0860aa85c5
Fleet PCs on a trusted (vaulted) network can now reach the GE-Enforce client endpoints (manifest, payload, report) without a per-PC token: the auth path accepts a valid geenforce.fetch/report token OR a source IP in the configured allowlist (setting geenforce_allowed_cidrs). Fail-closed; an empty allowlist means the token stays the only path, so existing deployments are unchanged. Rationale: the client token lives in HKLM on every kiosk, so it does not defend against a compromised kiosk anyway - network-perimeter trust is the same practical strength with far less provisioning + no token-rotation churn on a DB wipe. Documented in-UI that this is perimeter trust, not per-device identity. - _ip_allowlisted() (ipaddress, X-Forwarded-For-aware via _client_ip) - /geenforce/config GET/PUT extended with allowedcidrs, server-validated + normalized (bad CIDR -> 400) - new GE-Enforce > Settings tab (GeEnforceSettings.vue) to edit the allowlist in admin, no SQL - 3 regression tests (allow by IP, reject outside list, empty = token required)
45 lines
1.3 KiB
Vue
45 lines
1.3 KiB
Vue
<template>
|
|
<div class="geenforce-section">
|
|
<div class="section-header">
|
|
<h1>GE-Enforce</h1>
|
|
<p class="section-sub">Desired-state install manifests for imaging PC types, and the fleet's reported results.</p>
|
|
</div>
|
|
<nav class="section-tabs">
|
|
<router-link to="/geenforce/manifests" class="tab">Manifests</router-link>
|
|
<router-link to="/geenforce/reports" class="tab">Enforcement Reports</router-link>
|
|
<router-link to="/geenforce/settings" class="tab">Settings</router-link>
|
|
</nav>
|
|
<router-view />
|
|
</div>
|
|
</template>
|
|
|
|
<script setup>
|
|
// Tabbed shell for the GE-Enforce section. Children render the manifest editor
|
|
// and the fleet-compliance reports full-width (not squeezed into the settings rail).
|
|
</script>
|
|
|
|
<style scoped>
|
|
.geenforce-section { max-width: 1400px; }
|
|
.section-header { margin-bottom: 0.5rem; }
|
|
.section-header h1 { margin: 0; }
|
|
.section-sub { color: var(--text-light); margin: 0.25rem 0 0; }
|
|
.section-tabs {
|
|
display: flex;
|
|
gap: 0.25rem;
|
|
border-bottom: 1px solid var(--border);
|
|
margin: 1rem 0 1.25rem;
|
|
}
|
|
.tab {
|
|
padding: 0.5rem 0.9rem;
|
|
text-decoration: none;
|
|
color: var(--text-light);
|
|
border-bottom: 2px solid transparent;
|
|
font-weight: 500;
|
|
}
|
|
.tab:hover { color: var(--text); }
|
|
.tab.router-link-active {
|
|
color: var(--primary);
|
|
border-bottom-color: var(--primary);
|
|
}
|
|
</style>
|