Add pre-assume enrolled device status query

The /enroll wait UI polled device state via node(), which
requires an assumed org session, so confirmation never
succeeded for unassumed viewers. Expose viewer.enrolledDevice
behind itam:employee-device:get (own-device, skip assumption)
and point the poller at it.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/itam/actions.go

@@ -26,6 +26,7 @@ const (
 	// Device actions
 	ActionDeviceList         = "itam:device:list"
 	ActionEmployeeDeviceList = "itam:employee-device:list"
+	ActionEmployeeDeviceGet  = "itam:employee-device:get"
 	ActionDeviceGet          = "itam:device:get"
 	ActionDeviceCreate       = "itam:device:create"
 	ActionDeviceEnroll       = "itam:device:enroll"

pkg/itam/policies.go

@@ -40,6 +40,9 @@ var FullAccessPolicy = policy.NewPolicy(
 		ActionDeviceEnroll, ActionDeviceRevoke, ActionDeviceAssignOwner,
 		ActionDevicePostureList,
 	).WithSID("itam-full-access").When(organizationCondition),
+	policy.Allow(ActionEmployeeDeviceGet).
+		WithSID("itam-full-access-get-own-device").
+		When(organizationCondition, ownerCondition),
 ).WithDescription("Full ITAM access for organization owners and admins")
 
 // ViewerPolicy grants read-only access to ITAM entities for organization
@@ -60,7 +63,7 @@ var EmployeePolicy = policy.NewPolicy(
 	policy.Allow(ActionDeviceEnroll).
 		WithSID("itam-employee-enroll-device").
 		When(organizationCondition),
-	policy.Allow(ActionDeviceGet).
+	policy.Allow(ActionDeviceGet, ActionEmployeeDeviceGet).
 		WithSID("itam-employee-get-own-device").
 		When(organizationCondition, ownerCondition),
 	policy.Allow(ActionEmployeeDeviceList).