update security

2026-07-26 16:41:25 -05:00
parent 90b7b2c597
commit 81f65b5173
14 changed files with 869 additions and 5 deletions
@@ -18,6 +18,7 @@ type exchangeRequest struct {
 	Hostname         string `json:"hostname"`
 	RequestedAction  string `json:"requested_action,omitempty"`
 	RequestedPackage string `json:"requested_package,omitempty"`
+	InstallationID   string `json:"installation_id,omitempty"`
 }

 type exchangePackage struct {
@@ -59,6 +60,7 @@ func (s *Server) handleExchange(w http.ResponseWriter, r *http.Request) {
 	request.Hostname = strings.TrimSpace(request.Hostname)
 	request.RequestedAction = strings.TrimSpace(request.RequestedAction)
 	request.RequestedPackage = strings.TrimSpace(request.RequestedPackage)
+	request.InstallationID = strings.TrimSpace(request.InstallationID)
 	if request.Code == "" || len(request.HostFingerprint) < 16 ||
 		request.Hostname == "" || len(request.Hostname) > 255 ||
 		(request.RequestedAction != "" && !validSlug(request.RequestedAction)) ||
@@ -90,6 +92,7 @@ func (s *Server) handleExchange(w http.ResponseWriter, r *http.Request) {
 		sourceIP,
 		"requested_action="+request.RequestedAction,
 	)
+	s.verifyFleetInstallation(r.Context(), request.InstallationID)
 	writeJSON(w, http.StatusOK, response)
 }