From f7665297fccbb6d7e1471b5be60d4515d9377686 Mon Sep 17 00:00:00 2001
From: Roberto Dip <dip.jesusr@gmail.com>
Date: Tue, 4 Jun 2024 18:19:09 -0300
Subject: [PATCH] fix fleetctl generate mdm-apple-bm (#19507)

for #19506

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
---
 cmd/fleetctl/generate_test.go | 30 ++++++++++++------------------
 server/service/client_mdm.go  | 18 ++++++++----------
 2 files changed, 20 insertions(+), 28 deletions(-)

diff --git a/cmd/fleetctl/generate_test.go b/cmd/fleetctl/generate_test.go
index ea8a036d7e..c500ee5b9b 100644
--- a/cmd/fleetctl/generate_test.go
+++ b/cmd/fleetctl/generate_test.go
@@ -14,12 +14,11 @@ import (
 )
 
 func TestGenerateMDMAppleBM(t *testing.T) {
-	// TODO(roberto): update when the new endpoint to get a CSR is ready
-	t.Skip()
 	outdir, err := os.MkdirTemp("", t.Name())
 	require.NoError(t, err)
 	defer os.Remove(outdir)
 	publicKeyPath := filepath.Join(outdir, "public-key.crt")
+	_, _ = runServerWithMockedDS(t)
 
 	out := runAppForTest(t, []string{
 		"generate", "mdm-apple-bm",
@@ -29,18 +28,20 @@ func TestGenerateMDMAppleBM(t *testing.T) {
 	require.Contains(t, out, fmt.Sprintf("Generated your public key at %s", outdir))
 
 	// validate that the certificate is valid
-	certPEMBlock, err := os.ReadFile(publicKeyPath)
+	certPEM, err := os.ReadFile(publicKeyPath)
 	require.NoError(t, err)
 
-	parsed, err := x509.ParseCertificate(certPEMBlock)
+	block, _ := pem.Decode(certPEM)
+	require.NotNil(t, block)
+	require.Equal(t, "CERTIFICATE", block.Type)
+
+	parsed, err := x509.ParseCertificate(block.Bytes)
 	require.NoError(t, err)
-	require.Equal(t, "FleetDM", parsed.Issuer.CommonName)
+	require.NotNil(t, parsed)
 }
 
 func TestGenerateMDMApple(t *testing.T) {
 	t.Run("CSR API call fails", func(t *testing.T) {
-		// TODO(roberto): update when the new endpoint to get a CSR is ready
-		t.Skip()
 		_, _ = runServerWithMockedDS(t)
 		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			// fail this call
@@ -54,17 +55,15 @@ func TestGenerateMDMApple(t *testing.T) {
 			[]string{
 				"generate", "mdm-apple",
 			},
-			`POST /api/latest/fleet/mdm/apple/request_csr received status 422 Validation Failed: this email address is not valid: bad request`,
+			ErrGeneric.Error(),
 		)
 	})
 
 	t.Run("successful run", func(t *testing.T) {
-		// TODO(roberto): update when the new endpoint to get a CSR is ready
-		t.Skip()
 		_, _ = runServerWithMockedDS(t)
 		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			w.WriteHeader(http.StatusOK)
-			_, _ = w.Write([]byte("ok"))
+			_, _ = w.Write([]byte(`{"csr": "dGVzdAo="}`))
 		}))
 		t.Setenv("TEST_FLEETDM_API_URL", srv.URL)
 		t.Cleanup(srv.Close)
@@ -80,16 +79,11 @@ func TestGenerateMDMApple(t *testing.T) {
 			"--context", "default",
 		})
 
-		require.Contains(t, out, fmt.Sprintf("Generated your SCEP key at %s", csrPath))
+		require.Contains(t, out, fmt.Sprintf("Generated your certificate signing request (CSR) at %s", csrPath))
 
 		// validate that the CSR is valid
 		csrPEM, err := os.ReadFile(csrPath)
 		require.NoError(t, err)
-
-		block, _ := pem.Decode(csrPEM)
-		require.NotNil(t, block)
-		require.Equal(t, "CERTIFICATE REQUEST", block.Type)
-		_, err = x509.ParseCertificateRequest(block.Bytes)
-		require.NoError(t, err)
+		require.Equal(t, "test\n", string(csrPEM))
 	})
 }
diff --git a/server/service/client_mdm.go b/server/service/client_mdm.go
index 22a3cf8a10..07322a4c2b 100644
--- a/server/service/client_mdm.go
+++ b/server/service/client_mdm.go
@@ -43,21 +43,19 @@ func (c *Client) GetAppleBM() (*fleet.AppleBM, error) {
 // RequestAppleCSR requests a signed CSR from the Fleet server and returns the
 // CSR bytes
 func (c *Client) RequestAppleCSR() ([]byte, error) {
-	verb, path := "GET", "/api/v1/fleet/mdm/apple/request_csr"
-	// TODO(roberto): adjust request/response type when the endpoint is ready
-	var request, resp map[string][]byte
-	err := c.authenticatedRequest(request, verb, path, &resp)
-	return resp["csr"], err
+	verb, path := "GET", "/api/latest/fleet/mdm/apple/request_csr"
+	var resp getMDMAppleCSRResponse
+	err := c.authenticatedRequest(nil, verb, path, &resp)
+	return resp.CSR, err
 }
 
 // RequestAppleABM requests a signed CSR from the Fleet server and returns the
 // public key bytes
 func (c *Client) RequestAppleABM() ([]byte, error) {
-	verb, path := "GET", "/api/v1/fleet/mdm/apple/abm_public_key?alt=media"
-	// TODO(roberto): adjust this request type when the endpoint is ready
-	var request, resp map[string][]byte
-	err := c.authenticatedRequest(request, verb, path, &resp)
-	return resp["public_key"], err
+	verb, path := "GET", "/api/latest/fleet/mdm/apple/abm_public_key"
+	var resp generateABMKeyPairResponse
+	err := c.authenticatedRequest(nil, verb, path, &resp)
+	return resp.PublicKey, err
 }
 
 func (c *Client) GetBootstrapPackageMetadata(teamID uint, forUpdate bool) (*fleet.MDMAppleBootstrapPackage, error) {