0860aa85c5
Fleet PCs on a trusted (vaulted) network can now reach the GE-Enforce client endpoints (manifest, payload, report) without a per-PC token: the auth path accepts a valid geenforce.fetch/report token OR a source IP in the configured allowlist (setting geenforce_allowed_cidrs). Fail-closed; an empty allowlist means the token stays the only path, so existing deployments are unchanged. Rationale: the client token lives in HKLM on every kiosk, so it does not defend against a compromised kiosk anyway - network-perimeter trust is the same practical strength with far less provisioning + no token-rotation churn on a DB wipe. Documented in-UI that this is perimeter trust, not per-device identity. - _ip_allowlisted() (ipaddress, X-Forwarded-For-aware via _client_ip) - /geenforce/config GET/PUT extended with allowedcidrs, server-validated + normalized (bad CIDR -> 400) - new GE-Enforce > Settings tab (GeEnforceSettings.vue) to edit the allowlist in admin, no SQL - 3 regression tests (allow by IP, reject outside list, empty = token required)
37 lines
1.2 KiB
JavaScript
37 lines
1.2 KiB
JavaScript
/**
|
|
* GE-Enforce plugin routes.
|
|
*
|
|
* A top-level section (not under /settings) - the manifest editor + fleet
|
|
* reports are a large operational surface, so they get their own full-width
|
|
* shell with tabs. meta.plugin = 'geenforce' so the ADR-009 guard hides the
|
|
* section when the plugin is disabled. Admin-only.
|
|
*/
|
|
export default [
|
|
{
|
|
path: 'geenforce',
|
|
component: () => import('./views/GeEnforceLayout.vue'),
|
|
meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' },
|
|
children: [
|
|
{ path: '', redirect: '/geenforce/manifests' },
|
|
{
|
|
path: 'manifests',
|
|
name: 'geenforce-manifests',
|
|
component: () => import('./views/ManifestEditor.vue'),
|
|
meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
|
|
},
|
|
{
|
|
path: 'reports',
|
|
name: 'geenforce-reports',
|
|
component: () => import('./views/EnforcementReports.vue'),
|
|
meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
|
|
},
|
|
{
|
|
path: 'settings',
|
|
name: 'geenforce-settings',
|
|
component: () => import('./views/GeEnforceSettings.vue'),
|
|
meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
|
|
}
|
|
]
|
|
}
|
|
]
|