Documentation
¶
Overview ¶
Package mdmassets loads the MDM assets tree that obot-sentry's build publishes and assembles the per-configuration ZIP an admin downloads. The manifest is the whole contract: it declares the platforms (identity + display info), the configurations (per platform+OS, with their rendered-markdown instructions template and asset files), and the field schema the admin form renders from — obot holds no platform-specific knowledge of its own.
A source directory or tarball contains manifest.json plus its referenced files. The controller imports that source into immutable database bundles; HTTP replicas open those bundles through this package and never serve from the source path. The format is defined by these manifest types and produced by obot-sentry's build/mdm-assets.sh.
Index ¶
- Constants
- func ArtifactSlug(platform, osName string) string
- func Import(ctx context.Context, source string) ([]byte, error)
- func RedactSource(source string) string
- type Loader
- func (l *Loader) CompleteValues(values map[string]any) error
- func (l *Loader) Find(platform, osName string) (types.MDMAssetConfiguration, error)
- func (l *Loader) Manifest() types.MDMAssetManifest
- func (l *Loader) RenderAll(values map[string]any, enforcementEnabled bool) ([]RenderedArtifact, error)
- func (l *Loader) RenderInstructions(c types.MDMAssetConfiguration, values map[string]any, enforcementEnabled bool) (string, error)
- func (l *Loader) RenderStoredState(storedValues, serverURL string, enforcementEnabled bool) (artifacts []RenderedArtifact, normalizedValues string, err error)
- func (l *Loader) ValidateTemplates(c types.MDMAssetConfiguration, values map[string]any, enforcementEnabled bool) error
- func (l *Loader) Zip(w io.Writer, c types.MDMAssetConfiguration, values map[string]any, ...) error
- type RenderedArtifact
Constants ¶
const SchemaVersion = "v1"
SchemaVersion is the manifest format this loader understands. An assets tree declaring anything else is rejected so a newer format can't be misread by an older server.
Variables ¶
This section is empty.
Functions ¶
func ArtifactSlug ¶
ArtifactSlug returns the stable URL segment for a platform/OS artifact. NewFS rejects manifests whose targets collide after normalization.
func Import ¶
Import reads source, validates the complete assets snapshot, and normalizes it into deterministic archive bytes. HTTP(S) sources are tar archives. Local sources may be either the existing assets directory or a tar archive.
func RedactSource ¶
RedactSource returns a source suitable for status and UI display. Local paths are unchanged. URL credentials, query parameters, and fragments are never exposed, including when a malformed HTTP URL cannot be parsed safely.
Types ¶
type Loader ¶
type Loader struct {
// contains filtered or unexported fields
}
Loader validates and renders files from one immutable MDM asset bundle.
func NewFS ¶
NewFS loads and validates an assets snapshot rooted at files. Callers must not mutate files after this function returns.
func OpenArchive ¶
OpenArchive validates and opens canonical database bundle content without extracting it to disk.
func (*Loader) CompleteValues ¶
CompleteValues drops nulls (null means unset), fills schema defaults, and validates values in place — every rule comes from the manifest. The returned error is safe to surface to the admin.
func (*Loader) Find ¶
func (l *Loader) Find(platform, osName string) (types.MDMAssetConfiguration, error)
Find returns the configuration for (platform, osName). An empty osName matches when the platform has exactly one configuration. The returned error names what is available and is safe to surface to the admin.
func (*Loader) Manifest ¶
func (l *Loader) Manifest() types.MDMAssetManifest
Manifest returns a detached copy of the validated manifest for persistence and API discovery without reopening the archive.
func (*Loader) RenderAll ¶
func (l *Loader) RenderAll(values map[string]any, enforcementEnabled bool) ([]RenderedArtifact, error)
RenderAll completes and validates values once, then renders every target in the immutable bundle. It returns no partial result if any target fails. enforcementEnabled is threaded into every template's render context so templates can bake in the tool-call enforcement toggle.
func (*Loader) RenderInstructions ¶
func (l *Loader) RenderInstructions(c types.MDMAssetConfiguration, values map[string]any, enforcementEnabled bool) (string, error)
RenderInstructions renders the configuration's instructions template with values into the markdown setup guide clients display.
func (*Loader) RenderStoredState ¶ added in v0.25.0
func (l *Loader) RenderStoredState(storedValues, serverURL string, enforcementEnabled bool) (artifacts []RenderedArtifact, normalizedValues string, err error)
RenderStoredState renders every target from a configuration's persisted state, the single implementation shared by the asset-source controller (which re-renders configurations onto a new bundle) and the enforcement-update handler (which re-renders a configuration onto its own pinned bundle when the enforcement toggle flips). It parses the stored values JSON (dropping any serverURL, which is always injected fresh from trusted server state) and renders against serverURL + enforcementEnabled. The returned values JSON is the stored values re-marshaled without serverURL: the controller persists it alongside the new bundle digest, while the enforcement path ignores it and leaves the values column untouched.
func (*Loader) ValidateTemplates ¶
func (l *Loader) ValidateTemplates(c types.MDMAssetConfiguration, values map[string]any, enforcementEnabled bool) error
ValidateTemplates executes every rendered asset against completed values without copying binary assets. This catches missing template inputs before a deployment is saved instead of deferring the failure until download.
func (*Loader) Zip ¶
func (l *Loader) Zip(w io.Writer, c types.MDMAssetConfiguration, values map[string]any, enforcementEnabled bool) error
Zip writes the configuration's download to w: assets ending in .tmpl are rendered as Go text/templates against values (suffix stripped), everything else is copied verbatim. Names in the ZIP are base names — the assemble step guarantees they don't collide.
Source Files