@sagentix-inc/evidence-collector 0.2.0 → 0.3.0

package/collector/src/sources/ivanti_mdm.js

@@ -0,0 +1,276 @@
+// Ivanti Neurons for MDM (formerly MobileIron Cloud), read through its Customer Integration API with GET only, as a
+// dedicated admin user that holds the Device Read Only role and nothing more. No token request is made: the API
+// takes HTTP Basic authentication on every call.
+//
+// Pages read 2026-10-28 (help.ivanti.com, through r.jina.ai because the Mac's direct requests met a Cloudflare block):
+//   Customer Integration API Guide, MDMCustomerIntegrationAPIGuide/ (revision history last entry 2026-10-15):
+//     "MobileIron Cloud API Basics.htm": Basic Authentication on every call; when the admin portal requires a password
+//       and PIN (MFA), Basic does not work and Token-Based Authentication must be used. Rows: at most 500 per page
+//       (rows=, start=); device searches page efficiently with sortFields[0].name=id&sortFields[0].order=ASC and
+//       searchAfterValues[0]=<last id>, and start must not be used at 10,000 or more. 401 means credentials missing or
+//       wrong, 403 "a resource that does not belong to you". The device space id ("dmPartitionId", spaces were once
+//       called partitions) is needed for device calls; the default one is defaultDmPartitionId in Get Tenant Metadata.
+//       A GDPR profile on the API user obfuscates fields such as the serial number.
+//     default.htm: integrations must handle 429 (rate limited) and 503 and retry later. No numeric limit is published.
+//     "Device API Calls.htm": Get Device Details, GET /api/v1/device/{id} -> { errors, result: { id, platformType,
+//       platformVersion, lastCheckin ("Last client checkin"), registrationState, serialNumber, complianceState,
+//       passcodeCompliant (iOS only, null elsewhere), passcodeCompliantWithProfiles ("compliant with EMM profiles",
+//       iOS and Android only), osxFdeEnabled, osxFirewallSettings, osxSystemIntegrityProtectionEnabled, ... } };
+//       "Get Device without Signature Parameter", GET /api/v1/device -> { errors, result: { searchResults: [ ... ] } }
+//       with bitLockerEncryptionStatus and an epoch-millisecond lastCheckin in its example. Both say "This call
+//       requires Tenant Admin credentials"; "Key Concepts.htm" defines Tenant Admin as the API role "used for all other
+//       API calls" (System Admin being for tenant creation and licensing).
+//     "Token-Based Authentication.htm": POST /oauth2/token with an OIDC client's id and secret in a Basic header. Not
+//       used here: oauth.ts sends the client secret in the form body only.
+//   OpenAPI file https://help.ivanti.com/mi/help/en_us/CLD/8x/api/test.json (info.version NA2), linked from
+//     "Test the APIs.htm": GET /api/v1/device (dmPartitionId required; rows, start, sortFields[0].name/order,
+//     searchAfterValues), GET /api/v1/device/{id} (DeviceDetailView), GET /api/v1/metadata/tenant ("safe for
+//     consumption by any authenticated user"; defaultDmPartitionId). Types: complianceState, osxFdeEnabled,
+//     osxSystemIntegrityProtectionEnabled, passcodeCompliant(WithProfiles) boolean; osxFirewallSettings.firewallEnabled
+//     boolean; bitLockerEncryptionStatus NOT_ENCRYPTED | FULLY_ENCRYPTED | PARTIALLY_ENCRYPTED | UNKNOWN; platformType
+//     ANDROID | BLACKBERRY | IOS | OSX | WINDOWS_PHONE | CHROME_OS | UNKNOWN; registrationState ACTIVE, RETIRE_*, WIPE_*,
+//     PROVISIONING, RELINQ_*; lastCheckin "date-time" (the guide's example is epoch milliseconds, so both are read).
+//   Administrator Guide 128 (help.ivanti.com/mi/help/en_US/CLD/admin/ivanti/128/all/en-us/): User_Roles.htm, "Device
+//     Read Only: Allows an administrator to view device groups, configurations and policies" (space-specific);
+//     Assigning_Roles.htm (Users > Users > Actions > Assign Roles); Roles_Management.htm (a custom space-specific role
+//     may hold only the "View Device" permission).
+//
+// [Unverified] The guide does not say which admin role GET /api/v1/device and GET /api/v1/device/{id} accept beyond
+// "Tenant Admin credentials"; it names Device Read Only only for other device GETs (custom attributes, certificates).
+// The collector only ever sends GET, so a role that falls short gives HTTP 403, reported as skipped.
+// [Unverified] The platformType a Windows 10/11 desktop reports is not in the enum, so Windows encryption is read from
+// bitLockerEncryptionStatus wherever a device reports one, whatever its platformType.
+//
+// Left out: Windows firewall (the example's firewallStatus -1 has no documented meaning), pending OS updates
+// (availableOSUpdates is a bare string list with no description), and the idle time before lock (no field).
+//
+// Personal data: a device is named by its Ivanti id and serial number. deviceName, displayName, firstName, lastName,
+// uid, emailAddress, phone numbers, IMEI, ICCID, location and IP addresses are never read into a result.
+import { Emitter, enc, fetchRest, isObj, ok, realSleep, redact, str, withRetry, listRead, stampRead } from "./readonly_http.js";
+import { ageDays, cmpVersion, deviceResource, minOsOption, posInt, showVersion, versionIn } from "./device_common.js";
+export const IVANTI_MDM_ENV = { url: "IVANTI_MDM_URL", user: "IVANTI_MDM_USERNAME", password: "IVANTI_MDM_PASSWORD" };
+export const IVANTI_MDM_CHECKS = ["device_compliant", "disk_encryption", "os_minimum", "last_checkin", "passcode_compliant", "firewall", "system_integrity"];
+export const DEFAULTS = { checkinDays: 14, maxDevices: 5000 };
+/** The documented ceiling for rows. */
+export const PAGE = 500;
+const SORT = "sortFields%5B0%5D.name=id&sortFields%5B0%5D.order=ASC";
+export const metadataPath = "/metadata/tenant";
+export const devicesPath = (space, after) => `/device?q=&rows=${PAGE}&dmPartitionId=${enc(space)}&${SORT}&nav=true${after === undefined ? "" : `&searchAfterValues%5B0%5D=${enc(after)}`}`;
+export const detailPath = (id) => `/device/${enc(id)}`;
+/** An Ivanti Neurons for MDM API client from IVANTI_MDM_* variables, or what is missing. */
+export function ivantiMdmFromEnv(env, fetchFn = fetch) {
+    const url = env[IVANTI_MDM_ENV.url], user = env[IVANTI_MDM_ENV.user], password = env[IVANTI_MDM_ENV.password];
+    if (!url || !user || !password)
+        return `${IVANTI_MDM_ENV.url}, ${IVANTI_MDM_ENV.user} and ${IVANTI_MDM_ENV.password} are not all set`;
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return `${IVANTI_MDM_ENV.url} is not a URL`;
+    }
+    if (u.protocol !== "https:")
+        return `${IVANTI_MDM_ENV.url} must be https`;
+    const basic = Buffer.from(`${user}:${password}`).toString("base64");
+    return fetchRest({ base: `${u.origin}/api/v1`, fetchFn, headers: async () => ({ authorization: `Basic ${basic}` }) });
+}
+/** The guide wraps answers in { errors, result }; the OpenAPI file shows them bare. Either is read. */
+const unwrap = (b) => (isObj(b) ? (isObj(b.result) ? b.result : b) : undefined);
+/** Every device in the space, sorted by id and paged with searchAfterValues, up to `max`. */
+async function listDevices(api, space, max) {
+    const items = [];
+    let after;
+    for (let page = 0;; page++) {
+        const r = await api.get(devicesPath(space, after));
+        const body = ok(r) ? unwrap(r.body) : undefined;
+        const got = body && Array.isArray(body.searchResults) ? body.searchResults.filter(isObj) : undefined;
+        if (!got)
+            return { error: r };
+        items.push(...got);
+        const total = Number(body.totalCount);
+        const last = got.length ? got[got.length - 1].id : undefined;
+        const done = !got.length || last === undefined || (Number.isFinite(total) ? items.length >= total : got.length < PAGE);
+        if (items.length >= max)
+            return { items: items.slice(0, max), truncated: items.length > max || !done, pages: page + 1 };
+        if (done)
+            return { items, truncated: false, pages: page + 1 };
+        if (page >= Math.ceil(max / PAGE) + 1)
+            return { items, truncated: true, pages: page + 1 };
+        after = String(last);
+    }
+}
+/** lastCheckin as epoch milliseconds (the guide's example) or an ISO date-time (the OpenAPI type), as ISO. */
+function checkinIso(v) {
+    const n = typeof v === "number" ? v : typeof v === "string" && /^\d{10,}$/.test(v) ? Number(v) : NaN;
+    if (Number.isFinite(n))
+        return new Date(n).toISOString();
+    return typeof v === "string" ? v : undefined;
+}
+const BITLOCKER_FAIL = new Set(["NOT_ENCRYPTED", "PARTIALLY_ENCRYPTED"]);
+export async function ivantiMdmChecks(api, host, o, now) {
+    const out = new Emitter("ivanti_mdm", `ivanti_mdm ${host}`);
+    // The device space: --ivanti-mdm-space-id, else the tenant's default from Get Tenant Metadata.
+    let space = o.space;
+    if (!space) {
+        const m = await api.get(metadataPath);
+        const id = ok(m) ? unwrap(m.body)?.defaultDmPartitionId : undefined;
+        if (id === undefined || id === null || id === "") {
+            if (!ok(m))
+                for (const c of IVANTI_MDM_CHECKS)
+                    out.skip(c, m, "tenant metadata (default device space)");
+            else
+                out.skipAll(IVANTI_MDM_CHECKS, "tenant metadata gives no defaultDmPartitionId; set --ivanti-mdm-space-id");
+            return out.results;
+        }
+        space = String(id);
+    }
+    const tenant = `ivanti_mdm ${host} space ${space}`;
+    const tout = new Emitter("ivanti_mdm", tenant);
+    const got = await listDevices(api, space, o.maxDevices);
+    if ("error" in got) {
+        for (const c of IVANTI_MDM_CHECKS)
+            tout.skip(c, got.error, "device search");
+        return tout.results;
+    }
+    const active = got.items.filter((d) => d.registrationState === undefined || d.registrationState === null || d.registrationState === "ACTIVE");
+    const inactive = got.items.length - active.length;
+    const note = inactive ? `; ${inactive} retired, wiped or pending device(s) not judged` : "";
+    if (!active.length) {
+        tout.skipAll(IVANTI_MDM_CHECKS, `the device space lists no active device${note}; nothing to judge`);
+        return tout.results;
+    }
+    const cap = got.truncated ? `; only the first ${o.maxDevices} devices read (--ivanti-mdm-max-devices)` : "";
+    const from = tout.results.length;
+    if (!o.minOs.size)
+        tout.add("os_minimum", "skipped", `no minimum OS version given (--ivanti-mdm-min-os, e.g. osx=15.0 or ios=18.0); ${active.length} device(s) not judged`);
+    const isMac = (d) => d.platformType === "OSX";
+    const macs = active.filter(isMac).length;
+    if (!macs)
+        for (const c of ["firewall", "system_integrity"])
+            tout.add(c, "skipped", `no active macOS (platformType OSX) device; the API documents ${c === "firewall" ? "firewall settings" : "System Integrity Protection"} for macOS only${note}`);
+    const mobiles = active.filter((d) => d.platformType === "IOS" || d.platformType === "ANDROID").length;
+    if (!mobiles)
+        tout.add("passcode_compliant", "skipped", `no active iOS or Android device; passcodeCompliantWithProfiles is documented for those platforms only${note}`);
+    let encJudged = 0;
+    let detailDenied;
+    for (const d of active) {
+        const id = String(d.id ?? "?");
+        const res = deviceResource("ivanti device", id, d.serialNumber);
+        const plat = str(d.platformType) ?? "UNKNOWN";
+        const ver = str(d.platformVersion);
+        const where = ` (${plat} ${ver ?? "version not reported"})`;
+        if (typeof d.complianceState === "boolean")
+            tout.add("device_compliant", d.complianceState ? "pass" : "fail", `complianceState is ${d.complianceState}${where}${cap}${note}`, res);
+        else
+            tout.add("device_compliant", "skipped", `complianceState not reported${where}${note}`, res);
+        const age = ageDays(checkinIso(d.lastCheckin), now);
+        if (age === undefined)
+            tout.add("last_checkin", "skipped", `lastCheckin not reported${where}`, res);
+        else
+            tout.add("last_checkin", age <= o.checkinDays ? "pass" : "fail", `last client check-in ${age} day(s) ago; at most ${o.checkinDays} allowed (--ivanti-mdm-checkin-days)${where}`, res);
+        if (o.minOs.size) {
+            const key = plat.toLowerCase();
+            const floor = o.minOs.get(key) ?? (key === "osx" ? o.minOs.get("macos") : undefined) ?? o.minOs.get("*");
+            const have = versionIn(ver);
+            if (!floor)
+                tout.add("os_minimum", "skipped", `--ivanti-mdm-min-os names no floor for platformType ${plat}${where}`, res);
+            else if (!have)
+                tout.add("os_minimum", "skipped", `platformVersion not reported${where}`, res);
+            else {
+                const okv = cmpVersion(have, floor) >= 0;
+                tout.add("os_minimum", okv ? "pass" : "fail", `platformVersion ${showVersion(have)} ${okv ? "meets" : "is below"} the --ivanti-mdm-min-os floor ${showVersion(floor)}${where}`, res);
+            }
+        }
+        if (plat === "IOS" || plat === "ANDROID") {
+            const p = typeof d.passcodeCompliantWithProfiles === "boolean" ? ["passcodeCompliantWithProfiles", d.passcodeCompliantWithProfiles]
+                : typeof d.passcodeCompliant === "boolean" ? ["passcodeCompliant", d.passcodeCompliant] : undefined;
+            if (p)
+                tout.add("passcode_compliant", p[1] ? "pass" : "fail", `${p[0]} is ${p[1]}${where}`, res);
+            else
+                tout.add("passcode_compliant", "skipped", `neither passcodeCompliantWithProfiles nor passcodeCompliant reported${where}`, res);
+        }
+        // Not a Mac: BitLocker from the search row, wherever a device reports it.
+        if (!isMac(d)) {
+            const bl = str(d.bitLockerEncryptionStatus);
+            if (bl) {
+                encJudged++;
+                if (bl === "UNKNOWN")
+                    tout.add("disk_encryption", "skipped", `bitLockerEncryptionStatus is UNKNOWN${where}`, res);
+                else
+                    tout.add("disk_encryption", bl === "FULLY_ENCRYPTED" ? "pass" : BITLOCKER_FAIL.has(bl) ? "fail" : "skipped", `bitLockerEncryptionStatus is ${bl}; FULLY_ENCRYPTED required${where}`, res);
+            }
+            continue;
+        }
+        // macOS: FileVault, firewall and SIP come from Get Device Details, one call per Mac. A 401 or 403 stops the calls.
+        encJudged++;
+        if (detailDenied) {
+            for (const c of ["disk_encryption", "firewall", "system_integrity"])
+                tout.skip(c, detailDenied, "device details", res);
+            continue;
+        }
+        const r = await api.get(detailPath(id));
+        const det = ok(r) ? unwrap(r.body) : undefined;
+        if (!det) {
+            if (r.status === 401 || r.status === 403)
+                detailDenied = r;
+            for (const c of ["disk_encryption", "firewall", "system_integrity"])
+                tout.skip(c, r, "device details", res);
+            continue;
+        }
+        if (typeof det.osxFdeEnabled === "boolean")
+            tout.add("disk_encryption", det.osxFdeEnabled ? "pass" : "fail", `osxFdeEnabled (FileVault) is ${det.osxFdeEnabled}${where}`, res);
+        else
+            tout.add("disk_encryption", "skipped", `osxFdeEnabled not reported${where}`, res);
+        const fw = isObj(det.osxFirewallSettings) ? det.osxFirewallSettings.firewallEnabled : undefined;
+        if (typeof fw === "boolean")
+            tout.add("firewall", fw ? "pass" : "fail", `osxFirewallSettings.firewallEnabled is ${fw}${where}`, res);
+        else
+            tout.add("firewall", "skipped", `osxFirewallSettings.firewallEnabled not reported${where}`, res);
+        const sip = det.osxSystemIntegrityProtectionEnabled;
+        if (typeof sip === "boolean")
+            tout.add("system_integrity", sip ? "pass" : "fail", `osxSystemIntegrityProtectionEnabled is ${sip}${where}`, res);
+        else
+            tout.add("system_integrity", "skipped", `osxSystemIntegrityProtectionEnabled not reported${where}`, res);
+    }
+    if (!encJudged)
+        tout.add("disk_encryption", "skipped", `no active device reports an encryption field the API documents (osxFdeEnabled for macOS, bitLockerEncryptionStatus for BitLocker); iOS and Android expose none${note}`);
+    stampRead(tout.results, from, listRead(got)); // a capped list leaves devices unseen: format 3 says so
+    return tout.results;
+}
+export const ivanti_mdm = {
+    name: "ivanti_mdm",
+    options: {
+        "ivanti-mdm-space-id": { type: "string", help: "device space id (dmPartitionId) to read (default: the tenant's defaultDmPartitionId)" },
+        "ivanti-mdm-min-os": { type: "string", multiple: true, help: "<platformType>=<version> floor, e.g. osx=15.0, ios=18.0, android=14 (repeatable; without it os_minimum is skipped)" },
+        "ivanti-mdm-checkin-days": { type: "string", help: `days since a device's last client check-in before last_checkin fails (default ${DEFAULTS.checkinDays})` },
+        "ivanti-mdm-max-devices": { type: "string", help: `devices read, at most (default ${DEFAULTS.maxDevices}); each Mac costs one Get Device Details call` },
+    },
+    emits: IVANTI_MDM_CHECKS.map((c) => `ivanti_mdm.${c}`),
+    describe: () => "Ivanti Neurons for MDM (formerly MobileIron Cloud) tenant in IVANTI_MDM_URL (Customer Integration API, GET only, Device Read Only admin)",
+    async run(ctx) {
+        const host = (() => { try {
+            return new URL(ctx.env[IVANTI_MDM_ENV.url] ?? "").host || "(unknown)";
+        }
+        catch {
+            return "(unknown)";
+        } })();
+        const given = ctx.clients.ivanti_mdm;
+        const built = given !== undefined ? given : ivantiMdmFromEnv(ctx.env);
+        if (!built || typeof built === "string") {
+            const out = new Emitter("ivanti_mdm", `ivanti_mdm ${host}`);
+            out.skipAll(IVANTI_MDM_CHECKS, typeof built === "string" ? built : `${IVANTI_MDM_ENV.password} is not set`);
+            return out.results;
+        }
+        const api = withRetry(built, ctx.clients.sleep ?? realSleep);
+        const space = typeof ctx.opts["ivanti-mdm-space-id"] === "string" && /^\d+$/.test(ctx.opts["ivanti-mdm-space-id"]) ? ctx.opts["ivanti-mdm-space-id"] : undefined;
+        const o = {
+            space,
+            checkinDays: posInt(ctx.opts["ivanti-mdm-checkin-days"], DEFAULTS.checkinDays),
+            maxDevices: posInt(ctx.opts["ivanti-mdm-max-devices"], DEFAULTS.maxDevices),
+            minOs: minOsOption(ctx.opts["ivanti-mdm-min-os"]),
+        };
+        const user = ctx.env[IVANTI_MDM_ENV.user], password = ctx.env[IVANTI_MDM_ENV.password];
+        const basic = user && password ? Buffer.from(`${user}:${password}`).toString("base64") : undefined;
+        return redact(await ivantiMdmChecks(api, host, o, ctx.now), [password, basic]);
+    },
+};

package/collector/src/sources/ninjaone.js

@@ -0,0 +1,271 @@
+// NinjaOne (RMM and endpoint management) over the NinjaOne Public API v2 (GET only), as an API Services
+// (machine-to-machine) client app whose only scope is Monitoring. The client-credentials token request is the only POST.
+//
+// Auth (NinjaOne Public API reference, app.ninjarmm.com/apidocs-beta/, articles read 2026-10-28):
+//   /authorization/create-applications/machine-to-machine-apps: Configuration > Apps > API > Client App IDs > Add >
+//     "API Services (machine-to-machine)". Scopes: "Monitoring: grants read-only access to monitoring data and
+//     organization structure"; Management and Control modify devices or open remote access and are never asked for.
+//   /authorization/flows/client-credentials-flow: POST /ws/oauth/token (form) grant_type=client_credentials, client_id,
+//     client_secret, scope -> { access_token, expires_in (3600 in the example), scope, token_type: "Bearer" }.
+//   Instances: app, us2, eu, ca and oc .ninjarmm.com each served this same reference (NinjaRMM-API-v2.yaml, 794,720
+//     bytes, "NinjaOne Public API 2.0" version 2.0.9-draft) and answered /ws/oauth/token on 2026-10-28; the collector
+//     takes the instance as NINJAONE_URL and refuses any other host.
+//   The spec's global security requirement names the scopes monitoring, management and control and no operation below
+//   overrides it, so that Monitoring alone answers these calls rests on the M2M page's wording: a 401 or 403 is skipped.
+//
+// Endpoints and fields (NinjaRMM-API-v2.yaml, read 2026-10-28):
+//   GET /v2/devices?pageSize&after             List devices; `after` is "Last Node ID from previous page".
+//        -> [ { id, nodeClass, approvalStatus (PENDING, STAGED, APPROVED, DECOMMISSIONED), offline, lastContact,
+//               lastUpdate, ... } ]
+//   GET /v2/queries/computer-systems?pageSize&cursor    -> { cursor: { name, offset, count, expires }, results: [ { deviceId, serialNumber, ... } ] }
+//   GET /v2/queries/volumes?include=bl&pageSize&cursor  ("bl - BitLocker status")
+//        -> results: [ { deviceId, driveLetter, bitLockerStatus: { conversionStatus (FULLY_DECRYPTED, FULLY_ENCRYPTED,
+//             ENCRYPTION_IN_PROGRESS, DECRYPTION_IN_PROGRESS, ENCRYPTION_PAUSED, DECRYPTION_PAUSED, UNKNOWN),
+//             protectionStatus (UNPROTECTED, PROTECTED, UNKNOWN, PENDING) } } ]
+//   GET /v2/queries/operating-systems?pageSize&cursor   -> results: [ { deviceId, name, buildNumber, releaseId, needsReboot } ]
+//   GET /v2/queries/device-health?pageSize&cursor       -> results: [ { deviceId, failedOSPatchesCount, pendingOSPatchesCount, ... } ]
+//   The query reports answer with a named server-side cursor; the spec describes the `cursor` parameter only as
+//   "Cursor name", so the collector passes the last answer's cursor.name back and stops at an empty page. lastContact is
+//   a number whose unit the spec does not state: a value below 1e11 is read as epoch seconds, above as milliseconds.
+//   The spec documents a 429 "Rate limit exceeded" answer; no request budget is published, and a 429 is retried after
+//   its Retry-After.
+//
+// Left out, because no endpoint or field of the reference reports them: the firewall, the screen lock or passcode, and
+// FileVault (the volume report's encryption block is BitLocker's, so Macs and Linux hosts are skipped for encryption).
+//
+// Personal data: a device is named by its NinjaOne id and the serial of the computer-systems report. displayName,
+// systemName, dnsName, netbiosName, the assigned owner, userData, the logged-on user and tags are never read into a result.
+import { cachedToken, tokenRequest } from "./oauth.js";
+import { Emitter, enc, fetchRest, isObj, ok, realSleep, redact, str, withRetry } from "./readonly_http.js";
+import { cmpVersion, deviceResource, minOsOption, posInt, showVersion, versionIn } from "./device_common.js";
+export const NINJAONE_ENV = { url: "NINJAONE_URL", client: "NINJAONE_CLIENT_ID", secret: "NINJAONE_CLIENT_SECRET" };
+/** The instances whose hosts served the NinjaOne Public API reference on 2026-10-28. */
+export const NINJAONE_HOSTS = ["app.ninjarmm.com", "us2.ninjarmm.com", "eu.ninjarmm.com", "ca.ninjarmm.com", "oc.ninjarmm.com"];
+export const NINJAONE_CHECKS = ["disk_encryption", "os_minimum", "os_patches", "last_contact", "approved"];
+export const DEFAULTS = { contactDays: 14, maxDevices: 5000, maxPendingPatches: 0 };
+export const PAGE = 500;
+const WORKSTATIONS = new Set(["WINDOWS_WORKSTATION", "MAC", "LINUX_WORKSTATION"]);
+const SERVERS = new Set(["WINDOWS_SERVER", "MAC_SERVER", "LINUX_SERVER"]);
+export const devicesPath = (after) => `/v2/devices?pageSize=${PAGE}${after === undefined ? "" : `&after=${after}`}`;
+export const queryPath = (report, cursor) => `/v2/queries/${report}?${report === "volumes" ? "include=bl&" : ""}pageSize=${PAGE}${cursor ? `&cursor=${enc(cursor)}` : ""}`;
+/** A NinjaOne Public API client from NINJAONE_* variables, or what is missing. */
+export function ninjaoneFromEnv(env, fetchFn = fetch) {
+    const url = env[NINJAONE_ENV.url], client = env[NINJAONE_ENV.client], secret = env[NINJAONE_ENV.secret];
+    if (!url || !client || !secret)
+        return `${NINJAONE_ENV.url}, ${NINJAONE_ENV.client} and ${NINJAONE_ENV.secret} are not all set`;
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return `${NINJAONE_ENV.url} is not a URL`;
+    }
+    if (u.protocol !== "https:")
+        return `${NINJAONE_ENV.url} must be https`;
+    if (!NINJAONE_HOSTS.includes(u.host))
+        return `${NINJAONE_ENV.url} must be one of ${NINJAONE_HOSTS.map((h) => `https://${h}`).join(", ")}`;
+    const form = { grant_type: "client_credentials", client_id: client, client_secret: secret, scope: "monitoring" };
+    const token = cachedToken(() => tokenRequest(`${u.origin}/ws/oauth/token`, form, fetchFn));
+    return fetchRest({ base: u.origin, fetchFn, headers: async () => ({ authorization: `Bearer ${await token()}` }) });
+}
+/** List devices, paged by the last node id, until an empty page or `max` devices. */
+async function listDevices(api, max) {
+    const items = [];
+    let after;
+    for (let page = 0;; page++) {
+        const r = await api.get(devicesPath(after));
+        if (!ok(r) || !Array.isArray(r.body))
+            return { error: r };
+        const got = r.body.filter(isObj);
+        items.push(...got);
+        const last = got.length ? Number(got[got.length - 1].id) : NaN;
+        if (!got.length || !Number.isFinite(last) || (after !== undefined && last <= after))
+            return { items: items.slice(0, max), truncated: items.length > max, pages: page + 1 };
+        if (items.length >= max)
+            return { items: items.slice(0, max), truncated: true, pages: page + 1 };
+        after = last;
+    }
+}
+/** One query report's rows by deviceId (several rows per device for volumes), following cursor.name until an empty page. */
+async function report(api, name, maxPages) {
+    const rows = new Map();
+    let cursor;
+    for (let page = 0; page < maxPages; page++) {
+        const r = await api.get(queryPath(name, cursor));
+        if (!ok(r) || !isObj(r.body) || !Array.isArray(r.body.results))
+            return { error: r };
+        const got = r.body.results.filter(isObj);
+        for (const row of got) {
+            const id = Number(row.deviceId);
+            if (Number.isFinite(id))
+                rows.set(id, [...(rows.get(id) ?? []), row]);
+        }
+        const next = isObj(r.body.cursor) ? str(r.body.cursor.name) : undefined;
+        if (!got.length || !next)
+            break;
+        cursor = next;
+    }
+    return { rows };
+}
+/** lastContact as a Date: epoch seconds below 1e11, milliseconds above (the spec gives no unit). */
+export function contactDate(v) {
+    const n = typeof v === "number" ? v : typeof v === "string" && v.trim() ? Number(v) : NaN;
+    if (!Number.isFinite(n) || n <= 0)
+        return undefined;
+    return new Date(n < 1e11 ? n * 1000 : n);
+}
+const platformOf = (nodeClass) => (nodeClass.startsWith("WINDOWS") ? "windows" : nodeClass.startsWith("MAC") ? "macos" : nodeClass.startsWith("LINUX") ? "linux" : "other");
+/** The OS version a floor is compared with: 10.0.<build> on Windows (buildNumber), else the dotted version in the name. */
+export function osVersionOf(platform, os) {
+    if (!os)
+        return undefined;
+    if (platform === "windows") {
+        const b = String(os.buildNumber ?? "").match(/^\d+/)?.[0];
+        return b ? [10, 0, Number(b)] : undefined;
+    }
+    return versionIn(os.name);
+}
+export async function ninjaoneChecks(api, instance, o, now) {
+    const out = new Emitter("ninjaone", `ninjaone ${instance}`);
+    const got = await listDevices(api, o.maxDevices);
+    if ("error" in got) {
+        for (const c of NINJAONE_CHECKS)
+            out.skip(c, got.error, "device list");
+        return out.results;
+    }
+    const classes = o.servers ? new Set([...WORKSTATIONS, ...SERVERS]) : WORKSTATIONS;
+    const devices = got.items.filter((d) => classes.has(String(d.nodeClass)));
+    if (!devices.length) {
+        out.skipAll(NINJAONE_CHECKS, `NinjaOne lists no ${o.servers ? "workstation or server" : "workstation (Windows, Mac or Linux)"} among ${got.items.length} device(s); nothing to judge`);
+        return out.results;
+    }
+    const cap = got.truncated ? `; only the first ${o.maxDevices} devices read (--ninjaone-max-devices)` : "";
+    const maxPages = Math.ceil(o.maxDevices / PAGE) * 4 + 4; // volumes give several rows per device
+    const reports = new Map();
+    const failed = new Map();
+    for (const name of ["computer-systems", "volumes", "operating-systems", "device-health"]) {
+        const r = await report(api, name, maxPages);
+        if ("error" in r)
+            failed.set(name, r.error);
+        else
+            reports.set(name, r.rows);
+    }
+    const floorsGiven = o.minOs.size > 0;
+    if (!floorsGiven)
+        out.add("os_minimum", "skipped", `no minimum OS version given (--ninjaone-min-os, e.g. windows=10.0.26100 or macos=15.0); ${devices.length} device(s) not judged`);
+    for (const [check, name] of [["disk_encryption", "volumes"], ["os_minimum", "operating-systems"], ["os_patches", "device-health"]]) {
+        const e = failed.get(name);
+        if (e && (check !== "os_minimum" || floorsGiven))
+            out.skip(check, e, `query report ${name}`);
+    }
+    const from = out.results.length;
+    for (const d of devices) {
+        const id = Number(d.id);
+        const nodeClass = String(d.nodeClass);
+        const platform = platformOf(nodeClass);
+        const serial = reports.get("computer-systems")?.get(id)?.[0]?.serialNumber;
+        const res = deviceResource("ninjaone device", d.id, serial);
+        const os = reports.get("operating-systems")?.get(id)?.[0];
+        const where = ` (${nodeClass}${os?.buildNumber ? `, build ${String(os.buildNumber).slice(0, 30)}` : ""})`;
+        // Disk encryption: BitLocker on the C: volume of a Windows device.
+        const vols = reports.get("volumes");
+        if (vols) {
+            if (platform !== "windows")
+                out.add("disk_encryption", "skipped", `NinjaOne reports BitLocker only; no FileVault or LUKS field for ${nodeClass}${where}`, res);
+            else {
+                const c = (vols.get(id) ?? []).find((v) => /^c:?\\?$/i.test(String(v.driveLetter ?? "").trim()));
+                const bl = c && isObj(c.bitLockerStatus) ? c.bitLockerStatus : undefined;
+                const conv = str(bl?.conversionStatus), prot = str(bl?.protectionStatus);
+                if (!c)
+                    out.add("disk_encryption", "skipped", `no C: volume in the volumes report${where}`, res);
+                else if (!bl || !conv || conv === "UNKNOWN")
+                    out.add("disk_encryption", "skipped", `C: has no BitLocker conversionStatus (${conv ?? "not reported"})${where}`, res);
+                else {
+                    const pass = conv === "FULLY_ENCRYPTED" && prot === "PROTECTED";
+                    out.add("disk_encryption", pass ? "pass" : "fail", `C: BitLocker conversionStatus ${conv}, protectionStatus ${prot ?? "not reported"}; FULLY_ENCRYPTED and PROTECTED required${where}${cap}`, res);
+                }
+            }
+        }
+        // Minimum OS version.
+        if (floorsGiven && reports.has("operating-systems")) {
+            const floor = o.minOs.get(platform) ?? o.minOs.get("*");
+            const have = osVersionOf(platform, os);
+            if (!floor)
+                out.add("os_minimum", "skipped", `no --ninjaone-min-os floor for ${platform}${where}`, res);
+            else if (!have)
+                out.add("os_minimum", "skipped", `${platform === "windows" ? "buildNumber" : "a version in the OS name"} not reported${where}`, res);
+            else {
+                const okv = cmpVersion(have, floor) >= 0;
+                out.add("os_minimum", okv ? "pass" : "fail", `${platform} ${showVersion(have)} ${okv ? "meets" : "is below"} the --ninjaone-min-os floor ${showVersion(floor)}${where}`, res);
+            }
+        }
+        // OS patches: failed and pending counts from the device health report.
+        const health = reports.get("device-health");
+        if (health) {
+            const h = health.get(id)?.[0];
+            const failedN = h?.failedOSPatchesCount, pendingN = h?.pendingOSPatchesCount;
+            if (typeof failedN !== "number" || typeof pendingN !== "number")
+                out.add("os_patches", "skipped", `${h ? "failedOSPatchesCount or pendingOSPatchesCount not reported" : "no device health row"}${where}`, res);
+            else {
+                const pass = failedN === 0 && pendingN <= o.maxPendingPatches;
+                out.add("os_patches", pass ? "pass" : "fail", `${failedN} failed and ${pendingN} pending OS patch(es); 0 failed and at most ${o.maxPendingPatches} pending allowed (--ninjaone-max-pending-patches)${where}`, res);
+            }
+        }
+        const seen = contactDate(d.lastContact);
+        if (!seen)
+            out.add("last_contact", "skipped", `lastContact not reported${where}`, res);
+        else {
+            const age = Math.floor((now.getTime() - seen.getTime()) / 86_400_000);
+            out.add("last_contact", age <= o.contactDays ? "pass" : "fail", `last contact ${age} day(s) ago; at most ${o.contactDays} allowed (--ninjaone-contact-days)${where}`, res);
+        }
+        const st = str(d.approvalStatus);
+        if (st === "APPROVED")
+            out.add("approved", "pass", `approvalStatus is APPROVED${where}`, res);
+        else if (st === "PENDING" || st === "STAGED")
+            out.add("approved", "fail", `approvalStatus is ${st}; APPROVED required${where}`, res);
+        else
+            out.add("approved", "skipped", `approvalStatus is ${st ?? "not reported"}${st === "DECOMMISSIONED" ? " (no longer managed, not judged)" : ""}${where}`, res);
+    }
+    const read = { method: "config-read", itemsRead: devices.length, pagesRead: got.pages, complete: !got.truncated };
+    for (let i = from; i < out.results.length; i++)
+        if (out.results[i].method === undefined)
+            Object.assign(out.results[i], read);
+    return out.results;
+}
+export const ninjaone = {
+    name: "ninjaone",
+    options: {
+        "ninjaone-contact-days": { type: "string", help: `days since a device's last contact before last_contact fails (default ${DEFAULTS.contactDays})` },
+        "ninjaone-min-os": { type: "string", multiple: true, help: "<platform>=<version> floor for os_minimum, platform windows, macos or linux, e.g. windows=10.0.26100 (repeatable; without it the check is skipped)" },
+        "ninjaone-max-pending-patches": { type: "string", help: `pending OS patches a device may have before os_patches fails (default ${DEFAULTS.maxPendingPatches})` },
+        "ninjaone-max-devices": { type: "string", help: `devices read, at most (default ${DEFAULTS.maxDevices})` },
+        "ninjaone-include-servers": { type: "boolean", help: "also judge Windows, Mac and Linux servers (default: workstations only)" },
+    },
+    emits: NINJAONE_CHECKS.map((c) => `ninjaone.${c}`),
+    describe: () => "NinjaOne instance in NINJAONE_URL (Public API v2, client credentials, Monitoring scope only)",
+    async run(ctx) {
+        const instance = (() => { try {
+            return new URL(ctx.env[NINJAONE_ENV.url] ?? "").host || "(unknown)";
+        }
+        catch {
+            return "(unknown)";
+        } })();
+        const given = ctx.clients.ninjaone;
+        const built = given !== undefined ? given : ninjaoneFromEnv(ctx.env);
+        if (!built || typeof built === "string") {
+            const out = new Emitter("ninjaone", `ninjaone ${instance}`);
+            out.skipAll(NINJAONE_CHECKS, typeof built === "string" ? built : `${NINJAONE_ENV.secret} is not set`);
+            return out.results;
+        }
+        const api = withRetry(built, ctx.clients.sleep ?? realSleep);
+        const pending = Number(ctx.opts["ninjaone-max-pending-patches"]);
+        const o = {
+            contactDays: posInt(ctx.opts["ninjaone-contact-days"], DEFAULTS.contactDays),
+            maxDevices: posInt(ctx.opts["ninjaone-max-devices"], DEFAULTS.maxDevices),
+            maxPendingPatches: Number.isInteger(pending) && pending >= 0 && ctx.opts["ninjaone-max-pending-patches"] !== undefined ? pending : DEFAULTS.maxPendingPatches,
+            minOs: minOsOption(ctx.opts["ninjaone-min-os"]),
+            servers: ctx.opts["ninjaone-include-servers"] === true,
+        };
+        return redact(await ninjaoneChecks(api, instance, o, ctx.now), [ctx.env[NINJAONE_ENV.secret]]);
+    },
+};

package/collector/src/sources/oauth.js

@@ -30,9 +30,11 @@ export function entraClientAssertion(pem, tenant, clientId, nowSec) {
     const thumb = createHash("sha256").update(new X509Certificate(certPem).raw).digest("base64url");
     return jwt({ alg: "PS256", typ: "JWT", "x5t#S256": thumb }, { aud: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`, iss: clientId, sub: clientId, jti: randomUUID(), nbf: nowSec, iat: nowSec, exp: nowSec + 600 }, pem, true);
 }
-/** The signed assertion a Google service account exchanges for an access token as `subject`. */
+/** The signed assertion a Google service account exchanges for an access token: as `subject` (domain-wide delegation),
+ *  or as itself when `subject` is undefined. Google: `sub` is "the email address of the user for which the application
+ *  is requesting delegated access" (developers.google.com/identity/protocols/oauth2/service-account, read 2026-10-28). */
 export function googleAssertion(key, subject, scopes, nowSec) {
-    return jwt({ alg: "RS256", typ: "JWT" }, { iss: key.client_email, sub: subject, scope: scopes.join(" "), aud: key.token_uri ?? "https://oauth2.googleapis.com/token", iat: nowSec, exp: nowSec + 3600 }, key.private_key, false);
+    return jwt({ alg: "RS256", typ: "JWT" }, { iss: key.client_email, ...(subject ? { sub: subject } : {}), scope: scopes.join(" "), aud: key.token_uri ?? "https://oauth2.googleapis.com/token", iat: nowSec, exp: nowSec + 3600 }, key.private_key, false);
 }
 /** Posts a form to a token endpoint and returns the whole answer, which holds an access_token. */
 export async function tokenGrant(url, form, fetchFn = fetch) {