feat(domain-join): add interactive and zero-touch domain joining

src/Foundry.Bootstrap.Tests/Processes/ApplicationLauncherTests.cs

@@ -326,69 +326,4 @@ public async Task StartupFailureRecoveryWaitsForExitWithinBoundedGrace(bool exit
             Directory.Delete(directory, recursive: true);
         }
     }
-
-    [Theory]
-    [InlineData(true)]
-    [InlineData(false)]
-    public async Task NegotiatedChildAcknowledgementUsesActualLaunchIdentity(bool connect)
-    {
-        string directory = Directory.CreateTempSubdirectory("FoundryStartup-").FullName;
-        Process? fixture = null;
-        try
-        {
-            string application = connect ? "Foundry.Connect" : "Foundry.Deploy";
-            string executable = Path.Combine(directory, application + ".exe");
-            File.WriteAllText(executable, "prepared payload");
-            File.WriteAllText(Path.Combine(directory, "foundry.startup.json"), "{\"protocolVersions\":[1]}");
-            using var logger = new LoggerConfiguration().CreateLogger();
-            var launcher = new ApplicationLauncher(logger, Path.Combine(directory, "session"), startProcess: start =>
-            {
-                string script = $$"""
-                    $status = @{
-                        protocolVersion = [int]$env:FOUNDRY_STARTUP_PROTOCOL
-                        sessionId = $env:FOUNDRY_DIAGNOSTIC_SESSION_ID
-                        launchId = $env:FOUNDRY_STARTUP_LAUNCH_ID
-                        application = '{{application}}'
-                        processId = $PID
-                        stage = 'ui_ready'
-                        timestampUtc = [DateTime]::UtcNow.ToString('o')
-                    } | ConvertTo-Json -Compress
-                    [IO.File]::WriteAllText($env:FOUNDRY_STARTUP_STATUS_PATH, $status)
-                    {{(connect ? "exit 0" : "Start-Sleep -Seconds 30")}}
-                    """;
-                start.FileName = "powershell.exe";
-                start.WorkingDirectory = Path.GetTempPath();
-                start.CreateNoWindow = true;
-                start.ArgumentList.Clear();
-                start.ArgumentList.Add("-NoProfile");
-                start.ArgumentList.Add("-NonInteractive");
-                start.ArgumentList.Add("-EncodedCommand");
-                start.ArgumentList.Add(Convert.ToBase64String(System.Text.Encoding.Unicode.GetBytes(script)));
-                Process? child = Process.Start(start);
-                if (child is not null) { fixture = Process.GetProcessById(child.Id); }
-                return child;
-            }, releasePayload: File.Delete);
-            using var deadline = new CancellationTokenSource(TimeSpan.FromSeconds(15));
-            var environment = new Dictionary<string, string?> { ["FOUNDRY_DIAGNOSTIC_SESSION_ID"] = "TEST" };
-            ApplicationLaunchResult result = connect
-                ? await launcher.RunConnectAsync(executable, "missing.json", environment, deadline.Token)
-                : await launcher.StartDeployAsync(executable, environment, deadline.Token);
-            Assert.True(result.Succeeded);
-            Assert.True(result.ReadinessConfirmed);
-            Assert.Equal("ui_ready", result.LastStage);
-            Assert.Equal(!connect, File.Exists(executable));
-        }
-        finally
-        {
-            if (fixture is not null)
-            {
-                using (fixture)
-                {
-                    if (!fixture.HasExited) { fixture.Kill(); }
-                    await fixture.WaitForExitAsync(CancellationToken.None);
-                }
-            }
-            Directory.Delete(directory, recursive: true);
-        }
-    }
 }

src/Foundry.Core.Tests/BootMediaTelemetryPropertyBuilderTests.cs

@@ -735,6 +735,66 @@ public void Build_WhenAutopilotIsDisabled_ReportsDisabledProvisioningMode()
         Assert.Equal(TelemetryBootMediaUsbOperations.None, result["boot_media_usb_operation"]);
     }
 
+    [Theory]
+    [InlineData(false, DomainJoinMode.Automatic, "disabled", 0, 0, false, false)]
+    [InlineData(true, DomainJoinMode.Automatic, "zero_touch", 2, 3, true, true)]
+    [InlineData(true, DomainJoinMode.Interactive, "interactive", 2, 3, true, false)]
+    public void Build_ReportsDomainJoinUsageWithoutDirectoryNames(bool enabled, DomainJoinMode mode, string expectedMode,
+        int expectedDomains, int expectedOus, bool expectedDefaultOu, bool expectedSharedAccount)
+    {
+        var document = new FoundryConfigurationDocument
+        {
+            DomainJoin = new DomainJoinSettings
+            {
+                IsEnabled = enabled,
+                Mode = mode,
+                SharedAccountName = @"PRIVATE\joiner",
+                DefaultDomainId = "one",
+                Domains =
+                [
+                    new()
+                    {
+                        Id = "one",
+                        DomainName = "private.example.test",
+                        DefaultOuId = "ou-1",
+                        OrganizationalUnits =
+                        [
+                            new() { Id = "ou-1", DisplayName = "PrivateOne", DistinguishedName = "OU=PrivateOne,DC=private,DC=example,DC=test" },
+                            new() { Id = "ou-2", DisplayName = "PrivateTwo", DistinguishedName = "OU=PrivateTwo,DC=private,DC=example,DC=test" }
+                        ]
+                    },
+                    new()
+                    {
+                        Id = "two",
+                        DomainName = "private2.example.test",
+                        AccountName = @"PRIVATE2\joiner",
+                        OrganizationalUnits = [new() { Id = "ou-3", DisplayName = "PrivateThree", DistinguishedName = "OU=PrivateThree,DC=private2,DC=example,DC=test" }]
+                    }
+                ]
+            }
+        };
+
+        IReadOnlyDictionary<string, object?> result = BootMediaTelemetryPropertyBuilder.Build(
+            TelemetryBootMediaTargets.Iso,
+            TelemetryBootMediaUsbOperations.None,
+            new MediaPreflightOptions(),
+            document,
+            success: true,
+            failedStepName: null,
+            duration: TimeSpan.Zero,
+            connectRuntimePayloadSource: TelemetryRuntimePayloadSources.None,
+            deployRuntimePayloadSource: TelemetryRuntimePayloadSources.None);
+
+        Assert.Equal(enabled, result["domain_join_enabled"]);
+        Assert.Equal(expectedMode, result["domain_join_mode"]);
+        Assert.Equal(expectedDomains, result["domain_join_domain_count"]);
+        Assert.Equal(expectedOus, result["domain_join_ou_count"]);
+        Assert.Equal(expectedDefaultOu, result["domain_join_default_ou_set"]);
+
+        Assert.Equal(expectedSharedAccount, result["domain_join_shared_account_used"]);
+        Assert.DoesNotContain(result.Values, value => value is string text && text.Contains("private", StringComparison.OrdinalIgnoreCase));
+    }
+
     [Fact]
     public void Build_WhenInteractiveHardwareHashUploadIsEnabled_ReportsInteractiveMode()
     {

src/Foundry.Core.Tests/Configuration/ConfigurationOverviewEvaluatorTests.cs

@@ -9,6 +9,38 @@ namespace Foundry.Core.Tests.Configuration;
 
 public sealed class ConfigurationOverviewEvaluatorTests
 {
+    [Theory]
+    [InlineData(DomainJoinMode.Interactive, true, ConfigurationOverviewState.Configured)]
+    [InlineData(DomainJoinMode.Interactive, false, ConfigurationOverviewState.NeedsAttention)]
+    [InlineData(DomainJoinMode.Automatic, true, ConfigurationOverviewState.Configured)]
+    [InlineData(DomainJoinMode.Automatic, false, ConfigurationOverviewState.NeedsAttention)]
+    public void Evaluate_DomainJoinOnlyActiveModeUsesReadiness(DomainJoinMode mode, bool ready, ConfigurationOverviewState expected)
+    {
+        var configuration = new FoundryConfigurationDocument
+        {
+            DomainJoin = new DomainJoinSettings { IsEnabled = true, Mode = mode }
+        };
+        ConfigurationOverviewEvaluation evaluation = ConfigurationOverviewEvaluator.Evaluate(
+            CreateContext(configuration) with { IsDomainJoinConfigurationReady = ready });
+        ConfigurationOverviewItem active = mode == DomainJoinMode.Interactive ? ConfigurationOverviewItem.DomainJoinInteractive : ConfigurationOverviewItem.DomainJoinAutomatic;
+        ConfigurationOverviewItem inactive = mode == DomainJoinMode.Interactive ? ConfigurationOverviewItem.DomainJoinAutomatic : ConfigurationOverviewItem.DomainJoinInteractive;
+        Assert.Equal(expected, evaluation[active]);
+        Assert.Equal(ConfigurationOverviewState.NotSelected, evaluation[inactive]);
+        Assert.Equal(expected, ConfigurationOverviewNavigationEvaluator.EvaluateTarget(evaluation,
+            mode == DomainJoinMode.Interactive ? ConfigurationNavigationTarget.DomainJoinInteractive : ConfigurationNavigationTarget.DomainJoinAutomatic));
+    }
+
+    [Fact]
+    public void Evaluate_AutomaticDomainWithoutProtectionNeedsAttentionOnGeneralPage()
+    {
+        var configuration = new FoundryConfigurationDocument
+        {
+            DomainJoin = new DomainJoinSettings { IsEnabled = true, Mode = DomainJoinMode.Automatic }
+        };
+        ConfigurationOverviewEvaluation evaluation = ConfigurationOverviewEvaluator.Evaluate(CreateContext(configuration));
+        Assert.Equal(ConfigurationOverviewState.NeedsAttention, evaluation[ConfigurationOverviewItem.DeploymentProtection]);
+    }
+
     [Theory]
     [InlineData(false, 0, true, ConfigurationOverviewState.Disabled)]
     [InlineData(true, 0, true, ConfigurationOverviewState.NeedsAttention)]

src/Foundry.Core.Tests/Configuration/ConfigurationSchemaVersionsTests.cs

@@ -11,8 +11,8 @@ public sealed class ConfigurationSchemaVersionsTests
     [Fact]
     public void CurrentSchemaVersions_MatchNextPublishedContractVersions()
     {
-        Assert.Equal(17, ConfigurationSchemaVersions.FoundryCurrent);
-        Assert.Equal(15, ConfigurationSchemaVersions.DeployCurrent);
+        Assert.Equal(18, ConfigurationSchemaVersions.FoundryCurrent);
+        Assert.Equal(16, ConfigurationSchemaVersions.DeployCurrent);
         Assert.Equal(5, ConfigurationSchemaVersions.ConnectCurrent);
     }
 

src/Foundry.Core.Tests/Configuration/DeployConfigurationGeneratorTests.cs

@@ -14,6 +14,124 @@ namespace Foundry.Core.Tests.Configuration;
 
 public sealed class DeployConfigurationGeneratorTests
 {
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public void AnInvalidDomainListBlocksMediaOnlyWhileDomainJoinIsEnabled(bool enabled)
+    {
+        var document = new FoundryConfigurationDocument
+        {
+            DomainJoin = new()
+            {
+                IsEnabled = enabled,
+                DefaultDomainId = "a",
+                Domains = [new() { Id = "a", DomainName = "fabrikam.test", OrganizationalUnits = [new() { Id = "devices", DisplayName = "Devices", DistinguishedName = "OU=Devices,DC=contoso,DC=test" }] }]
+            }
+        };
+        var generator = new DeployConfigurationGenerator();
+
+        if (enabled)
+        {
+            Assert.Throws<InvalidOperationException>(() => generator.Generate(document, null, null, null, null));
+            return;
+        }
+
+        var media = generator.Generate(document, null, null, null, null);
+        Assert.False(media.DomainJoin.IsEnabled);
+        Assert.Empty(media.DomainJoin.Domains);
+    }
+
+    [Fact]
+    public void InteractiveProjectionOmitsAccountsAndPayloads()
+    {
+        using var secrets = new DomainJoinSecretState();
+        secrets.SetPassword("CORP\\join", "password");
+        var document = new FoundryConfigurationDocument { DomainJoin = TwoDomains() with { Mode = DomainJoinMode.Interactive } };
+        var media = new DeployConfigurationGenerator().Generate(document, null, null, null, secrets);
+        Assert.True(media.DomainJoin.IsEnabled);
+        Assert.Equal(2, media.DomainJoin.Domains.Count);
+        Assert.Equal("corp", media.DomainJoin.DefaultDomainId);
+
+        Assert.All(media.DomainJoin.Domains, domain =>
+        {
+            Assert.Null(domain.AccountName);
+            Assert.Null(domain.EncryptedCredentials);
+        });
+        Assert.Equal("ws", media.DomainJoin.Domains[0].DefaultOuId);
+        Assert.Single(media.DomainJoin.Domains[0].OrganizationalUnits);
+    }
+
+    [Theory]
+    [InlineData(false, true, true)]
+    [InlineData(true, false, true)]
+    [InlineData(true, true, false)]
+    public void ZeroTouchRequiresProtectionAndEveryPassword(bool protectedMedia, bool hasKey, bool hasEveryPassword)
+    {
+        using var secrets = new DomainJoinSecretState();
+        secrets.SetPassword("CORP\\join", "p1");
+        if (hasEveryPassword) secrets.SetPassword("EMEA\\join", "p2");
+        var document = new FoundryConfigurationDocument { DomainJoin = TwoDomains() };
+        Assert.Throws<InvalidOperationException>(() => new DeployConfigurationGenerator().Generate(document, hasKey ? new byte[32] : null,
+            new() { IsEnabled = protectedMedia }, null, secrets));
+    }
+
+    [Fact]
+    public void ZeroTouchWritesOnePayloadPerDomainBoundToItsOwnDomain()
+    {
+        using var secrets = new DomainJoinSecretState();
+        secrets.SetPassword("CORP\\join", " exact password ");
+        secrets.SetPassword("EMEA\\join", "p2");
+        byte[] key = new byte[32];
+        var generator = new DeployConfigurationGenerator();
+        var media = generator.Generate(new FoundryConfigurationDocument { DomainJoin = TwoDomains() }, key, new() { IsEnabled = true }, null, secrets);
+        Assert.Equal("CORP\\join", media.DomainJoin.Domains[0].AccountName);
+        Assert.Equal("EMEA\\join", media.DomainJoin.Domains[1].AccountName);
+        byte[][] plaintext = media.DomainJoin.Domains
+            .Select(domain => MediaSecretEnvelopeProtector.DecryptBytes(domain.EncryptedCredentials!, key, MediaSecretEnvelopeProtector.DeploymentKeyId)).ToArray();
+        try
+        {
+            using var corp = DomainJoinCredentialPayloadCodec.Decode(plaintext[0], new("corp.test", "CORP\\join"));
+            using var emea = DomainJoinCredentialPayloadCodec.Decode(plaintext[1], new("emea.test", "EMEA\\join"));
+            Assert.Equal(" exact password ", new string(corp.Password.Span));
+            Assert.Equal("p2", new string(emea.Password.Span));
+            Assert.DoesNotContain("exact password", generator.Serialize(media));
+        }
+        finally { foreach (byte[] bytes in plaintext) System.Security.Cryptography.CryptographicOperations.ZeroMemory(bytes); }
+    }
+
+    [Fact]
+    public void ASharedAccountPayloadCannotBeDecodedForAnotherDomain()
+    {
+        using var secrets = new DomainJoinSecretState();
+        secrets.SetPassword("CORP\\join", "shared");
+        byte[] key = new byte[32];
+        DomainJoinSettings settings = TwoDomains();
+        settings = settings with { Domains = [settings.Domains[0], settings.Domains[1] with { AccountName = null }] };
+        var media = new DeployConfigurationGenerator().Generate(new FoundryConfigurationDocument { DomainJoin = settings }, key, new() { IsEnabled = true }, null, secrets);
+        Assert.All(media.DomainJoin.Domains, domain => Assert.Equal("CORP\\join", domain.AccountName));
+        byte[] corp = MediaSecretEnvelopeProtector.DecryptBytes(media.DomainJoin.Domains[0].EncryptedCredentials!, key, MediaSecretEnvelopeProtector.DeploymentKeyId);
+        try
+        {
+            Assert.Throws<System.Security.Cryptography.CryptographicException>(() => DomainJoinCredentialPayloadCodec.Decode(corp, new("emea.test", "CORP\\join")));
+            using var decoded = DomainJoinCredentialPayloadCodec.Decode(corp, new("corp.test", "CORP\\join"));
+            Assert.Equal("shared", new string(decoded.Password.Span));
+        }
+        finally { System.Security.Cryptography.CryptographicOperations.ZeroMemory(corp); }
+    }
+
+    private static DomainJoinSettings TwoDomains() => new()
+    {
+        IsEnabled = true,
+        Mode = DomainJoinMode.Automatic,
+        SharedAccountName = "CORP\\join",
+        DefaultDomainId = "corp",
+        Domains =
+        [
+            new() { Id = "corp", DomainName = "corp.test", DefaultOuId = "ws", OrganizationalUnits = [new() { Id = "ws", DisplayName = "Workstations", DistinguishedName = "OU=Workstations,DC=corp,DC=test" }] },
+            new() { Id = "emea", DomainName = "emea.test", AccountName = "EMEA\\join" }
+        ]
+    };
+
     [Theory]
     [InlineData("26.10.3.1")]
     [InlineData(null)]