rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add soft delete for revoked devices

Browse Source 
Admins could only revoke devices, so never-enrolled and revoked
inventory rows piled up with no way to remove them. Soft-delete
is limited to REVOKED devices (revoke first), and ITAM GC now
hard-deletes PENDING/REVOKED orphans with no API key, postures,
or valid enrollment token—including user tombstones without
history.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-07-30 10:11:08 +02:00
parent 41da4bbad1
commit 7731566c68
23 changed files with 773 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/itam/policies.go
View File

@@ -37,7 +37,7 @@ var FullAccessPolicy = policy.NewPolicy(
"ITAM Full Access",
policy.Allow(
ActionDeviceList, ActionEmployeeDeviceList, ActionDeviceGet, ActionDeviceCreate,
ActionDeviceEnroll, ActionDeviceRevoke, ActionDeviceAssignOwner,
ActionDeviceEnroll, ActionDeviceRevoke, ActionDeviceDelete, ActionDeviceAssignOwner,
ActionDevicePostureList,
).WithSID("itam-full-access").When(organizationCondition),
policy.Allow(ActionEmployeeDeviceGet).