8b144a17bb
- Settings > Endpoints > Enrollment. Migration tab: readiness counts and progress, each PC's state with the reasons it is blocked, "Upgrade selected" and "Upgrade next 25", and live wave progress. Credentials tab: enrolled PCs with revoke, pending requests with approve and reject, and the shared key and auto-enroll switches. Turning the shared key off asks for confirmation and shows how many PCs are not enrolled. - The server certificate page shows the SPKI pin to put in the GE-Enforce pin entry. - The agent upgrade script and the asset and printer reporters send the PC's credential when it has one (over https, only to the issuing server), fall back to the shared key, check server pins, and log refusals clearly. - New Set-ShopDBServerPins.ps1 (GE-Enforce entry) and Get-ShopDBServerPin.ps1. - AGENT-CONTRACT.md documents per-PC credentials; the rollout runbook covers phases, gates, rollback, pin and wave entries, and every place the shared key lives and how to clear it at cutover. - Removed the 09-14 certificate design notes and dated session reports, and two VM notes that carried a live collector key and advised plain http. - Corrected the GE-Enforce collector note, which claimed a plain registry token is protected by ACL.
65 lines
2.3 KiB
JavaScript
65 lines
2.3 KiB
JavaScript
/**
|
|
* Endpoints plugin routes
|
|
*
|
|
* Groundwork for the fleet view. There is no endpoint-specific detail route
|
|
* yet: rows link into the existing PC detail page (/pcs/:id) so telemetry
|
|
* stays interoperable with the computers plugin instead of duplicating it.
|
|
*/
|
|
export default [
|
|
{
|
|
path: 'endpoints',
|
|
name: 'endpoints',
|
|
component: () => import('./views/EndpointsList.vue'),
|
|
meta: { plugin: 'endpoints' }
|
|
},
|
|
{
|
|
path: 'settings/endpoints/agentkey',
|
|
name: 'endpoints-agentkey-settings',
|
|
component: () => import('./views/AgentKeySettings.vue'),
|
|
meta: { requiresAuth: true, requiresAdmin: true, plugin: 'endpoints' }
|
|
},
|
|
{
|
|
path: 'settings/endpoints/monitors',
|
|
name: 'endpoints-monitors-settings',
|
|
component: () => import('./views/MonitorsSettings.vue'),
|
|
meta: { requiresAuth: true, requiresAdmin: true, plugin: 'endpoints' }
|
|
},
|
|
{
|
|
path: 'settings/endpoints/server-cert',
|
|
name: 'endpoints-server-cert-settings',
|
|
component: () => import('./views/ServerCertSettings.vue'),
|
|
meta: { requiresAuth: true, requiresAdmin: true, plugin: 'endpoints' }
|
|
},
|
|
// requiresPermission, not requiresAdmin: endpoints.runscript is grantable to
|
|
// non-admin operators, and the sibling pages' admin gate would lock the
|
|
// holders of the grant out of the library they are trusted to manage. The
|
|
// API enforces the same permission, so this only keeps the menu honest.
|
|
{
|
|
path: 'settings/endpoints/scripts',
|
|
name: 'endpoints-scripts-settings',
|
|
component: () => import('./views/SystemScriptsSettings.vue'),
|
|
meta: {
|
|
requiresAuth: true,
|
|
requiresPermission: 'endpoints.runscript',
|
|
plugin: 'endpoints'
|
|
}
|
|
},
|
|
// Readable by endpoints.fleet holders so they can watch a migration; every
|
|
// write on the page is admin-only and re-checked server-side.
|
|
{
|
|
path: 'settings/endpoints/enrollment',
|
|
name: 'endpoints-enrollment-settings',
|
|
component: () => import('./views/EnrollmentSettings.vue'),
|
|
meta: {
|
|
requiresAuth: true,
|
|
requiresPermission: 'endpoints.fleet',
|
|
plugin: 'endpoints'
|
|
}
|
|
}
|
|
]
|
|
|
|
// No full-screen routes: every view in this plugin renders inside
|
|
// AppLayout. Declared so routes.gen.js can read `.toplevel` off the module
|
|
// without Rollup warning about a missing export.
|
|
export const toplevel = []
|