Repository navigation
Join your company with an enrolment token - #832
Merged
Merged
Conversation
Matches the app's serverAllowed: a server.url lock without server.allowOther=false no longer blocks a token for another server. One block_on_timeout helper now runs both the enrol resolve and the plugin catalogue fetch.
- Closing the enrol modal is ignored while a submit or Join runs; each open is its own mount, so a late result never lands in a later open. - The machine server lock gates every resolve in the store: the palette shows the managed refusal, the inbox offers no invite. - An active-session redeem reloads my join requests. - A saved account on the token's server preselects Sign in. - Paste fields accept the enrol link as well as the bare token. - A cleartext token server shows http:// in its host label. - Retry-After is capped at one day. - Shared activeAccountAuth, tokenHost and CopyButton; clipboard rejection is caught. - invoke from @/lib/invoke; voltius-enrollment is device-scoped. - fr: jeton d'enrôlement; changelog and comment fixes.
This was referenced Nov 9, 2026
33 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lets people join their company from an enrolment token, and lets IT put that token on a machine. Closes the "
voltius-cli enroll <token>" and "Client: enrolment first-launch flow" items on #757.IT side.
voltius-cli enroll <token>checks the token with its server and writes it into the machine policy file asenrollment.token(a Rust copy of the token parser, tested against the shared fixture). Running it again with the same token changes nothing and exits 0, even offline; a revoked token exits 3 so a fleet run notices.--jsonreportschangedfor Ansible,--no-verifyskips the check for image builds,--shownever prints the secret,--removetakes it off. It refuses when the machine's policy pins another server and forbids others, the same rule the app uses.Employee side. The token can arrive three ways: written by
voltius-cli enroll, anenrolllink (voltius://enroll?t=…orhttps://voltius.app/open#enroll?t=…), or pasted (first-launch "Have an enrolment token?" field, or Ctrl+K). All three open one "Sign in to " form: create an account or sign in on the token's server, the join request is sent, then the outcome (joined, waiting for an admin, verify your email with Resend, no free seat). At first launch it fills the screen; from a running app it opens as a modal and keeps the other account in the switcher. Local accounts, including the passwordless "Skip for now" one, go through the existing link-to-cloud rules, now shared with CloudAuthModal.Safety.
http://server shows its scheme.Status afterwards lives in notifications: an invite when the machine has a token and the account isn't in the team yet, "waiting for approval", "verify your email", "declined" with Ask again, and a "You joined" message. It updates live from the server and reloads whenever the live connection comes back.
Admins get Copy link next to the token, for people on their own devices.
Needs VoltiusApp/server#129 deployed first (coded not-found,
team_id, the joiner's request list and its live event). Against older servers the form says the server doesn't support enrolment tokens yet and the inbox status stays absent.Screens of this branch against a private server: https://claude.ai/artifact/1Gbg53FmAqW6MthfKLFDc3
Tests: full
src/vitest 8791 passed,tscclean,cargo test policy:: cli::230 passed, clippy clean.tests/pluginBundleBuildandtests/pluginCatalogPublishfail only from a worktree with symlinked node_modules (known). Not live-tested on a real Android or iOS device; mobile screens are the mobile layout in the desktop build.Related: web bridge VoltiusApp/web (enroll route in /open), docs stacked on VoltiusApp/docs#71.