524 lines
18 KiB
TypeScript
524 lines
18 KiB
TypeScript
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
import Emm from '@mattermost/react-native-emm';
|
|
import {defineMessages} from 'react-intl';
|
|
import {Alert, Platform, type AlertButton} from 'react-native';
|
|
|
|
import {switchToServer} from '@actions/app/server';
|
|
import {logout} from '@actions/remote/session';
|
|
import DatabaseManager from '@database/manager';
|
|
import {DEFAULT_LOCALE, getTranslations} from '@i18n';
|
|
import {getServerCredentials} from '@init/credentials';
|
|
import {IntuneAuthRequiredReasons} from '@managers/intune_manager/types';
|
|
import {queryAllActiveServers} from '@queries/app/servers';
|
|
import {getConfigValue} from '@queries/servers/system';
|
|
import {logError} from '@utils/log';
|
|
|
|
export const messages = defineMessages({
|
|
not_secured_vendor_ios: {
|
|
id: 'mobile.managed.not_secured.ios.vendor',
|
|
defaultMessage: 'This device must be secured with biometrics or passcode to use {vendor}.\n\nGo to Settings > Face ID & Passcode.',
|
|
},
|
|
not_secured_vendor_android: {
|
|
id: 'mobile.managed.not_secured.android.vendor',
|
|
defaultMessage: 'This device must be secured with a screen lock to use {vendor}.',
|
|
},
|
|
not_secured_ios: {
|
|
id: 'mobile.managed.not_secured.ios',
|
|
defaultMessage: 'This device must be secured with biometrics or passcode to use Mattermost.\n\nGo to Settings > Face ID & Passcode.',
|
|
},
|
|
not_secured_android: {
|
|
id: 'mobile.managed.not_secured.android',
|
|
defaultMessage: 'This device must be secured with a screen lock to use Mattermost.',
|
|
},
|
|
blocked_by: {
|
|
id: 'mobile.managed.blocked_by',
|
|
defaultMessage: 'Blocked by {vendor}',
|
|
},
|
|
androidSettings: {
|
|
id: 'mobile.managed.settings',
|
|
defaultMessage: 'Go to settings',
|
|
},
|
|
securedBy: {
|
|
id: 'mobile.managed.secured_by',
|
|
defaultMessage: 'Secured by {vendor}',
|
|
},
|
|
logout: {
|
|
id: 'mobile.managed.logout',
|
|
defaultMessage: 'Logout',
|
|
},
|
|
switchServer: {
|
|
id: 'mobile.managed.switch_server',
|
|
defaultMessage: 'Switch server',
|
|
},
|
|
exit: {
|
|
id: 'mobile.managed.exit',
|
|
defaultMessage: 'Exit',
|
|
},
|
|
jailbreak: {
|
|
id: 'mobile.managed.jailbreak',
|
|
defaultMessage: 'Jailbroken or rooted devices are not trusted by {vendor}.',
|
|
},
|
|
biometric_failed: {
|
|
id: 'mobile.managed.biometric_failed',
|
|
defaultMessage: 'Biometric or Passcode authentication failed.',
|
|
},
|
|
retry: {
|
|
id: 'mobile.managed.retry',
|
|
defaultMessage: 'Retry',
|
|
},
|
|
authentication_required_title: {
|
|
id: 'security_manager.authentication_required_title',
|
|
defaultMessage: 'Authentication Required',
|
|
},
|
|
authentication_required_message: {
|
|
id: 'security_manager.authentication_required_message',
|
|
defaultMessage: 'Your organization requires you to sign in again to continue using Intune-managed accounts. The affected accounts have been unenrolled and signed out.',
|
|
},
|
|
consent_denied_title: {
|
|
id: 'security_manager.consent_denied_title',
|
|
defaultMessage: 'Consent Denied',
|
|
},
|
|
consent_denied_message: {
|
|
id: 'security_manager.consent_denied_message',
|
|
defaultMessage: 'You denied consent for Intune management. The affected accounts have been unenrolled and signed out.',
|
|
},
|
|
authentication_failed_title: {
|
|
id: 'security_manager.authentication_failed_title',
|
|
defaultMessage: 'Authentication Failed',
|
|
},
|
|
authentication_failed_message: {
|
|
id: 'security_manager.authentication_failed_message',
|
|
defaultMessage: 'Authentication failed. The affected accounts have been unenrolled and signed out. Please contact your IT administrator.',
|
|
},
|
|
okay: {
|
|
id: 'security_manager.okay',
|
|
defaultMessage: 'Okay',
|
|
},
|
|
access_blocked_title: {
|
|
id: 'security_manager.access_blocked_title',
|
|
defaultMessage: 'Access Blocked',
|
|
},
|
|
access_blocked_message: {
|
|
id: 'security_manager.access_blocked_message',
|
|
defaultMessage: 'Your organization has blocked access to this app. Please contact your IT administrator for assistance.',
|
|
},
|
|
identity_switch_required_title: {
|
|
id: 'security_manager.identity_switch_required_title',
|
|
defaultMessage: 'Identity Switch Required',
|
|
},
|
|
identity_switch_required_message: {
|
|
id: 'security_manager.identity_switch_required_message',
|
|
defaultMessage: 'Your organization requires you to switch accounts to continue using this app. Please contact your IT administrator for assistance.',
|
|
},
|
|
organization: {
|
|
id: 'security_manager.your_organization',
|
|
defaultMessage: 'your organization',
|
|
},
|
|
mam_enrollment_required_title: {
|
|
id: 'security_manager.mam_enrollment_required_title',
|
|
defaultMessage: 'Enrollment Required',
|
|
},
|
|
mam_enrollment_required_message: {
|
|
id: 'security_manager.mam_enrollment_required_message',
|
|
defaultMessage: '{organization} requires enrollment in Microsoft Intune to protect corporate data.',
|
|
},
|
|
mam_enrollment_failed_title: {
|
|
id: 'security_manager.mam_enrollment_failed_title',
|
|
defaultMessage: 'Enrollment Failed',
|
|
},
|
|
mam_enrollment_failed_message: {
|
|
id: 'security_manager.mam_enrollment_failed_message',
|
|
defaultMessage: 'Failed to enroll in Microsoft Intune. You will be logged out.',
|
|
},
|
|
mam_declined_title: {
|
|
id: 'security_manager.mam_declined_title',
|
|
defaultMessage: 'Enrollment Declined',
|
|
},
|
|
mam_declined_message: {
|
|
id: 'security_manager.mam_declined_message',
|
|
defaultMessage: '{organization} requires enrollment in Microsoft Intune. You can retry enrollment or logout.',
|
|
},
|
|
enroll_now: {
|
|
id: 'security_manager.enroll_now',
|
|
defaultMessage: 'Enroll Now',
|
|
},
|
|
cancel: {
|
|
id: 'security_manager.cancel',
|
|
defaultMessage: 'Cancel',
|
|
},
|
|
compliance_not_compliant: {
|
|
id: 'mobile.intune.compliance.not_compliant',
|
|
defaultMessage: "Your device doesn't meet the required app protection policy.",
|
|
},
|
|
compliance_network_failure: {
|
|
id: 'mobile.intune.compliance.network_failure',
|
|
defaultMessage: 'Could not reach the Intune service. Check your network and try again.',
|
|
},
|
|
compliance_service_failure: {
|
|
id: 'mobile.intune.compliance.service_failure',
|
|
defaultMessage: 'Intune service error. Please try again later.',
|
|
},
|
|
compliance_user_cancelled: {
|
|
id: 'mobile.intune.compliance.user_cancelled',
|
|
defaultMessage: 'Login was canceled. Please try again.',
|
|
},
|
|
compliance_alert_title: {
|
|
id: 'mobile.intune.compliance.alert_title',
|
|
defaultMessage: 'App Protection Required',
|
|
},
|
|
});
|
|
|
|
/**
|
|
* Switches to the previous server.
|
|
*/
|
|
const goToPreviousServer = async (lastAccessedServer: string) => {
|
|
// Switch to last accessed server
|
|
if (lastAccessedServer) {
|
|
await switchToServer(lastAccessedServer);
|
|
}
|
|
};
|
|
|
|
/**
|
|
* Builds the alert options for the alert.
|
|
*/
|
|
export const buildSecurityAlertOptions = async (
|
|
server: string, translations: Record<string, string>,
|
|
callback?: (value: boolean) => void,
|
|
retryCallback?: () => void,
|
|
) => {
|
|
const buttons: AlertButton[] = [];
|
|
const hasSessionToServer = await getServerCredentials(server);
|
|
|
|
const allServers = await queryAllActiveServers()?.fetch();
|
|
const activeServer = await DatabaseManager.getActiveServerUrl();
|
|
const otherServers = allServers?.filter((s) => s.url !== server).map((s) => s.url) || [];
|
|
|
|
if (server && hasSessionToServer) {
|
|
buttons.push({
|
|
text: translations[messages.logout.id],
|
|
style: 'destructive',
|
|
onPress: async () => {
|
|
await logout(server, undefined);
|
|
callback?.(true);
|
|
},
|
|
});
|
|
}
|
|
|
|
if (otherServers.length > 0) {
|
|
if (otherServers.length === 1 && otherServers[0] === activeServer) {
|
|
buttons.push({
|
|
text: translations[messages.okay.id],
|
|
style: 'cancel',
|
|
onPress: () => {
|
|
callback?.(true);
|
|
},
|
|
});
|
|
} else {
|
|
buttons.push({
|
|
text: translations[messages.switchServer.id],
|
|
style: 'cancel',
|
|
onPress: () => {
|
|
goToPreviousServer(otherServers[0]);
|
|
callback?.(true);
|
|
},
|
|
});
|
|
}
|
|
}
|
|
|
|
if (retryCallback && typeof retryCallback === 'function') {
|
|
buttons.push({
|
|
text: translations[messages.retry.id],
|
|
style: 'default',
|
|
onPress: () => {
|
|
retryCallback();
|
|
},
|
|
});
|
|
}
|
|
|
|
if (buttons.length === 0) {
|
|
buttons.push({
|
|
text: translations[messages.exit.id],
|
|
style: 'destructive',
|
|
onPress: () => {
|
|
Emm.exitApp();
|
|
},
|
|
});
|
|
}
|
|
|
|
return buttons;
|
|
};
|
|
|
|
/**
|
|
* Shows an alert when the device is not trusted (jailbroken or rooted).
|
|
*/
|
|
export const showDeviceNotTrustedAlert = async (server: string, siteName: string | undefined, locale?: string) => {
|
|
let serverSiteName;
|
|
try {
|
|
const {database} = DatabaseManager.getServerDatabaseAndOperator(server);
|
|
serverSiteName = await getConfigValue(database, 'SiteName');
|
|
} catch (error) {
|
|
logError('showDeviceNotTrustedAlert', error);
|
|
}
|
|
|
|
const translations = getTranslations(locale || DEFAULT_LOCALE);
|
|
const buttons = await buildSecurityAlertOptions(server, translations);
|
|
const securedBy = siteName || serverSiteName || 'Mattermost';
|
|
|
|
Alert.alert(
|
|
translations[messages.blocked_by.id].replace('{vendor}', securedBy),
|
|
translations[messages.jailbreak.id].
|
|
replace('{vendor}', securedBy),
|
|
buttons,
|
|
{cancelable: false},
|
|
);
|
|
};
|
|
|
|
/**
|
|
* Shows an alert when the device does not have biometrics or passcode set.
|
|
*/
|
|
export const showNotSecuredAlert = async (server: string, siteName: string | undefined, locale?: string) => {
|
|
const buttons: AlertButton[] = [];
|
|
let serverSiteName;
|
|
try {
|
|
const {database} = DatabaseManager.getServerDatabaseAndOperator(server);
|
|
serverSiteName = await getConfigValue(database, 'SiteName');
|
|
} catch (error) {
|
|
logError('showNotSecuredAlert', error);
|
|
}
|
|
|
|
const translations = getTranslations(locale || DEFAULT_LOCALE);
|
|
const securedBy = siteName || serverSiteName || 'Mattermost';
|
|
|
|
if (Platform.OS === 'android') {
|
|
buttons.push({
|
|
text: translations[messages.androidSettings.id],
|
|
onPress: () => {
|
|
Emm.openSecuritySettings();
|
|
},
|
|
});
|
|
}
|
|
|
|
const alertButtons = await buildSecurityAlertOptions(server, translations);
|
|
buttons.push(...alertButtons);
|
|
|
|
let message;
|
|
if (serverSiteName || siteName) {
|
|
const key = Platform.select({ios: messages.not_secured_vendor_ios.id, default: messages.not_secured_vendor_android.id});
|
|
message = translations[key].replace('{vendor}', securedBy);
|
|
} else {
|
|
const key = Platform.select({ios: messages.not_secured_ios.id, default: messages.not_secured_android.id});
|
|
message = translations[key];
|
|
}
|
|
|
|
Alert.alert(
|
|
translations[messages.blocked_by.id].replace('{vendor}', securedBy),
|
|
message,
|
|
buttons,
|
|
{cancelable: false},
|
|
);
|
|
};
|
|
|
|
/**
|
|
* Shows an alert when biometric authentication fails.
|
|
*/
|
|
export const showBiometricFailureAlert = async (server: string, blurOnAuthenticate: boolean, siteName: string | undefined, locale?: string, retryCallback?: () => void) => {
|
|
let serverSiteName;
|
|
try {
|
|
const {database} = DatabaseManager.getServerDatabaseAndOperator(server);
|
|
serverSiteName = await getConfigValue(database, 'SiteName');
|
|
} catch (error) {
|
|
logError('showBiometricFailureAlert', error);
|
|
}
|
|
|
|
const translations = getTranslations(locale || DEFAULT_LOCALE);
|
|
|
|
const buttons = await buildSecurityAlertOptions(server, translations, () => {
|
|
if (blurOnAuthenticate) {
|
|
Emm.removeBlurEffect();
|
|
}
|
|
}, retryCallback);
|
|
const securedBy = siteName || serverSiteName || 'Mattermost';
|
|
|
|
Alert.alert(
|
|
translations[messages.blocked_by.id].replace('{vendor}', securedBy),
|
|
translations[messages.biometric_failed.id],
|
|
buttons,
|
|
{cancelable: false},
|
|
);
|
|
};
|
|
|
|
export const showBiometricFailureAlertForOrganization = async (server: string, locale?: string, retryCallback?: () => void) => {
|
|
const translations = getTranslations(locale || DEFAULT_LOCALE);
|
|
const organization = translations[messages.organization.id];
|
|
|
|
return showBiometricFailureAlert(server, true, organization, locale, retryCallback);
|
|
};
|
|
|
|
/**
|
|
* Shows an alert when authentication is required when Intune fails.
|
|
*/
|
|
export const showAuthenticationRequiredAlert = async (reason?: string, locale?: string, callback?: () => void) => {
|
|
const translations = getTranslations(locale || DEFAULT_LOCALE);
|
|
|
|
// Customize message based on reason
|
|
let title = translations[messages.authentication_required_title.id];
|
|
let message = translations[messages.authentication_required_message.id];
|
|
|
|
if (reason === IntuneAuthRequiredReasons.CONSENT_DENIED) {
|
|
title = translations[messages.consent_denied_title.id];
|
|
message = translations[messages.consent_denied_message.id];
|
|
} else if (reason === IntuneAuthRequiredReasons.AUTH_FAILED) {
|
|
title = translations[messages.authentication_failed_title.id];
|
|
message = translations[messages.authentication_failed_message.id];
|
|
}
|
|
|
|
Alert.alert(title, message, [{text: translations[messages.okay.id], onPress: callback}], {cancelable: false});
|
|
};
|
|
|
|
/**
|
|
* Shows an alert when Intune conditional access blocks access to the app.
|
|
*/
|
|
export const showConditionalAccessAlert = async (locale?: string, callback?: () => void) => {
|
|
const translations = getTranslations(locale || DEFAULT_LOCALE);
|
|
Alert.alert(
|
|
translations[messages.access_blocked_title.id],
|
|
translations[messages.access_blocked_message.id],
|
|
[{text: translations[messages.okay.id], onPress: callback}],
|
|
{cancelable: false},
|
|
);
|
|
};
|
|
|
|
/**
|
|
* Shows an alert when Intune requires an identity switch.
|
|
*/
|
|
export const showIdentitySwitchRequiredAlert = async (locale?: string) => {
|
|
const translations = getTranslations(locale || DEFAULT_LOCALE);
|
|
Alert.alert(
|
|
translations[messages.identity_switch_required_title.id],
|
|
translations[messages.identity_switch_required_message.id],
|
|
[{text: translations[messages.okay.id]}],
|
|
{cancelable: false},
|
|
);
|
|
};
|
|
|
|
/**
|
|
* Shows an alert when MAM enrollment is required.
|
|
* User can choose to enroll now or cancel (which logs them out).
|
|
*/
|
|
export const showMAMEnrollmentRequiredAlert = async (
|
|
siteName: string | undefined,
|
|
locale: string | undefined,
|
|
enrollCallback: () => void,
|
|
cancelCallback: () => void,
|
|
) => {
|
|
const translations = getTranslations(locale || DEFAULT_LOCALE);
|
|
const organization = siteName || translations[messages.organization.id];
|
|
const message = translations[messages.mam_enrollment_required_message.id].replace('{organization}', organization);
|
|
|
|
Alert.alert(
|
|
translations[messages.mam_enrollment_required_title.id],
|
|
message,
|
|
[
|
|
{
|
|
text: translations[messages.cancel.id],
|
|
style: 'cancel',
|
|
onPress: cancelCallback,
|
|
},
|
|
{
|
|
text: translations[messages.enroll_now.id],
|
|
style: 'default',
|
|
onPress: enrollCallback,
|
|
},
|
|
],
|
|
{cancelable: false},
|
|
);
|
|
};
|
|
|
|
/**
|
|
* Shows an alert when MAM enrollment fails.
|
|
* User will be logged out after dismissing the alert.
|
|
*/
|
|
export const showMAMEnrollmentFailedAlert = async (
|
|
locale?: string,
|
|
callback?: () => void,
|
|
) => {
|
|
const translations = getTranslations(locale || DEFAULT_LOCALE);
|
|
|
|
Alert.alert(
|
|
translations[messages.mam_enrollment_failed_title.id],
|
|
translations[messages.mam_enrollment_failed_message.id],
|
|
[{text: translations[messages.okay.id], onPress: callback}],
|
|
{cancelable: false},
|
|
);
|
|
};
|
|
|
|
/**
|
|
* Shows an alert when user declines MAM enrollment.
|
|
* Provides option to retry enrollment or logout.
|
|
*/
|
|
export const showMAMDeclinedAlert = async (
|
|
server: string,
|
|
siteName: string | undefined,
|
|
locale: string | undefined,
|
|
callback: (value: boolean) => void,
|
|
retryCallback: () => void,
|
|
) => {
|
|
const translations = getTranslations(locale || DEFAULT_LOCALE);
|
|
const organization = siteName || translations[messages.organization.id];
|
|
const message = translations[messages.mam_declined_message.id].replace('{organization}', organization);
|
|
|
|
const buttons = await buildSecurityAlertOptions(server, translations, callback, retryCallback);
|
|
|
|
Alert.alert(
|
|
translations[messages.mam_declined_title.id],
|
|
message,
|
|
buttons,
|
|
{cancelable: false},
|
|
);
|
|
};
|
|
|
|
/**
|
|
* Shows an alert when MAM compliance remediation fails (post-enrollment SDK-triggered check).
|
|
* Uses SDK-provided localized title/message when available, falls back to our own strings.
|
|
*/
|
|
export const showMAMComplianceFailedAlert = (
|
|
sdkTitle: string,
|
|
sdkMessage: string,
|
|
reason: string,
|
|
locale?: string,
|
|
callback?: () => void,
|
|
) => {
|
|
const translations = getTranslations(locale || DEFAULT_LOCALE);
|
|
|
|
const title = sdkTitle || translations[messages.compliance_alert_title.id];
|
|
|
|
let message = sdkMessage;
|
|
if (!message) {
|
|
switch (reason) {
|
|
case 'not_compliant':
|
|
message = translations[messages.compliance_not_compliant.id];
|
|
break;
|
|
case 'network_failure':
|
|
message = translations[messages.compliance_network_failure.id];
|
|
break;
|
|
case 'service_failure':
|
|
message = translations[messages.compliance_service_failure.id];
|
|
break;
|
|
case 'user_cancelled':
|
|
message = translations[messages.compliance_user_cancelled.id];
|
|
break;
|
|
default:
|
|
message = translations[messages.compliance_service_failure.id];
|
|
break;
|
|
}
|
|
}
|
|
|
|
Alert.alert(
|
|
title,
|
|
message,
|
|
[{text: translations[messages.okay.id], onPress: callback}],
|
|
{cancelable: false},
|
|
);
|
|
};
|