Add device enrollment API and agent protocol

Expose ITAM REST endpoints for agents, console GraphQL for device
management, and wire probod bootstrap with enrollment e2e coverage.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/probod/aliases.go

@@ -64,5 +64,6 @@ type (
 	PgConfig                   = probodconfig.PgConfig
 	SAMLConfig                 = probodconfig.SAMLConfig
 	SCIMBridgeConfig           = probodconfig.SCIMBridgeConfig
+	ITAMConfig                 = probodconfig.ITAMConfig
 	SlackConfig                = probodconfig.SlackConfig
 )

pkg/probod/probod.go

@@ -71,6 +71,7 @@ import (
 	"go.probo.inc/probo/pkg/iam/oauth2"
 	"go.probo.inc/probo/pkg/iam/oauth2scope"
 	"go.probo.inc/probo/pkg/iam/oidc"
+	"go.probo.inc/probo/pkg/itam"
 	"go.probo.inc/probo/pkg/mailer"
 	"go.probo.inc/probo/pkg/mailman"
 	"go.probo.inc/probo/pkg/probo"
@@ -145,6 +146,9 @@ func New() *Implm {
 					DomainVerificationResolverAddr:    "8.8.8.8:53",
 				},
 			},
+			ITAM: ITAMConfig{
+				DeviceEnrollmentTokenValidity: 604800,
+			},
 			CompliancePortal: CompliancePortalConfig{
 				HTTPAddr:   ":80",
 				HTTPSAddr:  ":443",
@@ -720,6 +724,15 @@ func (impl *Implm) Run(
 	thirdPartyService := thirdparty.NewService(pgClient, fileManagerService, thirdPartyVetter)
 	riskManagementService := riskmanagement.NewService(pgClient)
 
+	itamService := itam.NewService(
+		pgClient,
+		iamService,
+		itam.ServiceConfig{
+			EnrollmentTokenValidity: time.Duration(impl.cfg.ITAM.DeviceEnrollmentTokenValidity) * time.Second,
+		},
+		l.Named("itam"),
+	)
+
 	serverHandler, err := server.NewServer(
 		server.Config{
 			AllowedOrigins:    impl.cfg.Api.Cors.AllowedOrigins,
@@ -739,6 +752,7 @@ func (impl *Implm) Run(
 			Geoloc:            geolocService,
 			ThirdParty:        thirdPartyService,
 			RiskManagement:    riskManagementService,
+			ITAM:              itamService,
 			Slack:             slackService,
 			ConnectorRegistry: defaultConnectorRegistry,
 			ProviderRegistry:  providerRegistry,
@@ -955,6 +969,17 @@ func (impl *Implm) Run(
 		},
 	)
 
+	itamGC := itam.NewGarbageCollector(pgClient, l.Named("itam"))
+	itamGCCtx, stopITAMGC := context.WithCancel(context.Background())
+
+	wg.Go(
+		func() {
+			if err := itamGC.Run(itamGCCtx); err != nil {
+				cancel(fmt.Errorf("itam garbage collector crashed: %w", err))
+			}
+		},
+	)
+
 	esignServiceCtx, stopESignService := context.WithCancel(context.Background())
 
 	wg.Go(
@@ -1174,6 +1199,7 @@ func (impl *Implm) Run(
 	stopExportJobExporter()
 	stopAccessReviewWorker()
 	stopIAMService()
+	stopITAMGC()
 	stopMailer()
 	stopSlackSender()