diff --git a/changes/14577-observer-plus-run-policies b/changes/14577-observer-plus-run-policies new file mode 100644 index 0000000000..6c7b0af28b --- /dev/null +++ b/changes/14577-observer-plus-run-policies @@ -0,0 +1 @@ +- Bug fix: Allow Observer+ ability to run all existing policies in the UI diff --git a/docs/Using Fleet/manage-access.md b/docs/Using Fleet/manage-access.md index 18f129c557..ff6507dbfd 100644 --- a/docs/Using Fleet/manage-access.md +++ b/docs/Using Fleet/manage-access.md @@ -50,10 +50,11 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines. | Run queries designated "**observer can run**" as live queries against all hosts | ✅ | ✅ | ✅ | ✅ | | | Run any query as [live query](https://fleetdm.com/docs/using-fleet/fleet-ui#run-a-query) against all hosts | | ✅ | ✅ | ✅ | | | Create, edit, and delete queries | | | ✅ | ✅ | ✅ | -| View all queries and their reports\** | ✅ | ✅ | ✅ | ✅ | | -| Manage [query automations](https://fleetdm.com/docs/using-fleet/fleet-ui#schedule-a-query) | | | ✅ | ✅ | ✅ | +| View all queries and their reports\** | ✅ | ✅ | ✅ | ✅ | | +| Manage [query automations](https://fleetdm.com/docs/using-fleet/fleet-ui#schedule-a-query) | | | ✅ | ✅ | ✅ | | Create, edit, view, and delete packs | | | ✅ | ✅ | ✅ | | View all policies | ✅ | ✅ | ✅ | ✅ | | +| Run all policies | | ✅ | ✅ | ✅ | | | Filter hosts using policies | ✅ | ✅ | ✅ | ✅ | | | Create, edit, and delete policies for all hosts | | | ✅ | ✅ | ✅ | | Create, edit, and delete policies for all hosts assigned to team\* | | | ✅ | ✅ | ✅ | @@ -75,7 +76,7 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines. | View Apple mobile device management (MDM) certificate information | | | | ✅ | | | View Apple business manager (BM) information | | | | ✅ | | | Generate Apple mobile device management (MDM) certificate signing request (CSR) | | | | ✅ | | -| View disk encryption key for macOS and Windows hosts | ✅ | ✅ | ✅ | ✅ | | +| View disk encryption key for macOS and Windows hosts | ✅ | ✅ | ✅ | ✅ | | | Create edit and delete configuration profiles for macOS hosts | | | ✅ | ✅ | ✅ | | Execute MDM commands on macOS and Windows hosts*** | | | ✅ | ✅ | | | View results of MDM commands executed on macOS and Windows hosts*** | ✅ | ✅ | ✅ | ✅ | | @@ -127,11 +128,12 @@ Users that are members of multiple teams can be assigned different roles for eac | Run queries designated "**observer can run**" as live queries against hosts | ✅ | ✅ | ✅ | ✅ | | | Run any query as [live query](https://fleetdm.com/docs/using-fleet/fleet-ui#run-a-query) | | ✅ | ✅ | ✅ | | | Create, edit, and delete only **self authored** queries | | | ✅ | ✅ | ✅ | -| View all queries and their reports\** | ✅ | ✅ | ✅ | ✅ | | -| Manage [query automations](https://fleetdm.com/docs/using-fleet/fleet-ui#schedule-a-query) | | | ✅ | ✅ | ✅ | -| View policies | ✅ | ✅ | ✅ | ✅ | | +| View all queries and their reports\** | ✅ | ✅ | ✅ | ✅ | | +| Manage [query automations](https://fleetdm.com/docs/using-fleet/fleet-ui#schedule-a-query) | | | ✅ | ✅ | ✅ | +| View team policies | ✅ | ✅ | ✅ | ✅ | | +| Run team policies as a live policy | | ✅ | ✅ | ✅ | | | View global (inherited) policies | ✅ | ✅ | ✅ | ✅ | | -| Run global (inherited) policies as a live policy | | | ✅ | ✅ | | +| Run global (inherited) policies as a live policy | | ✅ | ✅ | ✅ | | | Filter hosts using policies | ✅ | ✅ | ✅ | ✅ | | | Create, edit, and delete team policies | | | ✅ | ✅ | ✅ | | Manage [policy automations](https://fleetdm.com/docs/using-fleet/automations#policy-automations) | | | | ✅ | ✅ | diff --git a/frontend/hooks/useTeamIdParam.ts b/frontend/hooks/useTeamIdParam.ts index e5fc1efafb..a40284208a 100644 --- a/frontend/hooks/useTeamIdParam.ts +++ b/frontend/hooks/useTeamIdParam.ts @@ -343,6 +343,10 @@ export const useTeamIdParam = ({ isTeamObserver: !!currentTeam?.id && permissions.isTeamObserver(currentUser, currentTeam.id), + isObserverPlus: + !!currentTeam?.id && + !!currentUser && + permissions.isObserverPlus(currentUser, currentTeam.id), teamIdForApi: getTeamIdForApi({ currentTeam, includeNoTeam }), userTeams, handleTeamChange, diff --git a/frontend/pages/policies/PolicyPage/PolicyPage.tsx b/frontend/pages/policies/PolicyPage/PolicyPage.tsx index 19c2c5aa24..6c44c1463b 100644 --- a/frontend/pages/policies/PolicyPage/PolicyPage.tsx +++ b/frontend/pages/policies/PolicyPage/PolicyPage.tsx @@ -78,6 +78,7 @@ const PolicyPage = ({ isTeamMaintainer, isTeamObserver, teamIdForApi, + isObserverPlus, } = useTeamIdParam({ location, router, @@ -258,6 +259,7 @@ const PolicyPage = ({ isTeamAdmin, isTeamMaintainer, isTeamObserver, + isObserverPlus, storedPolicyError, createPolicy, onOsqueryTableSelect, diff --git a/frontend/pages/policies/PolicyPage/components/PolicyForm/PolicyForm.tsx b/frontend/pages/policies/PolicyPage/components/PolicyForm/PolicyForm.tsx index e19fbfb889..46a9b8a283 100644 --- a/frontend/pages/policies/PolicyPage/components/PolicyForm/PolicyForm.tsx +++ b/frontend/pages/policies/PolicyPage/components/PolicyForm/PolicyForm.tsx @@ -115,6 +115,7 @@ const PolicyForm = ({ isGlobalObserver, isGlobalAdmin, isGlobalMaintainer, + isObserverPlus, isOnGlobalTeam, isPremiumTier, isSandboxMode, @@ -470,7 +471,8 @@ const PolicyForm = ({ ); }; - // Observers and observer+ of existing query, team role viewing inherited policy + // Non-editable form used for Team Observers and Observer+ of their team policy and inherited policies + // And Global Observers and Observer+ of all policies const renderNonEditableForm = (
@@ -507,6 +509,18 @@ const PolicyForm = ({ /> )} {renderLiveQueryWarning()} + {isObserverPlus && ( // Observer+ can run existing policies +
+ +
+ )} );