Fix get policy by id endpoint and unify access in UI (#45048)

**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/44949.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [X] Confirmed that the fix is not expected to adversely impact load
test results.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Policy retrieval now correctly enforces team authorization, preventing
unauthorized cross-team access and ensuring team policies are returned
properly.

* **New Features**
* UI uses a unified policy access path for viewing/editing policies,
improving consistency for inherited/team-scoped policies,
back-navigation, and fleet-name display (All fleets / No team).

* **Tests**
* Added unit and integration tests covering cross-team access rules and
that policy automation fields are populated when policies are returned.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
Lucas Manuel Rodriguez
2026-05-11 09:39:52 -03:00
committed by GitHub
parent b5cb2e235b
commit 04d773f10f
17 changed files with 719 additions and 154 deletions
@@ -0,0 +1,3 @@
- Fixed `GET /api/latest/fleet/policies/:id` endpoint (and alias `GET /api/v1/fleet/global/policies/:id`) to return (and properly populate) team policies.
- Fixed `GET /api/latest/fleet/policies/:id` endpoint (and alias `GET /api/v1/fleet/global/policies/:id`) to perform authorization check on team policies before returning.
- Unify access to global and team policies in UI by using the now generic `GET /api/latest/fleet/policies/:id` endpoint.