Move devices to group

//native

/**

 * Move devices to group

 * Move up to 50 devices (by serial number) to a configuration group. preserve_config_overrides ["AOS_CX"] keeps AOS-CX device configuration when moving to a UI group.

 */

export async function main(

  auth: RT.ArubaCentralOnprem,

  group: string,

  serials: string[],

  preserve_config_overrides: "AOS_CX"[] | undefined

) {

  if (!serials?.length) {

    throw new Error("serials must contain at least one device serial")

  }

  if (serials.length > 50) {

    throw new Error("the API moves at most 50 devices per request")

  }

  const token = await getAccessToken(auth, "all")

  const base = auth.base_url.replace(/\/+$/, "")

  const response = await fetch(`${base}/configuration/v1/devices/move`, {

    method: "POST",

    headers: {

      Authorization: `Bearer ${token}`,

      "Content-Type": "application/json",

      Accept: "application/json",

    },

    body: JSON.stringify({

      group,

      serials,

      preserve_config_overrides: preserve_config_overrides?.length

        ? preserve_config_overrides

        : undefined,

    }),

  })

  if (!response.ok) {

    throw new Error(`${response.status} ${await response.text()}`)

  }

  const text = await response.text()

  return text ? JSON.parse(text) : { success: true, group, serials }

}

// OAuth grant mechanism documented for Central On-Premises (API Gateway > OAuth grant):

// login -> authorization code -> access token. Tokens last 2 hours, so a fresh one is minted per run.

async function getAccessToken(

  auth: RT.ArubaCentralOnprem,

  scope: "read" | "all"

): Promise<string> {

  const base = auth.base_url.replace(/\/+$/, "")

  const loginUrl = new URL(`${base}/oauth2/authorize/central/api/login`)

  loginUrl.searchParams.append("client_id", auth.client_id)

  const login = await fetch(loginUrl, {

    method: "POST",

    headers: { "Content-Type": "application/json", Accept: "application/json" },

    body: JSON.stringify({ username: auth.username, password: auth.password }),

  })

  if (!login.ok) {

    throw new Error(`login: ${login.status} ${await login.text()}`)

  }

  const cookies = login.headers.get("set-cookie") ?? ""

  const csrf = cookies.match(/csrftoken=([^;,\s]+)/)?.[1]

  const session = cookies.match(/session=([^;,\s]+)/)?.[1]

  if (!csrf || !session) {

    throw new Error(

      "login: response did not set the csrftoken and session cookies"

    )

  }

  const authorizeUrl = new URL(`${base}/oauth2/authorize/central/api`)

  authorizeUrl.searchParams.append("client_id", auth.client_id)

  authorizeUrl.searchParams.append("response_type", "code")

  authorizeUrl.searchParams.append("scope", scope)

  const authorize = await fetch(authorizeUrl, {

    method: "POST",

    headers: {

      "Content-Type": "application/json",

      Accept: "application/json",

      Cookie: `session=${session}`,

      "X-CSRF-Token": csrf,

    },

    body: JSON.stringify({ customer_id: auth.customer_id }),

  })

  if (!authorize.ok) {

    throw new Error(`authorize: ${authorize.status} ${await authorize.text()}`)

  }

  const { auth_code } = (await authorize.json()) as { auth_code: string }

  const tokenUrl = new URL(`${base}/oauth2/token`)

  tokenUrl.searchParams.append("client_id", auth.client_id)

  tokenUrl.searchParams.append("client_secret", auth.client_secret)

  tokenUrl.searchParams.append("grant_type", "authorization_code")

  tokenUrl.searchParams.append("code", auth_code)

  const token = await fetch(tokenUrl, {

    method: "POST",

    headers: { Accept: "application/json" },

  })

  if (!token.ok) {

    throw new Error(`token: ${token.status} ${await token.text()}`)

  }

  const { access_token } = (await token.json()) as { access_token: string }

  return access_token

}