunnelApps = "splitTunnelApps"

	// KeyLazyConnection forces the lazy-connection feature on or off, overriding
	// the management feature flag. Read as a bool (native bool, or on/off,
	// true/false, 1/0, yes/no); absent = defer to management.
	KeyLazyConnection = "lazyConnection"

	// KeyRemoteJobsAllowed opts the peer into management-requested remote jobs
	// (e.g. debug bundles). Read as a bool; absent = defer to the local config
	// (which defaults to disabled). Stored on Config as RemoteJobsAllowed.
	KeyRemoteJobsAllowed = "allowRemoteJobs"

	// KeyBundleUploadURL overrides the debug-bundle upload service URL for
	// remote jobs, taking precedence over the management-supplied value. Read
	// as a string; must be an https URL with a host. Absent = defer to the
	// management-supplied URL (or the default upload server).
	KeyBundleUploadURL = "debugBundleUploadURL"
)

const (
	SplitTunnelModeAllow    = "allow"
	SplitTunnelModeDisallow = "disallow"
)

const DefaultReloadInterval = 1 * time.Minute

const PreSharedKeyRedactedSentinel = "**********"