@openmdm/plugin-kiosk 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-present OpenMDM Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,129 @@
+import { MDMPlugin } from '@openmdm/core';
+export { MDMPlugin } from '@openmdm/core';
+
+/**
+ * OpenMDM Kiosk Mode Plugin
+ *
+ * Provides kiosk/lockdown mode functionality for Android devices.
+ * Supports single-app mode, multi-app kiosk, and screen pinning.
+ *
+ * @example
+ * ```typescript
+ * import { createMDM } from '@openmdm/core';
+ * import { kioskPlugin } from '@openmdm/plugin-kiosk';
+ *
+ * const mdm = createMDM({
+ *   database: drizzleAdapter(db),
+ *   plugins: [
+ *     kioskPlugin({
+ *       defaultExitPassword: 'admin123',
+ *       allowRemoteExit: true,
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+
+interface KioskPluginOptions {
+    /**
+     * Default password for exiting kiosk mode
+     * Can be overridden per-policy
+     */
+    defaultExitPassword?: string;
+    /**
+     * Allow remote exit command from server
+     */
+    allowRemoteExit?: boolean;
+    /**
+     * Auto-lock device when kiosk app crashes
+     */
+    lockOnCrash?: boolean;
+    /**
+     * Restart kiosk app if it closes
+     */
+    autoRestart?: boolean;
+    /**
+     * Auto-restart delay in milliseconds
+     */
+    autoRestartDelay?: number;
+    /**
+     * Maximum exit password attempts before lock
+     */
+    maxExitAttempts?: number;
+    /**
+     * Lockout duration in minutes after max attempts
+     */
+    lockoutDuration?: number;
+}
+interface KioskSettings {
+    /** Enable kiosk mode */
+    enabled: boolean;
+    /** Kiosk mode type */
+    mode: 'single-app' | 'multi-app' | 'screen-pin';
+    /** Main/launcher app package name */
+    mainApp: string;
+    /** Allowed apps in multi-app mode */
+    allowedApps?: string[];
+    /** Password to exit kiosk mode (device-side) */
+    exitPassword?: string;
+    /** Secret gesture to trigger exit (e.g., '5-tap-corners') */
+    exitGesture?: string;
+    /** Lock status bar */
+    lockStatusBar?: boolean;
+    /** Lock navigation bar */
+    lockNavigationBar?: boolean;
+    /** Disable home button */
+    disableHomeButton?: boolean;
+    /** Disable recent apps button */
+    disableRecentApps?: boolean;
+    /** Disable power button (soft) */
+    disablePowerButton?: boolean;
+    /** Disable volume buttons */
+    disableVolumeButtons?: boolean;
+    /** Lock screen orientation */
+    lockOrientation?: 'portrait' | 'landscape' | 'auto';
+    /** Disable notifications */
+    disableNotifications?: boolean;
+    /** Allowed notification packages */
+    allowedNotifications?: string[];
+    /** Keep screen on */
+    keepScreenOn?: boolean;
+    /** Screen brightness (0-255, or 'auto') */
+    screenBrightness?: number | 'auto';
+    /** Auto-launch on boot */
+    launchOnBoot?: boolean;
+    /** Auto-restart on crash */
+    restartOnCrash?: boolean;
+    /** Restart delay in ms */
+    restartDelay?: number;
+    /** Custom wallpaper URL */
+    wallpaperUrl?: string;
+    /** Hide system UI elements */
+    immersiveMode?: boolean;
+    /** Allow status bar pull-down for specific items */
+    allowedStatusBarItems?: ('wifi' | 'bluetooth' | 'airplane' | 'battery')[];
+    /** Show clock/time */
+    showClock?: boolean;
+    /** Show battery indicator */
+    showBattery?: boolean;
+    /** Custom exit password per device (encrypted) */
+    deviceExitPasswords?: Record<string, string>;
+}
+interface KioskState {
+    deviceId: string;
+    enabled: boolean;
+    mode: 'single-app' | 'multi-app' | 'screen-pin';
+    mainApp: string;
+    activeApp?: string;
+    lockedSince?: Date;
+    exitAttempts: number;
+    lastExitAttempt?: Date;
+    lockedOut: boolean;
+    lockoutUntil?: Date;
+}
+/**
+ * Create kiosk mode plugin
+ */
+declare function kioskPlugin(options?: KioskPluginOptions): MDMPlugin;
+
+export { type KioskPluginOptions, type KioskSettings, type KioskState, kioskPlugin };

package/dist/index.js

@@ -0,0 +1,396 @@
+// src/index.ts
+function kioskPlugin(options = {}) {
+  const {
+    defaultExitPassword = "admin",
+    allowRemoteExit = true,
+    lockOnCrash = true,
+    autoRestart = true,
+    autoRestartDelay = 1e3,
+    maxExitAttempts = 5,
+    lockoutDuration = 15
+  } = options;
+  let mdm;
+  const kioskStates = /* @__PURE__ */ new Map();
+  function getKioskSettings(policy) {
+    const settings = policy.settings;
+    if (!settings.kioskMode || !settings.mainApp) {
+      return null;
+    }
+    return {
+      enabled: settings.kioskMode,
+      mode: "single-app",
+      // Default mode
+      mainApp: settings.mainApp,
+      allowedApps: settings.allowedApps,
+      exitPassword: settings.kioskExitPassword || defaultExitPassword,
+      lockStatusBar: settings.lockStatusBar ?? true,
+      lockNavigationBar: settings.lockNavigationBar ?? true,
+      disableHomeButton: true,
+      disableRecentApps: true,
+      disablePowerButton: settings.lockPowerButton ?? false,
+      keepScreenOn: true,
+      launchOnBoot: true,
+      restartOnCrash: autoRestart,
+      restartDelay: autoRestartDelay,
+      immersiveMode: true,
+      showClock: true,
+      showBattery: true,
+      ...settings.custom?.kiosk
+    };
+  }
+  function getKioskState(deviceId) {
+    return kioskStates.get(deviceId);
+  }
+  function updateKioskState(deviceId, updates) {
+    const current = kioskStates.get(deviceId) || {
+      deviceId,
+      enabled: false,
+      mode: "single-app",
+      mainApp: "",
+      exitAttempts: 0,
+      lockedOut: false
+    };
+    const updated = { ...current, ...updates };
+    kioskStates.set(deviceId, updated);
+    return updated;
+  }
+  async function handleExitKiosk(device, command) {
+    if (!allowRemoteExit) {
+      return {
+        success: false,
+        message: "Remote kiosk exit is disabled"
+      };
+    }
+    const state = getKioskState(device.id);
+    if (!state?.enabled) {
+      return {
+        success: true,
+        message: "Device is not in kiosk mode"
+      };
+    }
+    updateKioskState(device.id, {
+      enabled: false,
+      exitAttempts: 0,
+      lockedOut: false
+    });
+    await mdm.emit("custom", {
+      type: "kiosk.exited",
+      deviceId: device.id,
+      method: "remote",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return {
+      success: true,
+      message: "Kiosk mode exit command sent"
+    };
+  }
+  async function handleEnterKiosk(device, command) {
+    const payload = command.payload;
+    let kioskSettings = null;
+    if (device.policyId) {
+      const policy = await mdm.policies.get(device.policyId);
+      if (policy) {
+        kioskSettings = getKioskSettings(policy);
+      }
+    }
+    const mainApp = payload?.app || kioskSettings?.mainApp;
+    if (!mainApp) {
+      return {
+        success: false,
+        message: "No main app specified for kiosk mode"
+      };
+    }
+    updateKioskState(device.id, {
+      enabled: true,
+      mode: kioskSettings?.mode || "single-app",
+      mainApp,
+      lockedSince: /* @__PURE__ */ new Date(),
+      exitAttempts: 0,
+      lockedOut: false
+    });
+    await mdm.emit("custom", {
+      type: "kiosk.entered",
+      deviceId: device.id,
+      mainApp,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return {
+      success: true,
+      message: `Kiosk mode activated with ${mainApp}`,
+      data: { mainApp }
+    };
+  }
+  function validateKioskPolicy(settings) {
+    const errors = [];
+    if (settings.kioskMode) {
+      if (!settings.mainApp) {
+        errors.push("Kiosk mode requires a main app package name");
+      }
+      if (settings.allowedApps && settings.allowedApps.length > 0) {
+        if (!settings.allowedApps.includes(settings.mainApp)) {
+          errors.push("Main app must be included in allowed apps list");
+        }
+      }
+      const custom = settings.custom?.kiosk;
+      if (custom?.mode === "multi-app" && !settings.allowedApps?.length) {
+        errors.push("Multi-app kiosk mode requires allowed apps list");
+      }
+      if (custom?.screenBrightness !== void 0 && custom.screenBrightness !== "auto") {
+        if (typeof custom.screenBrightness === "number") {
+          if (custom.screenBrightness < 0 || custom.screenBrightness > 255) {
+            errors.push('Screen brightness must be between 0-255 or "auto"');
+          }
+        }
+      }
+    }
+    return {
+      valid: errors.length === 0,
+      errors: errors.length > 0 ? errors : void 0
+    };
+  }
+  const routes = [
+    // Get kiosk status for a device
+    {
+      method: "GET",
+      path: "/kiosk/:deviceId/status",
+      auth: true,
+      admin: true,
+      handler: async (context) => {
+        const { deviceId } = context.req.param();
+        const state = getKioskState(deviceId);
+        if (!state) {
+          return context.json({ enabled: false });
+        }
+        return context.json({
+          ...state,
+          lockedSince: state.lockedSince?.toISOString(),
+          lastExitAttempt: state.lastExitAttempt?.toISOString(),
+          lockoutUntil: state.lockoutUntil?.toISOString()
+        });
+      }
+    },
+    // Enter kiosk mode
+    {
+      method: "POST",
+      path: "/kiosk/:deviceId/enter",
+      auth: true,
+      admin: true,
+      handler: async (context) => {
+        const { deviceId } = context.req.param();
+        const body = await context.req.json();
+        const command = await mdm.commands.send({
+          deviceId,
+          type: "enterKiosk",
+          payload: { app: body.app }
+        });
+        return context.json({ success: true, commandId: command.id });
+      }
+    },
+    // Exit kiosk mode
+    {
+      method: "POST",
+      path: "/kiosk/:deviceId/exit",
+      auth: true,
+      admin: true,
+      handler: async (context) => {
+        const { deviceId } = context.req.param();
+        const command = await mdm.commands.send({
+          deviceId,
+          type: "exitKiosk"
+        });
+        return context.json({ success: true, commandId: command.id });
+      }
+    },
+    // Get all devices in kiosk mode
+    {
+      method: "GET",
+      path: "/kiosk/devices",
+      auth: true,
+      admin: true,
+      handler: async (context) => {
+        const kioskDevices = Array.from(kioskStates.entries()).filter(([_, state]) => state.enabled).map(([_, state]) => ({
+          ...state,
+          lockedSince: state.lockedSince?.toISOString()
+        }));
+        return context.json({ devices: kioskDevices });
+      }
+    },
+    // Report exit attempt from device
+    {
+      method: "POST",
+      path: "/kiosk/exit-attempt",
+      auth: true,
+      handler: async (context) => {
+        const body = await context.req.json();
+        const { deviceId, success, password } = body;
+        const state = getKioskState(deviceId);
+        if (!state?.enabled) {
+          return context.json({ error: "Device not in kiosk mode" }, 400);
+        }
+        if (state.lockedOut && state.lockoutUntil) {
+          if (/* @__PURE__ */ new Date() < state.lockoutUntil) {
+            return context.json({
+              error: "Exit attempts locked",
+              lockoutUntil: state.lockoutUntil.toISOString()
+            }, 403);
+          } else {
+            updateKioskState(deviceId, {
+              lockedOut: false,
+              lockoutUntil: void 0,
+              exitAttempts: 0
+            });
+          }
+        }
+        if (success) {
+          updateKioskState(deviceId, {
+            enabled: false,
+            exitAttempts: 0
+          });
+          await mdm.emit("custom", {
+            type: "kiosk.exited",
+            deviceId,
+            method: "local",
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          });
+          return context.json({ success: true });
+        } else {
+          const newAttempts = state.exitAttempts + 1;
+          if (newAttempts >= maxExitAttempts) {
+            const lockoutUntil = new Date(
+              Date.now() + lockoutDuration * 60 * 1e3
+            );
+            updateKioskState(deviceId, {
+              exitAttempts: newAttempts,
+              lastExitAttempt: /* @__PURE__ */ new Date(),
+              lockedOut: true,
+              lockoutUntil
+            });
+            await mdm.emit("custom", {
+              type: "kiosk.lockout",
+              deviceId,
+              attempts: newAttempts,
+              lockoutUntil: lockoutUntil.toISOString()
+            });
+            return context.json({
+              error: "Max attempts exceeded",
+              lockedOut: true,
+              lockoutUntil: lockoutUntil.toISOString()
+            }, 403);
+          } else {
+            updateKioskState(deviceId, {
+              exitAttempts: newAttempts,
+              lastExitAttempt: /* @__PURE__ */ new Date()
+            });
+            return context.json({
+              error: "Invalid password",
+              attemptsRemaining: maxExitAttempts - newAttempts
+            }, 401);
+          }
+        }
+      }
+    },
+    // Report kiosk app crash from device
+    {
+      method: "POST",
+      path: "/kiosk/app-crash",
+      auth: true,
+      handler: async (context) => {
+        const body = await context.req.json();
+        const { deviceId, packageName, error } = body;
+        await mdm.emit("custom", {
+          type: "kiosk.appCrash",
+          deviceId,
+          packageName,
+          error,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        const state = getKioskState(deviceId);
+        const shouldRestart = state?.enabled && autoRestart;
+        return context.json({
+          restart: shouldRestart,
+          restartDelay: autoRestartDelay,
+          lockDevice: lockOnCrash
+        });
+      }
+    }
+  ];
+  return {
+    name: "kiosk",
+    version: "1.0.0",
+    async onInit(instance) {
+      mdm = instance;
+      console.log("[OpenMDM Kiosk] Plugin initialized");
+    },
+    async onDestroy() {
+      kioskStates.clear();
+      console.log("[OpenMDM Kiosk] Plugin destroyed");
+    },
+    routes,
+    async onDeviceEnrolled(device) {
+      if (device.policyId) {
+        const policy = await mdm.policies.get(device.policyId);
+        if (policy) {
+          const kioskSettings = getKioskSettings(policy);
+          if (kioskSettings?.enabled) {
+            updateKioskState(device.id, {
+              enabled: true,
+              mode: kioskSettings.mode,
+              mainApp: kioskSettings.mainApp,
+              lockedSince: /* @__PURE__ */ new Date()
+            });
+          }
+        }
+      }
+    },
+    async onHeartbeat(device, heartbeat) {
+      const state = getKioskState(device.id);
+      if (state?.enabled && heartbeat.runningApps) {
+        const isKioskAppRunning = heartbeat.runningApps.includes(state.mainApp);
+        if (!isKioskAppRunning && autoRestart) {
+          await mdm.commands.send({
+            deviceId: device.id,
+            type: "runApp",
+            payload: { packageName: state.mainApp }
+          });
+        }
+      }
+    },
+    policySchema: {
+      kioskMode: { type: "boolean", description: "Enable kiosk mode" },
+      mainApp: {
+        type: "string",
+        description: "Main kiosk app package name"
+      },
+      allowedApps: {
+        type: "array",
+        items: { type: "string" },
+        description: "Allowed apps in kiosk mode"
+      },
+      kioskExitPassword: {
+        type: "string",
+        description: "Password to exit kiosk mode"
+      }
+    },
+    validatePolicy: async (settings) => {
+      return validateKioskPolicy(settings);
+    },
+    commandTypes: ["enterKiosk", "exitKiosk"],
+    executeCommand: async (device, command) => {
+      switch (command.type) {
+        case "enterKiosk":
+          return handleEnterKiosk(device, command);
+        case "exitKiosk":
+          return handleExitKiosk(device, command);
+        default:
+          return {
+            success: false,
+            message: `Unknown command type: ${command.type}`
+          };
+      }
+    }
+  };
+}
+export {
+  kioskPlugin
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * OpenMDM Kiosk Mode Plugin\n *\n * Provides kiosk/lockdown mode functionality for Android devices.\n * Supports single-app mode, multi-app kiosk, and screen pinning.\n *\n * @example\n * ```typescript\n * import { createMDM } from '@openmdm/core';\n * import { kioskPlugin } from '@openmdm/plugin-kiosk';\n *\n * const mdm = createMDM({\n *   database: drizzleAdapter(db),\n *   plugins: [\n *     kioskPlugin({\n *       defaultExitPassword: 'admin123',\n *       allowRemoteExit: true,\n *     }),\n *   ],\n * });\n * ```\n */\n\nimport type {\n  MDMPlugin,\n  MDMInstance,\n  Device,\n  Policy,\n  PolicySettings,\n  Command,\n  CommandResult,\n  Heartbeat,\n  PluginRoute,\n} from '@openmdm/core';\n\n// ============================================\n// Kiosk Types\n// ============================================\n\nexport interface KioskPluginOptions {\n  /**\n   * Default password for exiting kiosk mode\n   * Can be overridden per-policy\n   */\n  defaultExitPassword?: string;\n\n  /**\n   * Allow remote exit command from server\n   */\n  allowRemoteExit?: boolean;\n\n  /**\n   * Auto-lock device when kiosk app crashes\n   */\n  lockOnCrash?: boolean;\n\n  /**\n   * Restart kiosk app if it closes\n   */\n  autoRestart?: boolean;\n\n  /**\n   * Auto-restart delay in milliseconds\n   */\n  autoRestartDelay?: number;\n\n  /**\n   * Maximum exit password attempts before lock\n   */\n  maxExitAttempts?: number;\n\n  /**\n   * Lockout duration in minutes after max attempts\n   */\n  lockoutDuration?: number;\n}\n\nexport interface KioskSettings {\n  /** Enable kiosk mode */\n  enabled: boolean;\n\n  /** Kiosk mode type */\n  mode: 'single-app' | 'multi-app' | 'screen-pin';\n\n  /** Main/launcher app package name */\n  mainApp: string;\n\n  /** Allowed apps in multi-app mode */\n  allowedApps?: string[];\n\n  /** Password to exit kiosk mode (device-side) */\n  exitPassword?: string;\n\n  /** Secret gesture to trigger exit (e.g., '5-tap-corners') */\n  exitGesture?: string;\n\n  /** Lock status bar */\n  lockStatusBar?: boolean;\n\n  /** Lock navigation bar */\n  lockNavigationBar?: boolean;\n\n  /** Disable home button */\n  disableHomeButton?: boolean;\n\n  /** Disable recent apps button */\n  disableRecentApps?: boolean;\n\n  /** Disable power button (soft) */\n  disablePowerButton?: boolean;\n\n  /** Disable volume buttons */\n  disableVolumeButtons?: boolean;\n\n  /** Lock screen orientation */\n  lockOrientation?: 'portrait' | 'landscape' | 'auto';\n\n  /** Disable notifications */\n  disableNotifications?: boolean;\n\n  /** Allowed notification packages */\n  allowedNotifications?: string[];\n\n  /** Keep screen on */\n  keepScreenOn?: boolean;\n\n  /** Screen brightness (0-255, or 'auto') */\n  screenBrightness?: number | 'auto';\n\n  /** Auto-launch on boot */\n  launchOnBoot?: boolean;\n\n  /** Auto-restart on crash */\n  restartOnCrash?: boolean;\n\n  /** Restart delay in ms */\n  restartDelay?: number;\n\n  /** Custom wallpaper URL */\n  wallpaperUrl?: string;\n\n  /** Hide system UI elements */\n  immersiveMode?: boolean;\n\n  /** Allow status bar pull-down for specific items */\n  allowedStatusBarItems?: ('wifi' | 'bluetooth' | 'airplane' | 'battery')[];\n\n  /** Show clock/time */\n  showClock?: boolean;\n\n  /** Show battery indicator */\n  showBattery?: boolean;\n\n  /** Custom exit password per device (encrypted) */\n  deviceExitPasswords?: Record<string, string>;\n}\n\nexport interface KioskState {\n  deviceId: string;\n  enabled: boolean;\n  mode: 'single-app' | 'multi-app' | 'screen-pin';\n  mainApp: string;\n  activeApp?: string;\n  lockedSince?: Date;\n  exitAttempts: number;\n  lastExitAttempt?: Date;\n  lockedOut: boolean;\n  lockoutUntil?: Date;\n}\n\n// ============================================\n// Kiosk Plugin Implementation\n// ============================================\n\n/**\n * Create kiosk mode plugin\n */\nexport function kioskPlugin(options: KioskPluginOptions = {}): MDMPlugin {\n  const {\n    defaultExitPassword = 'admin',\n    allowRemoteExit = true,\n    lockOnCrash = true,\n    autoRestart = true,\n    autoRestartDelay = 1000,\n    maxExitAttempts = 5,\n    lockoutDuration = 15,\n  } = options;\n\n  let mdm: MDMInstance;\n\n  // In-memory kiosk state (should be persisted to DB in production)\n  const kioskStates = new Map<string, KioskState>();\n\n  /**\n   * Get kiosk settings from policy\n   */\n  function getKioskSettings(policy: Policy): KioskSettings | null {\n    const settings = policy.settings;\n\n    if (!settings.kioskMode || !settings.mainApp) {\n      return null;\n    }\n\n    return {\n      enabled: settings.kioskMode,\n      mode: 'single-app', // Default mode\n      mainApp: settings.mainApp,\n      allowedApps: settings.allowedApps,\n      exitPassword: settings.kioskExitPassword || defaultExitPassword,\n      lockStatusBar: settings.lockStatusBar ?? true,\n      lockNavigationBar: settings.lockNavigationBar ?? true,\n      disableHomeButton: true,\n      disableRecentApps: true,\n      disablePowerButton: settings.lockPowerButton ?? false,\n      keepScreenOn: true,\n      launchOnBoot: true,\n      restartOnCrash: autoRestart,\n      restartDelay: autoRestartDelay,\n      immersiveMode: true,\n      showClock: true,\n      showBattery: true,\n      ...(settings.custom?.kiosk as Partial<KioskSettings>),\n    };\n  }\n\n  /**\n   * Get or create kiosk state for device\n   */\n  function getKioskState(deviceId: string): KioskState | undefined {\n    return kioskStates.get(deviceId);\n  }\n\n  /**\n   * Update kiosk state\n   */\n  function updateKioskState(\n    deviceId: string,\n    updates: Partial<KioskState>\n  ): KioskState {\n    const current = kioskStates.get(deviceId) || {\n      deviceId,\n      enabled: false,\n      mode: 'single-app' as const,\n      mainApp: '',\n      exitAttempts: 0,\n      lockedOut: false,\n    };\n\n    const updated = { ...current, ...updates };\n    kioskStates.set(deviceId, updated);\n    return updated;\n  }\n\n  /**\n   * Handle exit kiosk command\n   */\n  async function handleExitKiosk(\n    device: Device,\n    command: Command\n  ): Promise<CommandResult> {\n    if (!allowRemoteExit) {\n      return {\n        success: false,\n        message: 'Remote kiosk exit is disabled',\n      };\n    }\n\n    const state = getKioskState(device.id);\n    if (!state?.enabled) {\n      return {\n        success: true,\n        message: 'Device is not in kiosk mode',\n      };\n    }\n\n    // Update state\n    updateKioskState(device.id, {\n      enabled: false,\n      exitAttempts: 0,\n      lockedOut: false,\n    });\n\n    // Emit event\n    await mdm.emit('custom', {\n      type: 'kiosk.exited',\n      deviceId: device.id,\n      method: 'remote',\n      timestamp: new Date().toISOString(),\n    });\n\n    return {\n      success: true,\n      message: 'Kiosk mode exit command sent',\n    };\n  }\n\n  /**\n   * Handle enter kiosk command\n   */\n  async function handleEnterKiosk(\n    device: Device,\n    command: Command\n  ): Promise<CommandResult> {\n    const payload = command.payload as { app?: string } | undefined;\n\n    // Get policy kiosk settings\n    let kioskSettings: KioskSettings | null = null;\n    if (device.policyId) {\n      const policy = await mdm.policies.get(device.policyId);\n      if (policy) {\n        kioskSettings = getKioskSettings(policy);\n      }\n    }\n\n    const mainApp = payload?.app || kioskSettings?.mainApp;\n    if (!mainApp) {\n      return {\n        success: false,\n        message: 'No main app specified for kiosk mode',\n      };\n    }\n\n    // Update state\n    updateKioskState(device.id, {\n      enabled: true,\n      mode: kioskSettings?.mode || 'single-app',\n      mainApp,\n      lockedSince: new Date(),\n      exitAttempts: 0,\n      lockedOut: false,\n    });\n\n    // Emit event\n    await mdm.emit('custom', {\n      type: 'kiosk.entered',\n      deviceId: device.id,\n      mainApp,\n      timestamp: new Date().toISOString(),\n    });\n\n    return {\n      success: true,\n      message: `Kiosk mode activated with ${mainApp}`,\n      data: { mainApp },\n    };\n  }\n\n  /**\n   * Validate kiosk policy settings\n   */\n  function validateKioskPolicy(\n    settings: PolicySettings\n  ): { valid: boolean; errors?: string[] } {\n    const errors: string[] = [];\n\n    if (settings.kioskMode) {\n      if (!settings.mainApp) {\n        errors.push('Kiosk mode requires a main app package name');\n      }\n\n      if (settings.allowedApps && settings.allowedApps.length > 0) {\n        if (!settings.allowedApps.includes(settings.mainApp!)) {\n          errors.push('Main app must be included in allowed apps list');\n        }\n      }\n\n      const custom = settings.custom?.kiosk as Partial<KioskSettings> | undefined;\n      if (custom?.mode === 'multi-app' && !settings.allowedApps?.length) {\n        errors.push('Multi-app kiosk mode requires allowed apps list');\n      }\n\n      if (custom?.screenBrightness !== undefined && custom.screenBrightness !== 'auto') {\n        if (typeof custom.screenBrightness === 'number') {\n          if (custom.screenBrightness < 0 || custom.screenBrightness > 255) {\n            errors.push('Screen brightness must be between 0-255 or \"auto\"');\n          }\n        }\n      }\n    }\n\n    return {\n      valid: errors.length === 0,\n      errors: errors.length > 0 ? errors : undefined,\n    };\n  }\n\n  // Define plugin routes\n  const routes: PluginRoute[] = [\n    // Get kiosk status for a device\n    {\n      method: 'GET',\n      path: '/kiosk/:deviceId/status',\n      auth: true,\n      admin: true,\n      handler: async (context: any) => {\n        const { deviceId } = context.req.param();\n        const state = getKioskState(deviceId);\n\n        if (!state) {\n          return context.json({ enabled: false });\n        }\n\n        return context.json({\n          ...state,\n          lockedSince: state.lockedSince?.toISOString(),\n          lastExitAttempt: state.lastExitAttempt?.toISOString(),\n          lockoutUntil: state.lockoutUntil?.toISOString(),\n        });\n      },\n    },\n\n    // Enter kiosk mode\n    {\n      method: 'POST',\n      path: '/kiosk/:deviceId/enter',\n      auth: true,\n      admin: true,\n      handler: async (context: any) => {\n        const { deviceId } = context.req.param();\n        const body = await context.req.json();\n\n        const command = await mdm.commands.send({\n          deviceId,\n          type: 'enterKiosk',\n          payload: { app: body.app },\n        });\n\n        return context.json({ success: true, commandId: command.id });\n      },\n    },\n\n    // Exit kiosk mode\n    {\n      method: 'POST',\n      path: '/kiosk/:deviceId/exit',\n      auth: true,\n      admin: true,\n      handler: async (context: any) => {\n        const { deviceId } = context.req.param();\n\n        const command = await mdm.commands.send({\n          deviceId,\n          type: 'exitKiosk',\n        });\n\n        return context.json({ success: true, commandId: command.id });\n      },\n    },\n\n    // Get all devices in kiosk mode\n    {\n      method: 'GET',\n      path: '/kiosk/devices',\n      auth: true,\n      admin: true,\n      handler: async (context: any) => {\n        const kioskDevices = Array.from(kioskStates.entries())\n          .filter(([_, state]) => state.enabled)\n          .map(([_, state]) => ({\n            ...state,\n            lockedSince: state.lockedSince?.toISOString(),\n          }));\n\n        return context.json({ devices: kioskDevices });\n      },\n    },\n\n    // Report exit attempt from device\n    {\n      method: 'POST',\n      path: '/kiosk/exit-attempt',\n      auth: true,\n      handler: async (context: any) => {\n        const body = await context.req.json();\n        const { deviceId, success, password } = body;\n\n        const state = getKioskState(deviceId);\n        if (!state?.enabled) {\n          return context.json({ error: 'Device not in kiosk mode' }, 400);\n        }\n\n        // Check lockout\n        if (state.lockedOut && state.lockoutUntil) {\n          if (new Date() < state.lockoutUntil) {\n            return context.json({\n              error: 'Exit attempts locked',\n              lockoutUntil: state.lockoutUntil.toISOString(),\n            }, 403);\n          } else {\n            // Lockout expired\n            updateKioskState(deviceId, {\n              lockedOut: false,\n              lockoutUntil: undefined,\n              exitAttempts: 0,\n            });\n          }\n        }\n\n        if (success) {\n          // Successful exit\n          updateKioskState(deviceId, {\n            enabled: false,\n            exitAttempts: 0,\n          });\n\n          await mdm.emit('custom', {\n            type: 'kiosk.exited',\n            deviceId,\n            method: 'local',\n            timestamp: new Date().toISOString(),\n          });\n\n          return context.json({ success: true });\n        } else {\n          // Failed attempt\n          const newAttempts = state.exitAttempts + 1;\n\n          if (newAttempts >= maxExitAttempts) {\n            // Lock out\n            const lockoutUntil = new Date(\n              Date.now() + lockoutDuration * 60 * 1000\n            );\n\n            updateKioskState(deviceId, {\n              exitAttempts: newAttempts,\n              lastExitAttempt: new Date(),\n              lockedOut: true,\n              lockoutUntil,\n            });\n\n            await mdm.emit('custom', {\n              type: 'kiosk.lockout',\n              deviceId,\n              attempts: newAttempts,\n              lockoutUntil: lockoutUntil.toISOString(),\n            });\n\n            return context.json({\n              error: 'Max attempts exceeded',\n              lockedOut: true,\n              lockoutUntil: lockoutUntil.toISOString(),\n            }, 403);\n          } else {\n            updateKioskState(deviceId, {\n              exitAttempts: newAttempts,\n              lastExitAttempt: new Date(),\n            });\n\n            return context.json({\n              error: 'Invalid password',\n              attemptsRemaining: maxExitAttempts - newAttempts,\n            }, 401);\n          }\n        }\n      },\n    },\n\n    // Report kiosk app crash from device\n    {\n      method: 'POST',\n      path: '/kiosk/app-crash',\n      auth: true,\n      handler: async (context: any) => {\n        const body = await context.req.json();\n        const { deviceId, packageName, error } = body;\n\n        await mdm.emit('custom', {\n          type: 'kiosk.appCrash',\n          deviceId,\n          packageName,\n          error,\n          timestamp: new Date().toISOString(),\n        });\n\n        const state = getKioskState(deviceId);\n        const shouldRestart = state?.enabled && autoRestart;\n\n        return context.json({\n          restart: shouldRestart,\n          restartDelay: autoRestartDelay,\n          lockDevice: lockOnCrash,\n        });\n      },\n    },\n  ];\n\n  return {\n    name: 'kiosk',\n    version: '1.0.0',\n\n    async onInit(instance: MDMInstance): Promise<void> {\n      mdm = instance;\n      console.log('[OpenMDM Kiosk] Plugin initialized');\n    },\n\n    async onDestroy(): Promise<void> {\n      kioskStates.clear();\n      console.log('[OpenMDM Kiosk] Plugin destroyed');\n    },\n\n    routes,\n\n    async onDeviceEnrolled(device: Device): Promise<void> {\n      // Initialize kiosk state for new device\n      if (device.policyId) {\n        const policy = await mdm.policies.get(device.policyId);\n        if (policy) {\n          const kioskSettings = getKioskSettings(policy);\n          if (kioskSettings?.enabled) {\n            updateKioskState(device.id, {\n              enabled: true,\n              mode: kioskSettings.mode,\n              mainApp: kioskSettings.mainApp,\n              lockedSince: new Date(),\n            });\n          }\n        }\n      }\n    },\n\n    async onHeartbeat(device: Device, heartbeat: Heartbeat): Promise<void> {\n      const state = getKioskState(device.id);\n\n      if (state?.enabled && heartbeat.runningApps) {\n        // Check if kiosk app is still running\n        const isKioskAppRunning = heartbeat.runningApps.includes(state.mainApp);\n\n        if (!isKioskAppRunning && autoRestart) {\n          // Kiosk app is not running - send restart command\n          await mdm.commands.send({\n            deviceId: device.id,\n            type: 'runApp',\n            payload: { packageName: state.mainApp },\n          });\n        }\n      }\n    },\n\n    policySchema: {\n      kioskMode: { type: 'boolean', description: 'Enable kiosk mode' },\n      mainApp: {\n        type: 'string',\n        description: 'Main kiosk app package name',\n      },\n      allowedApps: {\n        type: 'array',\n        items: { type: 'string' },\n        description: 'Allowed apps in kiosk mode',\n      },\n      kioskExitPassword: {\n        type: 'string',\n        description: 'Password to exit kiosk mode',\n      },\n    },\n\n    validatePolicy: async (settings: PolicySettings) => {\n      return validateKioskPolicy(settings);\n    },\n\n    commandTypes: ['enterKiosk', 'exitKiosk'] as any,\n\n    executeCommand: async (\n      device: Device,\n      command: Command\n    ): Promise<CommandResult> => {\n      switch (command.type) {\n        case 'enterKiosk':\n          return handleEnterKiosk(device, command);\n        case 'exitKiosk':\n          return handleExitKiosk(device, command);\n        default:\n          return {\n            success: false,\n            message: `Unknown command type: ${command.type}`,\n          };\n      }\n    },\n  };\n}\n\n// ============================================\n// Exports\n// ============================================\n\nexport type { MDMPlugin };\n"],"mappings":";AAiLO,SAAS,YAAY,UAA8B,CAAC,GAAc;AACvE,QAAM;AAAA,IACJ,sBAAsB;AAAA,IACtB,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,EACpB,IAAI;AAEJ,MAAI;AAGJ,QAAM,cAAc,oBAAI,IAAwB;AAKhD,WAAS,iBAAiB,QAAsC;AAC9D,UAAM,WAAW,OAAO;AAExB,QAAI,CAAC,SAAS,aAAa,CAAC,SAAS,SAAS;AAC5C,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,MACL,SAAS,SAAS;AAAA,MAClB,MAAM;AAAA;AAAA,MACN,SAAS,SAAS;AAAA,MAClB,aAAa,SAAS;AAAA,MACtB,cAAc,SAAS,qBAAqB;AAAA,MAC5C,eAAe,SAAS,iBAAiB;AAAA,MACzC,mBAAmB,SAAS,qBAAqB;AAAA,MACjD,mBAAmB;AAAA,MACnB,mBAAmB;AAAA,MACnB,oBAAoB,SAAS,mBAAmB;AAAA,MAChD,cAAc;AAAA,MACd,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,cAAc;AAAA,MACd,eAAe;AAAA,MACf,WAAW;AAAA,MACX,aAAa;AAAA,MACb,GAAI,SAAS,QAAQ;AAAA,IACvB;AAAA,EACF;AAKA,WAAS,cAAc,UAA0C;AAC/D,WAAO,YAAY,IAAI,QAAQ;AAAA,EACjC;AAKA,WAAS,iBACP,UACA,SACY;AACZ,UAAM,UAAU,YAAY,IAAI,QAAQ,KAAK;AAAA,MAC3C;AAAA,MACA,SAAS;AAAA,MACT,MAAM;AAAA,MACN,SAAS;AAAA,MACT,cAAc;AAAA,MACd,WAAW;AAAA,IACb;AAEA,UAAM,UAAU,EAAE,GAAG,SAAS,GAAG,QAAQ;AACzC,gBAAY,IAAI,UAAU,OAAO;AACjC,WAAO;AAAA,EACT;AAKA,iBAAe,gBACb,QACA,SACwB;AACxB,QAAI,CAAC,iBAAiB;AACpB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,QAAQ,cAAc,OAAO,EAAE;AACrC,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAGA,qBAAiB,OAAO,IAAI;AAAA,MAC1B,SAAS;AAAA,MACT,cAAc;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AAGD,UAAM,IAAI,KAAK,UAAU;AAAA,MACvB,MAAM;AAAA,MACN,UAAU,OAAO;AAAA,MACjB,QAAQ;AAAA,MACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,CAAC;AAED,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF;AAKA,iBAAe,iBACb,QACA,SACwB;AACxB,UAAM,UAAU,QAAQ;AAGxB,QAAI,gBAAsC;AAC1C,QAAI,OAAO,UAAU;AACnB,YAAM,SAAS,MAAM,IAAI,SAAS,IAAI,OAAO,QAAQ;AACrD,UAAI,QAAQ;AACV,wBAAgB,iBAAiB,MAAM;AAAA,MACzC;AAAA,IACF;AAEA,UAAM,UAAU,SAAS,OAAO,eAAe;AAC/C,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAGA,qBAAiB,OAAO,IAAI;AAAA,MAC1B,SAAS;AAAA,MACT,MAAM,eAAe,QAAQ;AAAA,MAC7B;AAAA,MACA,aAAa,oBAAI,KAAK;AAAA,MACtB,cAAc;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AAGD,UAAM,IAAI,KAAK,UAAU;AAAA,MACvB,MAAM;AAAA,MACN,UAAU,OAAO;AAAA,MACjB;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,CAAC;AAED,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS,6BAA6B,OAAO;AAAA,MAC7C,MAAM,EAAE,QAAQ;AAAA,IAClB;AAAA,EACF;AAKA,WAAS,oBACP,UACuC;AACvC,UAAM,SAAmB,CAAC;AAE1B,QAAI,SAAS,WAAW;AACtB,UAAI,CAAC,SAAS,SAAS;AACrB,eAAO,KAAK,6CAA6C;AAAA,MAC3D;AAEA,UAAI,SAAS,eAAe,SAAS,YAAY,SAAS,GAAG;AAC3D,YAAI,CAAC,SAAS,YAAY,SAAS,SAAS,OAAQ,GAAG;AACrD,iBAAO,KAAK,gDAAgD;AAAA,QAC9D;AAAA,MACF;AAEA,YAAM,SAAS,SAAS,QAAQ;AAChC,UAAI,QAAQ,SAAS,eAAe,CAAC,SAAS,aAAa,QAAQ;AACjE,eAAO,KAAK,iDAAiD;AAAA,MAC/D;AAEA,UAAI,QAAQ,qBAAqB,UAAa,OAAO,qBAAqB,QAAQ;AAChF,YAAI,OAAO,OAAO,qBAAqB,UAAU;AAC/C,cAAI,OAAO,mBAAmB,KAAK,OAAO,mBAAmB,KAAK;AAChE,mBAAO,KAAK,mDAAmD;AAAA,UACjE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,OAAO,WAAW;AAAA,MACzB,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,IACvC;AAAA,EACF;AAGA,QAAM,SAAwB;AAAA;AAAA,IAE5B;AAAA,MACE,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,OAAO,YAAiB;AAC/B,cAAM,EAAE,SAAS,IAAI,QAAQ,IAAI,MAAM;AACvC,cAAM,QAAQ,cAAc,QAAQ;AAEpC,YAAI,CAAC,OAAO;AACV,iBAAO,QAAQ,KAAK,EAAE,SAAS,MAAM,CAAC;AAAA,QACxC;AAEA,eAAO,QAAQ,KAAK;AAAA,UAClB,GAAG;AAAA,UACH,aAAa,MAAM,aAAa,YAAY;AAAA,UAC5C,iBAAiB,MAAM,iBAAiB,YAAY;AAAA,UACpD,cAAc,MAAM,cAAc,YAAY;AAAA,QAChD,CAAC;AAAA,MACH;AAAA,IACF;AAAA;AAAA,IAGA;AAAA,MACE,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,OAAO,YAAiB;AAC/B,cAAM,EAAE,SAAS,IAAI,QAAQ,IAAI,MAAM;AACvC,cAAM,OAAO,MAAM,QAAQ,IAAI,KAAK;AAEpC,cAAM,UAAU,MAAM,IAAI,SAAS,KAAK;AAAA,UACtC;AAAA,UACA,MAAM;AAAA,UACN,SAAS,EAAE,KAAK,KAAK,IAAI;AAAA,QAC3B,CAAC;AAED,eAAO,QAAQ,KAAK,EAAE,SAAS,MAAM,WAAW,QAAQ,GAAG,CAAC;AAAA,MAC9D;AAAA,IACF;AAAA;AAAA,IAGA;AAAA,MACE,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,OAAO,YAAiB;AAC/B,cAAM,EAAE,SAAS,IAAI,QAAQ,IAAI,MAAM;AAEvC,cAAM,UAAU,MAAM,IAAI,SAAS,KAAK;AAAA,UACtC;AAAA,UACA,MAAM;AAAA,QACR,CAAC;AAED,eAAO,QAAQ,KAAK,EAAE,SAAS,MAAM,WAAW,QAAQ,GAAG,CAAC;AAAA,MAC9D;AAAA,IACF;AAAA;AAAA,IAGA;AAAA,MACE,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,OAAO,YAAiB;AAC/B,cAAM,eAAe,MAAM,KAAK,YAAY,QAAQ,CAAC,EAClD,OAAO,CAAC,CAAC,GAAG,KAAK,MAAM,MAAM,OAAO,EACpC,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;AAAA,UACpB,GAAG;AAAA,UACH,aAAa,MAAM,aAAa,YAAY;AAAA,QAC9C,EAAE;AAEJ,eAAO,QAAQ,KAAK,EAAE,SAAS,aAAa,CAAC;AAAA,MAC/C;AAAA,IACF;AAAA;AAAA,IAGA;AAAA,MACE,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,OAAO,YAAiB;AAC/B,cAAM,OAAO,MAAM,QAAQ,IAAI,KAAK;AACpC,cAAM,EAAE,UAAU,SAAS,SAAS,IAAI;AAExC,cAAM,QAAQ,cAAc,QAAQ;AACpC,YAAI,CAAC,OAAO,SAAS;AACnB,iBAAO,QAAQ,KAAK,EAAE,OAAO,2BAA2B,GAAG,GAAG;AAAA,QAChE;AAGA,YAAI,MAAM,aAAa,MAAM,cAAc;AACzC,cAAI,oBAAI,KAAK,IAAI,MAAM,cAAc;AACnC,mBAAO,QAAQ,KAAK;AAAA,cAClB,OAAO;AAAA,cACP,cAAc,MAAM,aAAa,YAAY;AAAA,YAC/C,GAAG,GAAG;AAAA,UACR,OAAO;AAEL,6BAAiB,UAAU;AAAA,cACzB,WAAW;AAAA,cACX,cAAc;AAAA,cACd,cAAc;AAAA,YAChB,CAAC;AAAA,UACH;AAAA,QACF;AAEA,YAAI,SAAS;AAEX,2BAAiB,UAAU;AAAA,YACzB,SAAS;AAAA,YACT,cAAc;AAAA,UAChB,CAAC;AAED,gBAAM,IAAI,KAAK,UAAU;AAAA,YACvB,MAAM;AAAA,YACN;AAAA,YACA,QAAQ;AAAA,YACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,UACpC,CAAC;AAED,iBAAO,QAAQ,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,QACvC,OAAO;AAEL,gBAAM,cAAc,MAAM,eAAe;AAEzC,cAAI,eAAe,iBAAiB;AAElC,kBAAM,eAAe,IAAI;AAAA,cACvB,KAAK,IAAI,IAAI,kBAAkB,KAAK;AAAA,YACtC;AAEA,6BAAiB,UAAU;AAAA,cACzB,cAAc;AAAA,cACd,iBAAiB,oBAAI,KAAK;AAAA,cAC1B,WAAW;AAAA,cACX;AAAA,YACF,CAAC;AAED,kBAAM,IAAI,KAAK,UAAU;AAAA,cACvB,MAAM;AAAA,cACN;AAAA,cACA,UAAU;AAAA,cACV,cAAc,aAAa,YAAY;AAAA,YACzC,CAAC;AAED,mBAAO,QAAQ,KAAK;AAAA,cAClB,OAAO;AAAA,cACP,WAAW;AAAA,cACX,cAAc,aAAa,YAAY;AAAA,YACzC,GAAG,GAAG;AAAA,UACR,OAAO;AACL,6BAAiB,UAAU;AAAA,cACzB,cAAc;AAAA,cACd,iBAAiB,oBAAI,KAAK;AAAA,YAC5B,CAAC;AAED,mBAAO,QAAQ,KAAK;AAAA,cAClB,OAAO;AAAA,cACP,mBAAmB,kBAAkB;AAAA,YACvC,GAAG,GAAG;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA;AAAA,IAGA;AAAA,MACE,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,OAAO,YAAiB;AAC/B,cAAM,OAAO,MAAM,QAAQ,IAAI,KAAK;AACpC,cAAM,EAAE,UAAU,aAAa,MAAM,IAAI;AAEzC,cAAM,IAAI,KAAK,UAAU;AAAA,UACvB,MAAM;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,UACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,CAAC;AAED,cAAM,QAAQ,cAAc,QAAQ;AACpC,cAAM,gBAAgB,OAAO,WAAW;AAExC,eAAO,QAAQ,KAAK;AAAA,UAClB,SAAS;AAAA,UACT,cAAc;AAAA,UACd,YAAY;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IAET,MAAM,OAAO,UAAsC;AACjD,YAAM;AACN,cAAQ,IAAI,oCAAoC;AAAA,IAClD;AAAA,IAEA,MAAM,YAA2B;AAC/B,kBAAY,MAAM;AAClB,cAAQ,IAAI,kCAAkC;AAAA,IAChD;AAAA,IAEA;AAAA,IAEA,MAAM,iBAAiB,QAA+B;AAEpD,UAAI,OAAO,UAAU;AACnB,cAAM,SAAS,MAAM,IAAI,SAAS,IAAI,OAAO,QAAQ;AACrD,YAAI,QAAQ;AACV,gBAAM,gBAAgB,iBAAiB,MAAM;AAC7C,cAAI,eAAe,SAAS;AAC1B,6BAAiB,OAAO,IAAI;AAAA,cAC1B,SAAS;AAAA,cACT,MAAM,cAAc;AAAA,cACpB,SAAS,cAAc;AAAA,cACvB,aAAa,oBAAI,KAAK;AAAA,YACxB,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,YAAY,QAAgB,WAAqC;AACrE,YAAM,QAAQ,cAAc,OAAO,EAAE;AAErC,UAAI,OAAO,WAAW,UAAU,aAAa;AAE3C,cAAM,oBAAoB,UAAU,YAAY,SAAS,MAAM,OAAO;AAEtE,YAAI,CAAC,qBAAqB,aAAa;AAErC,gBAAM,IAAI,SAAS,KAAK;AAAA,YACtB,UAAU,OAAO;AAAA,YACjB,MAAM;AAAA,YACN,SAAS,EAAE,aAAa,MAAM,QAAQ;AAAA,UACxC,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,IAEA,cAAc;AAAA,MACZ,WAAW,EAAE,MAAM,WAAW,aAAa,oBAAoB;AAAA,MAC/D,SAAS;AAAA,QACP,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,aAAa;AAAA,QACX,MAAM;AAAA,QACN,OAAO,EAAE,MAAM,SAAS;AAAA,QACxB,aAAa;AAAA,MACf;AAAA,MACA,mBAAmB;AAAA,QACjB,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IAEA,gBAAgB,OAAO,aAA6B;AAClD,aAAO,oBAAoB,QAAQ;AAAA,IACrC;AAAA,IAEA,cAAc,CAAC,cAAc,WAAW;AAAA,IAExC,gBAAgB,OACd,QACA,YAC2B;AAC3B,cAAQ,QAAQ,MAAM;AAAA,QACpB,KAAK;AACH,iBAAO,iBAAiB,QAAQ,OAAO;AAAA,QACzC,KAAK;AACH,iBAAO,gBAAgB,QAAQ,OAAO;AAAA,QACxC;AACE,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,SAAS,yBAAyB,QAAQ,IAAI;AAAA,UAChD;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@openmdm/plugin-kiosk",
+  "version": "0.2.0",
+  "description": "Kiosk mode plugin for OpenMDM - single-app lock down mode for Android devices",
+  "author": "OpenMDM Contributors",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "dependencies": {
+    "@openmdm/core": "0.2.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.0.0",
+    "typescript": "^5.5.0"
+  },
+  "keywords": [
+    "openmdm",
+    "kiosk",
+    "lockdown",
+    "single-app",
+    "mdm"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/azoila/openmdm.git",
+    "directory": "packages/plugins/kiosk"
+  },
+  "homepage": "https://openmdm.dev",
+  "bugs": {
+    "url": "https://github.com/azoila/openmdm/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  }
+}

package/src/index.ts

@@ -0,0 +1,685 @@
+/**
+ * OpenMDM Kiosk Mode Plugin
+ *
+ * Provides kiosk/lockdown mode functionality for Android devices.
+ * Supports single-app mode, multi-app kiosk, and screen pinning.
+ *
+ * @example
+ * ```typescript
+ * import { createMDM } from '@openmdm/core';
+ * import { kioskPlugin } from '@openmdm/plugin-kiosk';
+ *
+ * const mdm = createMDM({
+ *   database: drizzleAdapter(db),
+ *   plugins: [
+ *     kioskPlugin({
+ *       defaultExitPassword: 'admin123',
+ *       allowRemoteExit: true,
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+
+import type {
+  MDMPlugin,
+  MDMInstance,
+  Device,
+  Policy,
+  PolicySettings,
+  Command,
+  CommandResult,
+  Heartbeat,
+  PluginRoute,
+} from '@openmdm/core';
+
+// ============================================
+// Kiosk Types
+// ============================================
+
+export interface KioskPluginOptions {
+  /**
+   * Default password for exiting kiosk mode
+   * Can be overridden per-policy
+   */
+  defaultExitPassword?: string;
+
+  /**
+   * Allow remote exit command from server
+   */
+  allowRemoteExit?: boolean;
+
+  /**
+   * Auto-lock device when kiosk app crashes
+   */
+  lockOnCrash?: boolean;
+
+  /**
+   * Restart kiosk app if it closes
+   */
+  autoRestart?: boolean;
+
+  /**
+   * Auto-restart delay in milliseconds
+   */
+  autoRestartDelay?: number;
+
+  /**
+   * Maximum exit password attempts before lock
+   */
+  maxExitAttempts?: number;
+
+  /**
+   * Lockout duration in minutes after max attempts
+   */
+  lockoutDuration?: number;
+}
+
+export interface KioskSettings {
+  /** Enable kiosk mode */
+  enabled: boolean;
+
+  /** Kiosk mode type */
+  mode: 'single-app' | 'multi-app' | 'screen-pin';
+
+  /** Main/launcher app package name */
+  mainApp: string;
+
+  /** Allowed apps in multi-app mode */
+  allowedApps?: string[];
+
+  /** Password to exit kiosk mode (device-side) */
+  exitPassword?: string;
+
+  /** Secret gesture to trigger exit (e.g., '5-tap-corners') */
+  exitGesture?: string;
+
+  /** Lock status bar */
+  lockStatusBar?: boolean;
+
+  /** Lock navigation bar */
+  lockNavigationBar?: boolean;
+
+  /** Disable home button */
+  disableHomeButton?: boolean;
+
+  /** Disable recent apps button */
+  disableRecentApps?: boolean;
+
+  /** Disable power button (soft) */
+  disablePowerButton?: boolean;
+
+  /** Disable volume buttons */
+  disableVolumeButtons?: boolean;
+
+  /** Lock screen orientation */
+  lockOrientation?: 'portrait' | 'landscape' | 'auto';
+
+  /** Disable notifications */
+  disableNotifications?: boolean;
+
+  /** Allowed notification packages */
+  allowedNotifications?: string[];
+
+  /** Keep screen on */
+  keepScreenOn?: boolean;
+
+  /** Screen brightness (0-255, or 'auto') */
+  screenBrightness?: number | 'auto';
+
+  /** Auto-launch on boot */
+  launchOnBoot?: boolean;
+
+  /** Auto-restart on crash */
+  restartOnCrash?: boolean;
+
+  /** Restart delay in ms */
+  restartDelay?: number;
+
+  /** Custom wallpaper URL */
+  wallpaperUrl?: string;
+
+  /** Hide system UI elements */
+  immersiveMode?: boolean;
+
+  /** Allow status bar pull-down for specific items */
+  allowedStatusBarItems?: ('wifi' | 'bluetooth' | 'airplane' | 'battery')[];
+
+  /** Show clock/time */
+  showClock?: boolean;
+
+  /** Show battery indicator */
+  showBattery?: boolean;
+
+  /** Custom exit password per device (encrypted) */
+  deviceExitPasswords?: Record<string, string>;
+}
+
+export interface KioskState {
+  deviceId: string;
+  enabled: boolean;
+  mode: 'single-app' | 'multi-app' | 'screen-pin';
+  mainApp: string;
+  activeApp?: string;
+  lockedSince?: Date;
+  exitAttempts: number;
+  lastExitAttempt?: Date;
+  lockedOut: boolean;
+  lockoutUntil?: Date;
+}
+
+// ============================================
+// Kiosk Plugin Implementation
+// ============================================
+
+/**
+ * Create kiosk mode plugin
+ */
+export function kioskPlugin(options: KioskPluginOptions = {}): MDMPlugin {
+  const {
+    defaultExitPassword = 'admin',
+    allowRemoteExit = true,
+    lockOnCrash = true,
+    autoRestart = true,
+    autoRestartDelay = 1000,
+    maxExitAttempts = 5,
+    lockoutDuration = 15,
+  } = options;
+
+  let mdm: MDMInstance;
+
+  // In-memory kiosk state (should be persisted to DB in production)
+  const kioskStates = new Map<string, KioskState>();
+
+  /**
+   * Get kiosk settings from policy
+   */
+  function getKioskSettings(policy: Policy): KioskSettings | null {
+    const settings = policy.settings;
+
+    if (!settings.kioskMode || !settings.mainApp) {
+      return null;
+    }
+
+    return {
+      enabled: settings.kioskMode,
+      mode: 'single-app', // Default mode
+      mainApp: settings.mainApp,
+      allowedApps: settings.allowedApps,
+      exitPassword: settings.kioskExitPassword || defaultExitPassword,
+      lockStatusBar: settings.lockStatusBar ?? true,
+      lockNavigationBar: settings.lockNavigationBar ?? true,
+      disableHomeButton: true,
+      disableRecentApps: true,
+      disablePowerButton: settings.lockPowerButton ?? false,
+      keepScreenOn: true,
+      launchOnBoot: true,
+      restartOnCrash: autoRestart,
+      restartDelay: autoRestartDelay,
+      immersiveMode: true,
+      showClock: true,
+      showBattery: true,
+      ...(settings.custom?.kiosk as Partial<KioskSettings>),
+    };
+  }
+
+  /**
+   * Get or create kiosk state for device
+   */
+  function getKioskState(deviceId: string): KioskState | undefined {
+    return kioskStates.get(deviceId);
+  }
+
+  /**
+   * Update kiosk state
+   */
+  function updateKioskState(
+    deviceId: string,
+    updates: Partial<KioskState>
+  ): KioskState {
+    const current = kioskStates.get(deviceId) || {
+      deviceId,
+      enabled: false,
+      mode: 'single-app' as const,
+      mainApp: '',
+      exitAttempts: 0,
+      lockedOut: false,
+    };
+
+    const updated = { ...current, ...updates };
+    kioskStates.set(deviceId, updated);
+    return updated;
+  }
+
+  /**
+   * Handle exit kiosk command
+   */
+  async function handleExitKiosk(
+    device: Device,
+    command: Command
+  ): Promise<CommandResult> {
+    if (!allowRemoteExit) {
+      return {
+        success: false,
+        message: 'Remote kiosk exit is disabled',
+      };
+    }
+
+    const state = getKioskState(device.id);
+    if (!state?.enabled) {
+      return {
+        success: true,
+        message: 'Device is not in kiosk mode',
+      };
+    }
+
+    // Update state
+    updateKioskState(device.id, {
+      enabled: false,
+      exitAttempts: 0,
+      lockedOut: false,
+    });
+
+    // Emit event
+    await mdm.emit('custom', {
+      type: 'kiosk.exited',
+      deviceId: device.id,
+      method: 'remote',
+      timestamp: new Date().toISOString(),
+    });
+
+    return {
+      success: true,
+      message: 'Kiosk mode exit command sent',
+    };
+  }
+
+  /**
+   * Handle enter kiosk command
+   */
+  async function handleEnterKiosk(
+    device: Device,
+    command: Command
+  ): Promise<CommandResult> {
+    const payload = command.payload as { app?: string } | undefined;
+
+    // Get policy kiosk settings
+    let kioskSettings: KioskSettings | null = null;
+    if (device.policyId) {
+      const policy = await mdm.policies.get(device.policyId);
+      if (policy) {
+        kioskSettings = getKioskSettings(policy);
+      }
+    }
+
+    const mainApp = payload?.app || kioskSettings?.mainApp;
+    if (!mainApp) {
+      return {
+        success: false,
+        message: 'No main app specified for kiosk mode',
+      };
+    }
+
+    // Update state
+    updateKioskState(device.id, {
+      enabled: true,
+      mode: kioskSettings?.mode || 'single-app',
+      mainApp,
+      lockedSince: new Date(),
+      exitAttempts: 0,
+      lockedOut: false,
+    });
+
+    // Emit event
+    await mdm.emit('custom', {
+      type: 'kiosk.entered',
+      deviceId: device.id,
+      mainApp,
+      timestamp: new Date().toISOString(),
+    });
+
+    return {
+      success: true,
+      message: `Kiosk mode activated with ${mainApp}`,
+      data: { mainApp },
+    };
+  }
+
+  /**
+   * Validate kiosk policy settings
+   */
+  function validateKioskPolicy(
+    settings: PolicySettings
+  ): { valid: boolean; errors?: string[] } {
+    const errors: string[] = [];
+
+    if (settings.kioskMode) {
+      if (!settings.mainApp) {
+        errors.push('Kiosk mode requires a main app package name');
+      }
+
+      if (settings.allowedApps && settings.allowedApps.length > 0) {
+        if (!settings.allowedApps.includes(settings.mainApp!)) {
+          errors.push('Main app must be included in allowed apps list');
+        }
+      }
+
+      const custom = settings.custom?.kiosk as Partial<KioskSettings> | undefined;
+      if (custom?.mode === 'multi-app' && !settings.allowedApps?.length) {
+        errors.push('Multi-app kiosk mode requires allowed apps list');
+      }
+
+      if (custom?.screenBrightness !== undefined && custom.screenBrightness !== 'auto') {
+        if (typeof custom.screenBrightness === 'number') {
+          if (custom.screenBrightness < 0 || custom.screenBrightness > 255) {
+            errors.push('Screen brightness must be between 0-255 or "auto"');
+          }
+        }
+      }
+    }
+
+    return {
+      valid: errors.length === 0,
+      errors: errors.length > 0 ? errors : undefined,
+    };
+  }
+
+  // Define plugin routes
+  const routes: PluginRoute[] = [
+    // Get kiosk status for a device
+    {
+      method: 'GET',
+      path: '/kiosk/:deviceId/status',
+      auth: true,
+      admin: true,
+      handler: async (context: any) => {
+        const { deviceId } = context.req.param();
+        const state = getKioskState(deviceId);
+
+        if (!state) {
+          return context.json({ enabled: false });
+        }
+
+        return context.json({
+          ...state,
+          lockedSince: state.lockedSince?.toISOString(),
+          lastExitAttempt: state.lastExitAttempt?.toISOString(),
+          lockoutUntil: state.lockoutUntil?.toISOString(),
+        });
+      },
+    },
+
+    // Enter kiosk mode
+    {
+      method: 'POST',
+      path: '/kiosk/:deviceId/enter',
+      auth: true,
+      admin: true,
+      handler: async (context: any) => {
+        const { deviceId } = context.req.param();
+        const body = await context.req.json();
+
+        const command = await mdm.commands.send({
+          deviceId,
+          type: 'enterKiosk',
+          payload: { app: body.app },
+        });
+
+        return context.json({ success: true, commandId: command.id });
+      },
+    },
+
+    // Exit kiosk mode
+    {
+      method: 'POST',
+      path: '/kiosk/:deviceId/exit',
+      auth: true,
+      admin: true,
+      handler: async (context: any) => {
+        const { deviceId } = context.req.param();
+
+        const command = await mdm.commands.send({
+          deviceId,
+          type: 'exitKiosk',
+        });
+
+        return context.json({ success: true, commandId: command.id });
+      },
+    },
+
+    // Get all devices in kiosk mode
+    {
+      method: 'GET',
+      path: '/kiosk/devices',
+      auth: true,
+      admin: true,
+      handler: async (context: any) => {
+        const kioskDevices = Array.from(kioskStates.entries())
+          .filter(([_, state]) => state.enabled)
+          .map(([_, state]) => ({
+            ...state,
+            lockedSince: state.lockedSince?.toISOString(),
+          }));
+
+        return context.json({ devices: kioskDevices });
+      },
+    },
+
+    // Report exit attempt from device
+    {
+      method: 'POST',
+      path: '/kiosk/exit-attempt',
+      auth: true,
+      handler: async (context: any) => {
+        const body = await context.req.json();
+        const { deviceId, success, password } = body;
+
+        const state = getKioskState(deviceId);
+        if (!state?.enabled) {
+          return context.json({ error: 'Device not in kiosk mode' }, 400);
+        }
+
+        // Check lockout
+        if (state.lockedOut && state.lockoutUntil) {
+          if (new Date() < state.lockoutUntil) {
+            return context.json({
+              error: 'Exit attempts locked',
+              lockoutUntil: state.lockoutUntil.toISOString(),
+            }, 403);
+          } else {
+            // Lockout expired
+            updateKioskState(deviceId, {
+              lockedOut: false,
+              lockoutUntil: undefined,
+              exitAttempts: 0,
+            });
+          }
+        }
+
+        if (success) {
+          // Successful exit
+          updateKioskState(deviceId, {
+            enabled: false,
+            exitAttempts: 0,
+          });
+
+          await mdm.emit('custom', {
+            type: 'kiosk.exited',
+            deviceId,
+            method: 'local',
+            timestamp: new Date().toISOString(),
+          });
+
+          return context.json({ success: true });
+        } else {
+          // Failed attempt
+          const newAttempts = state.exitAttempts + 1;
+
+          if (newAttempts >= maxExitAttempts) {
+            // Lock out
+            const lockoutUntil = new Date(
+              Date.now() + lockoutDuration * 60 * 1000
+            );
+
+            updateKioskState(deviceId, {
+              exitAttempts: newAttempts,
+              lastExitAttempt: new Date(),
+              lockedOut: true,
+              lockoutUntil,
+            });
+
+            await mdm.emit('custom', {
+              type: 'kiosk.lockout',
+              deviceId,
+              attempts: newAttempts,
+              lockoutUntil: lockoutUntil.toISOString(),
+            });
+
+            return context.json({
+              error: 'Max attempts exceeded',
+              lockedOut: true,
+              lockoutUntil: lockoutUntil.toISOString(),
+            }, 403);
+          } else {
+            updateKioskState(deviceId, {
+              exitAttempts: newAttempts,
+              lastExitAttempt: new Date(),
+            });
+
+            return context.json({
+              error: 'Invalid password',
+              attemptsRemaining: maxExitAttempts - newAttempts,
+            }, 401);
+          }
+        }
+      },
+    },
+
+    // Report kiosk app crash from device
+    {
+      method: 'POST',
+      path: '/kiosk/app-crash',
+      auth: true,
+      handler: async (context: any) => {
+        const body = await context.req.json();
+        const { deviceId, packageName, error } = body;
+
+        await mdm.emit('custom', {
+          type: 'kiosk.appCrash',
+          deviceId,
+          packageName,
+          error,
+          timestamp: new Date().toISOString(),
+        });
+
+        const state = getKioskState(deviceId);
+        const shouldRestart = state?.enabled && autoRestart;
+
+        return context.json({
+          restart: shouldRestart,
+          restartDelay: autoRestartDelay,
+          lockDevice: lockOnCrash,
+        });
+      },
+    },
+  ];
+
+  return {
+    name: 'kiosk',
+    version: '1.0.0',
+
+    async onInit(instance: MDMInstance): Promise<void> {
+      mdm = instance;
+      console.log('[OpenMDM Kiosk] Plugin initialized');
+    },
+
+    async onDestroy(): Promise<void> {
+      kioskStates.clear();
+      console.log('[OpenMDM Kiosk] Plugin destroyed');
+    },
+
+    routes,
+
+    async onDeviceEnrolled(device: Device): Promise<void> {
+      // Initialize kiosk state for new device
+      if (device.policyId) {
+        const policy = await mdm.policies.get(device.policyId);
+        if (policy) {
+          const kioskSettings = getKioskSettings(policy);
+          if (kioskSettings?.enabled) {
+            updateKioskState(device.id, {
+              enabled: true,
+              mode: kioskSettings.mode,
+              mainApp: kioskSettings.mainApp,
+              lockedSince: new Date(),
+            });
+          }
+        }
+      }
+    },
+
+    async onHeartbeat(device: Device, heartbeat: Heartbeat): Promise<void> {
+      const state = getKioskState(device.id);
+
+      if (state?.enabled && heartbeat.runningApps) {
+        // Check if kiosk app is still running
+        const isKioskAppRunning = heartbeat.runningApps.includes(state.mainApp);
+
+        if (!isKioskAppRunning && autoRestart) {
+          // Kiosk app is not running - send restart command
+          await mdm.commands.send({
+            deviceId: device.id,
+            type: 'runApp',
+            payload: { packageName: state.mainApp },
+          });
+        }
+      }
+    },
+
+    policySchema: {
+      kioskMode: { type: 'boolean', description: 'Enable kiosk mode' },
+      mainApp: {
+        type: 'string',
+        description: 'Main kiosk app package name',
+      },
+      allowedApps: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'Allowed apps in kiosk mode',
+      },
+      kioskExitPassword: {
+        type: 'string',
+        description: 'Password to exit kiosk mode',
+      },
+    },
+
+    validatePolicy: async (settings: PolicySettings) => {
+      return validateKioskPolicy(settings);
+    },
+
+    commandTypes: ['enterKiosk', 'exitKiosk'] as any,
+
+    executeCommand: async (
+      device: Device,
+      command: Command
+    ): Promise<CommandResult> => {
+      switch (command.type) {
+        case 'enterKiosk':
+          return handleEnterKiosk(device, command);
+        case 'exitKiosk':
+          return handleExitKiosk(device, command);
+        default:
+          return {
+            success: false,
+            message: `Unknown command type: ${command.type}`,
+          };
+      }
+    },
+  };
+}
+
+// ============================================
+// Exports
+// ============================================
+
+export type { MDMPlugin };