diff --git a/changes/47832-filevault-escrow-banner-ade-copy b/changes/47832-filevault-escrow-banner-ade-copy new file mode 100644 index 0000000000..3c538d1570 --- /dev/null +++ b/changes/47832-filevault-escrow-banner-ade-copy @@ -0,0 +1 @@ +* Updated the macOS disk encryption banner on the Host details and My device pages to tell IT admins and end users that ADE-enrolled hosts escrow their FileVault key automatically on the next refetch, instead of asking the end user to log out. diff --git a/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tests.tsx b/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tests.tsx index 79b4b0a095..3bb5eed5dd 100644 --- a/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tests.tsx +++ b/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tests.tsx @@ -7,6 +7,7 @@ import DeviceUserBanners from "./DeviceUserBanners"; describe("Device User Banners", () => { const turnOnMdmExpcetedText = /Mobile device management \(MDM\) is off\./; const resetNonLinuxDiskEncryptKeyExpectedText = /Disk encryption: Log out of your device or restart it to safeguard your data in case your device is lost or stolen\./; + const adeDiskEncryptKeyExpectedText = /Disk encryption: Refetch to ensure data is safeguarded in case your device is lost or stolen\. If this banner persists, contact your IT admin\./; const createNewLinuxDiskEncryptKeyExpectedText = /Disk encryption: Create a new disk encryption key\. This lets your organization help you unlock your device if you forget your passphrase\./; const createPINExepectedText = /Disk encryption: Create a BitLocker PIN to safeguard your data/; @@ -31,7 +32,7 @@ describe("Device User Banners", () => { render( { screen.getByText(resetNonLinuxDiskEncryptKeyExpectedText) ).toBeInTheDocument(); }); + + it("renders the refetch disk encryption banner for ADE-enrolled hosts", () => { + render( + + ); + expect(screen.getByText(adeDiskEncryptKeyExpectedText)).toBeInTheDocument(); + expect( + screen.queryByText(resetNonLinuxDiskEncryptKeyExpectedText) + ).not.toBeInTheDocument(); + }); + + // "On (company-owned)" is the current name for automatic enrollment; "On (automatic)" + // is the legacy value the API still returns + it("renders the refetch disk encryption banner for company-owned hosts", () => { + render( + + ); + expect(screen.getByText(adeDiskEncryptKeyExpectedText)).toBeInTheDocument(); + }); it("renders the create new linux disk encryption key banner correctly for Ubuntu", () => { render( - Disk encryption: Log out of your device or restart it to safeguard - your data in case your device is lost or stolen. After, select{" "} - Refetch to clear this banner. + {isAdeEnrolled ? ( + <> + Disk encryption: Refetch to ensure data is safeguarded in case + your device is lost or stolen. If this banner persists, contact + your IT admin. + + ) : ( + <> + Disk encryption: Log out of your device or restart it to safeguard + your data in case your device is lost or stolen. After, select{" "} + Refetch to clear this banner. + + )} ); } diff --git a/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tests.tsx b/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tests.tsx new file mode 100644 index 0000000000..77795ca48b --- /dev/null +++ b/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tests.tsx @@ -0,0 +1,81 @@ +import React from "react"; +import { screen } from "@testing-library/react"; + +import { createCustomRenderer } from "test/test-utils"; +import createMockConfig from "__mocks__/configMock"; + +import HostDetailsBanners from "./HostDetailsBanners"; + +const render = createCustomRenderer({ + context: { app: { config: createMockConfig() } }, +}); + +describe("Host Details Banners", () => { + const logOutExpectedText = /Disk encryption: Requires action from the end user\. Ask the end user to log out of their device or restart it\./; + const escrowedAutomaticallyExpectedText = /Disk encryption: FileVault key will be escrowed automatically on this host's next refetch\./; + + it("tells the admin the key is escrowed automatically for ADE-enrolled hosts", () => { + render( + + ); + + expect( + screen.getByText(escrowedAutomaticallyExpectedText) + ).toBeInTheDocument(); + expect(screen.queryByText(logOutExpectedText)).not.toBeInTheDocument(); + }); + + // "On (company-owned)" is the current name for automatic enrollment; "On (automatic)" + // is the legacy value the API still returns + it("tells the admin the key is escrowed automatically for company-owned hosts", () => { + render( + + ); + + expect( + screen.getByText(escrowedAutomaticallyExpectedText) + ).toBeInTheDocument(); + }); + + it("tells the admin to ask the end user to log out for manually-enrolled hosts", () => { + render( + + ); + + expect(screen.getByText(logOutExpectedText)).toBeInTheDocument(); + expect( + screen.queryByText(escrowedAutomaticallyExpectedText) + ).not.toBeInTheDocument(); + }); + + it("renders no disk encryption banner when the key is not in an action required state", () => { + render( + + ); + + expect( + screen.queryByText(escrowedAutomaticallyExpectedText) + ).not.toBeInTheDocument(); + expect(screen.queryByText(logOutExpectedText)).not.toBeInTheDocument(); + }); +}); diff --git a/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx b/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx index 34d7ea6544..ea75514d14 100644 --- a/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx +++ b/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx @@ -2,7 +2,11 @@ import React, { useContext } from "react"; import { AppContext } from "context/app"; import { addHours, isPast } from "date-fns"; -import { DiskEncryptionStatus, MdmEnrollmentStatus } from "interfaces/mdm"; +import { + DiskEncryptionStatus, + MdmEnrollmentStatus, + isAutomaticDeviceEnrollment, +} from "interfaces/mdm"; import { IOSSettings } from "interfaces/host"; import { HostPlatform, @@ -67,6 +71,11 @@ const HostDetailsBanners = ({ macDiskEncryptionStatus === "action_required" && !isNewMdmEnrollment; + // ADE-enrolled hosts escrow their FileVault key automatically, so the end user + // doesn't need to log out. Manually-enrolled hosts only get a new key at next + // login, so they keep the log-out instruction. + const isAdeEnrolled = isAutomaticDeviceEnrollment(mdmEnrollmentStatus); + const actionRequiredBanner = (
@@ -92,8 +101,17 @@ const HostDetailsBanners = ({ return (
- Disk encryption: Requires action from the end user. Ask the end user - to log out of their device or restart it. + {isAdeEnrolled ? ( + <> + Disk encryption: FileVault key will be escrowed automatically on + this host's next refetch. + + ) : ( + <> + Disk encryption: Requires action from the end user. Ask the end + user to log out of their device or restart it. + + )}
);