Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity
26,791 Commits 2 Branches 0 Tags
imgbot
Commit Graph
1054 Commits
Author SHA1 Message Date
kilo-code-bot[bot] e1f972f3a2 Hide generate-gitops command from fleetctl help output (#44254) 2026-06-19 15:45:17 -07:00
Scott Gress 208715e2c8 Update some GitOps error messages for clarity (#47134) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45639 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
A bit hard to replicate these ones, but they're text changes only.



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved error message clarity for macOS setup assistant and bootstrap
package workflows, including more precise identification of the failed
operation (such as verifying or uploading) and better details for
script-reading failures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-19 11:10:58 -05:00
Jonathan Katz ad52492c78 Undo rename from utilities to support (#47881) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually
Tested with fleet maintained apps and VPP in UI and gitops 

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations
N/A since this is just editing the existing migration
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- newly added custom category, or default category, was cleared if was
not in the yaml file
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Corrected the “Productivity” category emoji/name and the “Utilities”
category emoji/name across the system for consistent display and
behavior.
* **Tests**
* Updated unit, integration, and handler tests to expect the corrected
category strings and delete-button labels.
* **Chores**
* Refreshed database seed data and migration/test expectations to align
default and per-team category names, preserving IDs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-19 10:12:10 -04:00
Magnus Jensen 8d26d298e2 fixed update teams not updating appconfig, and team delete not cleaning up appconfig (#47826) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Unreleased bugs while going through test plan

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Apple Business Manager (ABM) token team assignments now stay
synchronized when team defaults change across BYOD, macOS, iOS, and
iPadOS.
* “No team” selections are now saved as cleared (empty) assignments for
cleaner configuration output.
* Improved ABM token cleanup during team deletion to remove references
tied to the deleted team.
* **Tests**
* Added/extended coverage for ABM token team update behavior (including
invalid team handling and nil inputs) and deletion cleanup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-18 18:23:02 +02:00
Steven PalmesanoandJuan Fernandez 435c6e130b Display instructions needed for SSO-enabled accounts with fleetctl (#46768) 
**Related issue:** Resolves #21818

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* The CLI now detects when SSO is enabled on the server and shows a
warning directing users to authenticate with an API token (with guidance
link) instead of email/password.

* **Bug Fixes**
* Authentication error messaging is now SSO-aware, improving guidance
when credential login fails.

* **Tests**
* Added coverage to verify the authentication guidance changes correctly
based on whether SSO is enabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Juan Fernandez <juan@fleetdm.com>
 2026-06-17 18:19:00 -04:00
Magnus Jensen e14f6e67c1 fix gitops relative paths for unassigned and org_settings (#47512) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45661

I couldn't really find another good solution that would solve it all, as
the path resolution is spread out, plus unassigned merging into global
config definitely makes it more complex (root cause of the issue).

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed GitOps relative path resolution so controls and nested
organization settings correctly resolve referenced files from their
source directory, including cases with `unassigned.yml`.
* Corrected macOS setup assistant uploads to use the base filename
instead of the full configured path/URL.
* **Tests**
* Added regression coverage for GitOps relative path handling across
working-directory and nested-file scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 18:32:06 +02:00
Nico fcadb0e6b0 Gate all policy label inclusions/exclusions as premium-only (#47686) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47677 

Updating code so that it matches the docs (all label inclusions and
exclusions for policies should be premium-only):
- https://github.com/fleetdm/fleet/pull/47643
- https://github.com/fleetdm/fleet/pull/46353

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Bug Fixes
* Global and team policy label scoping now consistently enforces premium
licensing for `labels_include_any` and `labels_exclude_any` (in addition
to existing `any/all` restrictions).
* Non-premium requests that include these label filter fields are
rejected earlier with the appropriate license error.
* GitOps policy export/validation now omits or disallows
`labels_include_any`/`labels_exclude_any` on non-premium instances.

## Tests
* Expanded coverage to verify premium gating behavior across global
policy create/modify and spec-based policy application, including GitOps
validation paths.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 10:57:28 -03:00
Magnus Jensen dcf5029da5 BYOF: API & GitOps support (#47506) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45600

I could see the contributor endpoint was not updated, so I just included
it in this PR, and since it's a contributor one I think we are fine
updating ahead of release.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. (Part of previous PR)

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **New Features**
* Added support for Apple Business Manager BYOD team assignments,
including saving/loading BYOD default team selections and exposing BYOD
team details via the API for personal mobile devices.

* **Refactor**
* Updated GitOps key handling for BYOD assignments to use `byod_fleet`,
with migration/aliasing from the older `byod_team` key.

* **Tests**
* Expanded GitOps and ABM token tests/fixtures to cover BYOD team
behavior, including defaults, clearing/reset behavior, and
error/validation scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 13:02:37 +02:00
Allen Houchins ec1d8fb30c Paginate Fleet-maintained apps and filters (#47615) 
Fix the Fleet-maintained apps list being cut off by adding server-side
pagination and applying platform / "hide added apps" filters across the
full library. Introduces MaintainedAppListOptions (with Platform and
AvailableOnly) and changes the ListAvailableFleetMaintainedApps /
ListFleetMaintainedApps signatures. Datastore now paginates and counts
by distinct app name, fetches all platform rows for apps on a page, and
returns a count and pagination metadata; default client page size set to
500. Frontend no longer performs client-side filtering or local
status/platform state; it relies on the API and uses data.count for
totals. Docs, tests, mocks, and various call sites updated (including a
new test that verifies pagination, platform and availability filters).

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fleet-maintained apps listing now paginates server-side (100 per page)
so entries near the end of the alphabet are reachable.
* Platform and “Hide added apps” filters are applied across the entire
library, not just the currently loaded subset.
* The displayed count now matches results by counting macOS and Windows
versions separately.

* **New Features**
* Listing now supports URL-driven platform and “available” filtering,
and the UI consistently reflects the active filter state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 15:58:24 -05:00
Nico 12d2aba40c Fix macOS "Update new hosts to latest" staying enabled in GitOps after clearing version/deadline (#45984) (#47602) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45984 

Fix is applied on the GitOps side since that's what I figured the
customer was using on the [Slack
thread](https://fleetdm.slack.com/archives/C061ZA91Y1J/p1779372669701129).

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

#### Before

Reproduced on `main`:
- Set `update_new_hosts: true` beforehand.
- Ran `gitops` with `update_new_hosts` commented out. It was still kept
as `true`.



https://github.com/user-attachments/assets/f6b41f0d-38e6-468f-a605-b3e66b7b2dbc

#### After

Running `gitops` with `update_new_hosts` commented out switched its
value to `false`.



https://github.com/user-attachments/assets/24756063-b3a9-400b-a2cc-208dd816a556



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Corrected GitOps behavior for the macOS “Update new hosts to latest”
setting so it no longer stays enabled after clearing `minimum_version`
and `deadline`; it now defaults to disabled unless both are set.

* **Tests**
* Added GitOps test coverage to verify the defaulting outcomes across
YAML variations for the macOS update settings, including explicit and
empty field combinations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 10:21:20 -03:00
Nico 5e27628266 GitOps: combined include/exclude policy label targeting + labels_exclude_all (#33441) (#47505) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46584 

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
(Already added in main.)

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

`generate-gitops`:



https://github.com/user-attachments/assets/d32e89c3-2ce7-4c57-9492-66deb0a3dfe8



`gitops`:



https://github.com/user-attachments/assets/ac0e3935-bc8d-4541-b3e5-f992109630d9




<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added `labels_exclude_all` field support for refining policy label
scopes (available with Fleet Premium license).

* **Bug Fixes**
* Enhanced validation of policy label scope configurations to prevent
invalid field combinations and enforce license requirements.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-15 08:55:05 -03:00
Nico 32e534215c Policies: combine include/exclude label targeting + add labels_exclude_all (#33441) (#47444) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46582

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
(Already added as part of the frontend PRs which have been merged to
main.)

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually



https://github.com/user-attachments/assets/696b8e41-6653-4be8-aae0-cf45dfa7a9b6



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Support for labels_exclude_all in policy targeting to exclude hosts
matching all specified labels.
* Allow combining include and exclude label scopes (e.g., include_any
with exclude_any or exclude_all).

* **Improvements**
* Distinct include vs. exclude conflict errors and explicit overlap
reporting.
  * Premium gating extended to include/exclude_all.
* Centralized label-overlap detection for consistent validation and
improved policy membership/exclusion behavior.

* **Tests**
* Expanded tests covering exclude_all semantics and label-scope
validation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-12 15:05:20 -03:00
Jonathan Katz 89b2a5e470 Change self-service categories GitOps to not require dedicated key (#47439) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
    - Not needed

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Batch software installer and app-association endpoints now return the
list of referenced self-service categories.
* Category fields support an “omit when unset” JSON behavior so omitted
vs empty categories are distinguishable.

* **Bug Fixes**
* Improved category validation (trim + case-insensitive dedupe) and
GitOps reconciliation to remove unused categories.

* **Chores**
* GitOps schema simplified: no separate top-level
self_service_categories; categories are defined inline with packages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-11 16:19:11 -04:00
Scott GressandLucas Manuel Rodriguez ffbbb9e866 Validate SSO settings correctly for GitOps (#46487) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43371 

# Details

* Ensures that if `enable_sso: true` is set in a global config, then all
required sso keys (`entity_id`, `idp_name` and one of
`metadata`/`metadata_url`) are provided
* Ensures that if `end_user_authentication: true` is set on a fleet,
then all required sso keys (`entity_id`, `idp_name` and one of
`metadata`/`metadata_url`) are provided, _even if the fleet's config
file is not provided in the gitops run_.
* Ensures that if `end_user_authentication: true` is set in a fleet
config in a gitops run, then all required sso keys (`entity_id`,
`idp_name` and one of `metadata`/`metadata_url`) are provided, _even if
the global config file is not provided in the gitops run_.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
  ### Org SSO — gitops client validation (`fleetctl gitops`)
- [x] `enable_sso: true` with **empty `metadata` and `metadata_url`** →
fails (metadata-or-url)
  - [x] `enable_sso: true` with **empty `idp_name`** → fails (idp_name)
- [x] `enable_sso: true` with **empty `entity_id`** → fails (entity_id)
- [x] Multiple fields missing at once → **one error line per missing
field**
  - [x] `enable_sso: true` + complete IdP (`metadata_url`) → succeeds
- [x] `enable_sso: true` + complete IdP using inline `metadata` (no url)
→ succeeds
  - [x] `enable_sso: false` + empty IdP fields → succeeds
- [x] `sso_settings` key **omitted entirely** → succeeds, and apply
**clears** stored SSO
- [x] The literal `generate-gitops` output (`metadata: # TODO: ...`)
applied as-is → **rejected**

  ### MDM EUA — gitops group cross-file validation
- [x] Team file enables EUA **+** global file **omits** the EUA IdP
block → fails
- [x] **#43371 core repro:** stored team EUA on, file NOT in run,
global-only run blanks metadata → fails, names the team
- [x] Same but the team's file **is** in the run with EUA `false` →
succeeds
  - [x] EUA disabled everywhere + **empty** stored IdP → succeeds

  ### `--delete-other-fleets`
- [x] Run with `--delete-other-fleets` degrading the IdP while a stored
not-in-run team has EUA on → succeeds
  - [x] Confirm the omitted team is actually deleted on apply
- [x] Known corner: `--delete-other-fleets` + omitted ABM/VPP team with
EUA on + degraded IdP → fails at apply time

  ### Server-side backstop (REST API)
- [x] `PATCH /config` (overwrite=false), `enable_sso:true`, metadata
omitted, existing has metadata → **200**, metadata preserved
- [x] `PATCH /config?overwrite=true`, `enable_sso:true` + empty
metadata/url → **422** field `metadata`
- [x] `?overwrite=true`, metadata_url set, empty `entity_id`/`idp_name`
→ **422** both `required`
- [x] `?overwrite=true`, `enable_sso:false` → **200** (no IdP required
when disabled); `sso_settings` omitted entirely → clears (covered by
gitops POS-2)

  ### Server-side EUA (`euaStrict` keyed on incoming global flag only)
- [x] `?overwrite=true` + incoming **global** EUA enabled + incomplete
IdP → **422** `entity_id`/`idp_name`
- [x] `?overwrite=true` + global EUA **off** + stored team EUA + payload
degrades IdP → **succeeds** (via gitops #43371-OVERRIDE)
- [x] `?overwrite=true` + global EUA off + payload **fully clears** IdP
while a team has EUA → **422** `end_user_authentication` (IsEmpty guard)

  ### Regression / false-positive guards
- [x] Multi-file gitops `--dry-run` configuring IdP AND enabling team
EUA (empty stored IdP) → dry-run passes (EE dry-run skip)
- [x] A previously-working gitops run with a complete SSO/EUA config →
still applies cleanly

  ### End state verification
  - [x] After any **rejected** run, stored SSO/EUA config **unchanged**
- [ ] After a valid complete-IdP run, SSO login + ADE/EUA enrollment
works end-to-end (live device)



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* GitOps now validates SSO and MDM end-user authentication (EUA) configs
before applying changes, rejecting incomplete settings when SSO/EUA are
enabled globally or for any team. Overwrite (GitOps) mode enforces
stricter validation than standard updates; dry-run behavior adjusted to
avoid spurious EUA rejections.

* **Tests**
* Added comprehensive tests covering SSO/EUA validation, overwrite vs
patch semantics, cross-file EUA scenarios, and delete-other-fleets
behavior.

* **Refactor**
* Reorganized validation and config-parsing helpers for reuse in GitOps
checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-06-09 11:38:48 -05:00
Jonathan Katz b7adf2751d Add detailed error for generate-gitops when a patch policy installer is missing an FMA (#47136) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43770
Just updates the error message to make it say what's wrong and what can
be done about it. We still abort the entire export because it would be
wrong to create a patch policy not associated to an FMA.


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


New error message:
```
$ fleetctl generate-gitops --dir ./my-gitops --fleet Example-Fleet
Generating GitOps configuration files...
Error generating policies for fleet Example-Fleet: The patch policy "macOS - Zen Browser up to date" references a software installer that is no longer a Fleet-maintained app. Please delete the policy manually.
Error: Something's gone wrong. Please try again. If this keeps happening please file an issue:
https://github.com/fleetdm/fleet/issues/new/choose
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Enhanced error handling in the `generate-gitops` command to provide
clearer messaging when a patch policy references a Fleet-maintained
application that has been removed from the catalog. The command will now
abort with explicit guidance, instructing users to manually remove the
orphaned policy.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 17:49:02 -04:00
Steven Palmesano 20c0963331 Fix GitOps when using All fleets in VPP settings (#46855) 
**Related issue:** Resolves #46824

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed an issue where volume purchasing program assignments failed when
"All fleets" was selected; validation and token assignment now treat the
"All fleets" label consistently, preventing errors during configuration
application.
* **Tests**
* Added an end-to-end GitOps test case verifying "All fleets" is
supported for volume purchasing program entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 13:27:57 -05:00
Jonathan Katz e34126ab3a Merge branch 'main' of github.com:fleetdm/fleet into feat/39018-self-service-categories 
Bump migration, fix failing test and nilaway check
 2026-06-08 12:12:33 -04:00
Magnus Jensen 07129edc66 Clean up Apple reconciler queries, no longer used (#46712) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Final part of Optimize apple reconciler queries.

It does include a slight logic change, when cleaning up for the setup
experience status and release DEP worker, checking for pending profiles.

🤑🤑🤑
<img width="106" height="35" alt="image"
src="https://github.com/user-attachments/assets/68498b1c-31cb-494c-9643-ed5da2602615"
/>


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. Added in another PR.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Move Apple MDM profile and declaration reconciliation to
batched/scheduled processing.
* Stop immediate bulk-updating of pending host profiles after
creating/editing profiles or declarations; Android remains synchronous
while Apple/Windows are deferred.

* **New Features**
* Added targeted per-host pending-profile detection for Apple devices to
improve reconcile accuracy.

* **Tests**
* Reworked and expanded Apple MDM reconciliation tests; removed
legacy/obsolete batch tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-05 11:43:16 +02:00
Scott Gress 07df7c5cfd Track software deletions in GitOps (#46764) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43729

# Details

Adds output to GitOps runs indicating which custom/FMA software packages
would be deleted. This involves adding a `deleted_packages` key to the
`/software/batch/:request_uuid` ("Get status of software batch-apply
request") API, which will be documented separately.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] verified that a GitOps dry run produces one "would've deleted"
line per custom package / fma that would be deleted
- [X] verified that a GitOps real run produces one "deleted" line per
custom package / fma that was deleted
  - [X] verified that adding software is unaffected



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* GitOps batch software operations now report packages pending deletion:
dry-runs show "would've deleted" warnings and real runs show deletions;
apply flows surface per-package deletion messages.
* Empty payload dry-run now still reports pending deletions when
applicable.

* **Tests**
* Added integration and datastore tests validating deletion-warning
output, pending-deletion detection, and related result handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-04 13:11:49 -05:00
Scott Gress 10f65595f8 Update error message for GitOps exceptions violations (#46700) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45306 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<img width="1470" height="19" alt="image"
src="https://github.com/user-attachments/assets/726b1efe-176f-4460-a140-a1f571990010"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Bug Fixes**
* Enhanced GitOps exception enforcement error messages for labels,
secrets, and software to include a direct link to the Fleet settings
page where exceptions can be disabled. Users now receive actionable
guidance when enforcement is triggered, improving troubleshooting
efficiency and reducing time spent resolving configuration issues.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-04 09:50:04 -05:00
Scott Gress 9cf20fbab3 Fix preview config (#46677) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46560 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- updated preview test. This won't run in CI right now b/c we didn't
update fleetctl, but I ran it successfully locally
- [X] QA'd all new/changed functionality manually
- [x] on main, did `fleetctl preview` with the 4.86.0 tag and verified
that charts were disabled
  - [x] on this branch, did the same and verified charts were enabled 



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Dashboard chart data collection (Hosts online and Vulnerability
exposure) is no longer disabled when starting preview mode.

* **Chores**
* Software inventory config moved to the current features flag so
historical chart data is preserved.

* **Tests**
* Added regression checks to ensure uptime, vulnerabilities, and
host-users historical data remain enabled in preview.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-04 09:49:47 -05:00
Konstantin Sykulev e8bd1d525a Android provision certificates before dependent profiles (#46759) 
**Related issue:** Resolves #45022

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Prevented intermittent Android profile failures during host/team
transfers by ensuring pending Android certificates are created for
transferred devices before dependent profiles are applied. Profiles now
apply reliably, including when devices are moved off a team.
* **Tests**
* Added and updated tests to cover Android certificate provisioning
during host transfers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-03 20:46:08 -05:00
Jonathan Katz a3338d032e Self service categories - GitOps support (#46671) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46392 
A few things in this PR:
- updated the conversion from old default category to the new ones with
the emoji included that was introduced in the feature branch. It takes
into account what exists in the database now so if an admin wants to add
for example "Productivity" without the emoji as a category it won't get
overwritten.
- updated a few places to ignore missing categories rather than error
(what we do for adding a single FMA currently)
- updated permissions for "gitops" users 
- added everything needed for gitops, generate-gitops support using the
existing endpoints from the last PR.

Didn't add logs like "[+] applied X self service categories" since it
wasn't mentioned in the docs, but wouldn't be too hard to add.


# Checklist for submitter


## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## New Fleet configuration settings

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
    - Currently missing, at least on this branch
 2026-06-03 15:23:44 -04:00
Jordan Montgomery 356caea6fd 42508 Rename abm to ab in API (#46657) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #42508 

Renames abm/apple_business_manager to ab/apple_business in API and
fleetctl. Uses existing renameto logic with a slight twist: added
"inline" option to handle cases particularly where a single object tree
has renames in multiple versions so that we don't break backwards
compatibiility since the default behavior when you have multi-level
renames is a new/old split at the top level

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Canonical Apple Business (AB) API endpoints and CLI:
/api/v1/fleet/ab_tokens, /api/v1/fleet/mdm/apple/ab_public_key, plus new
fleetctl get mdm-ab and fleetctl generate mdm-ab
  * New GitOps/config key: mdm.apple_business
* Admin UI updated to show Apple Business tokens with fleet-based
associations and updated labels

* **Deprecations**
* Legacy ABM endpoints, CLI aliases, and config keys remain supported
but emit deprecation warnings pointing to the new AB equivalents
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-03 14:58:17 -04:00
Andrew Mellor d7d9a96aa3 Add combined include/exclude label targeting for MDM profiles (API and GitOps) (#46437) 
**Related issue:** Resolves #45180

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [x] Confirmed that the fix is not expected to adversely impact load
test results


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* MDM profiles can combine label inclusion (include-all/include-any)
with exclusion (exclude-any) so you can target hosts by labels while
excluding specific labeled hosts.
* Profile validation now enforces a single include-mode and explicitly
rejects any label used in both include and exclude lists.

* **Bug Fixes**
* Deleting a label that’s referenced by an MDM configuration profile or
declaration is blocked and returns an error to prevent broken targeting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-03 15:24:33 +01:00
Scott Gress 2bd7fec8a7 Handle edge case of adding new fleet + vpp at the same time (#46533) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44444 

# Details

This PR fixes the following edge case when running `fleetctl gitops`:

1. A new fleet is added
2. That fleet is declared as an ABM default fleet and/or a fleet in a
VPP token location
3. The _other_ fleets declared as ABM defaults or VPP fleets are _not_
all provided in the GitOps run

In that case, the GitOps run would fail with an error that one of the
previously-existing fleets could not be found. This PR fixes the bug by
making sure that GitOps looks at both the currently-persisted fleets
(via the API) and any fleets that are being created in the current run.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- Reproduced the issue on `main` by attempting to create a new fleet
_and_ add it both as an ABM default fleet and to the set of VPP token
users in a single run, and getting an error about one of the existing
fleets not being found
- Verified that I was able to complete a gitops run successfully on this
branch with a new fleet as a VPP token user and a default ABM fleet



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Bug Fixes**
* Improved validation for Apple Business Manager and Volume Purchasing
Program token team assignments with clearer error messages when
referenced teams aren't found in Fleet.
* Enhanced team name matching to properly handle Unicode characters,
ensuring consistent team identification across GitOps configurations.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-02 14:47:54 -05:00
Magnus Jensen a4d1cfab1f CSUD: Add validation for OS Update profiles and OS updates being configured (#46545) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45282

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Deploy custom OS update configuration profiles for Apple
(macOS/iOS/iPadOS) and Windows; tracks and enforces one custom OS‑update
profile per scope.

* **Improvements**
* Prevent changing OS update settings when a custom profile exists;
returns guidance to remove the custom profile first.
* Batch upload now detects OS‑update payloads and enforces license
requirements.
  * UI error handling surfaces API-specific messages.
* FileVault control separated from OS updates and gated behind a
configurable flag/license.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-02 17:28:58 +02:00
Victor Lyuboslavsky 1072c852e8 Added support for validating Microsoft Entra v2 access tokens (#46416) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46388 

Video demo: https://www.youtube.com/watch?v=t3yuGh0kwP8
Docs PR: https://github.com/fleetdm/fleet/pull/46483

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.

## New Fleet configuration settings

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* UI to add/remove Entra application (client) IDs for Windows automatic
enrollment; add/delete modals and list management.

* **Enhancements**
  * Activity feed entries for added/removed Entra client IDs.
* Entra client ID allowlist surfaced in GitOps and persisted config;
client IDs normalized (trim/lowercase) and de-duplicated.

* **Documentation**
* Note: from July 1, 2026 new on‑prem Windows MDM apps receive Entra v2
tokens with aud = client ID; v1 tokens remain supported.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-01 17:58:51 -05:00
Jonathan Katz abd38218fa Self service categories endpoints + activities (#46593) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46391 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually
 2026-06-01 15:53:06 -04:00
Lucas Manuel Rodriguez 9032883b47 Fix fleetctl get fleets to use source of truth (DB) for software (#46480) 
Resolves #44970 (1/2).

---

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* `fleetctl get fleets` / `get teams` now display software and setup
experience from authoritative software endpoints.
* Preserve literal setup_experience fields (avoid erroneous macos_setup
renames) when applying and when transmitting JSON for software entries.
* **Tests**
* Added regression tests and test helpers to ensure
software/setup_experience are sourced correctly and to prevent nil
panics in related tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-01 11:41:34 -03:00
Steven PalmesanoandScott Gress 64f601891e Fix fleetctl apply ignoring spec.fleet (#44894) 
**Related issue:** Resolves #44892

Claude also added tests, since this wasn't covered before, but I've kept
them in a separate commit in case they're not needed.

# Checklist for submitter

## Testing

- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved spec parsing to correctly accept resources declared as either
team or fleet, handling nested spec keys consistently and preserving
backward-compatible behavior.

* **Tests**
* Added and updated tests and fixtures to validate parsing across both
team/fleet variants and to assert specific conflict/reporting behavior
when both keys are present.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44894?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Scott Gress <scott@fleetdm.com>
 2026-05-29 11:23:19 -05:00
Lucas Manuel Rodriguez 5b2427d187 Add backend changes for continuous automations on policies (#45999) 
Resolves #45149 and #45150.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## Database migrations

- [X] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [X] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [X] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [X] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added team policy setting continuous_automations_enabled (default:
false) to re-run software/script automations on every failing
evaluation; exposed in APIs and GitOps YAML. Disallowed for "All fleets"
and requires a premium license.

* **Tests**
* Added integration tests for CRUD, GitOps, and re-queuing behavior
validating continuous automations.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45999?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-26 21:11:18 -03:00
Victor Lyuboslavsky e790260b85 Android commands backend (#46031) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41683 

Support for Android lock, wipe, and clear passcode commands. Behavior is
slightly different between BYOD and CODO. The fleetdm.com proxy isn't
wired up, so they only work with direct Google connection.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Clear-passcode CLI plus Android Lock and Wipe commands (Wipe
restricted to company-owned devices).
* BYO unenroll now removes only the work profile, preserving personal
data.
* Commands issued with a 10-year duration; UI/CLI show Android-specific
messaging and command IDs.

* **Improvements**
* Host MDM pages reflect command lifecycle transitions (pending →
acknowledged or error with code/message) via Pub/Sub updates.

* **Documentation**
* Updated docs for Android MDM commands, ownership rules, and command
duration.

* **Tests**
  * New unit and integration tests for Android MDM flows.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46031?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-26 12:16:03 -05:00
Jonathan Katz 5d59b0e627 Skip VPP label validation in dry runs (#46106) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45844
Skips label validation against the database in dry runs, because if new
ones are being applied in the same run then they wouldnt be in the db
ahead of time.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.


## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually
- Added a new label and vpp reference to it, both dry run and real run
worked.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

**Bug Fixes**
* GitOps dry runs no longer fail when a VPP app references a label that
is introduced within the same run.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46106?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-25 12:04:06 -04:00
Steven Palmesano 4676042542 Update note about no-teams -> unassigned (#45486) 
On my Fleet instance, "No team" was automatically named "Unassigned" in
the UI. If this isn't the case for a user, they need to rename the fleet
in the UI first, before changing the name in git.

Reference:
https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#:~:text=When%20renaming%20a,g.%20software%20packages

> When renaming a fleet, first update the name in the UI, then update
your YAML.

# Checklist for submitter

## Testing

- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated deprecation warning message for legacy configuration files to
provide clearer migration instructions, guiding users to update fleet
names and rename files to align with new naming conventions.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45486)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-25 14:38:05 +02:00
Noah Talerman f6db618aa7 GitOps: "teams" mentioned in error messages (#45878) 2026-05-20 10:26:26 -05:00
Robert FairburnLucas Manuel RodriguezCopilot Autofix powered by AI
 		3e10ad717c Add optional SES sender domain configuration (#43811) 
**Related issue:** Resolves #42288

# Summary

This PR adds support for configuring an optional SES sender domain.

When the SES email backend is enabled, Fleet can now use a configured
sender domain for the `From` address instead of always deriving the
domain from `server.server_url`. If the setting is not provided, Fleet
keeps the existing behavior.

# Impact

This gives self-hosted operators a server-side SES configuration option
for email sending without changing UI-managed SMTP settings.

# Root cause

The SES sender path only generated `do-not-reply@<server host>` from the
Fleet server URL, so there was no way to override the sender domain
through server configuration.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Added/updated automated tests
- [x] Setting(s) is/are explicitly excluded from GitOps

## Testing

- [x] `go test -tags full,fts5,netgo ./server/mail -run
'Test_(getFromSES|sesSender_SendEmail)$'`
- [x] `go test -tags full,fts5,netgo ./server/config -run
'TestConfig(SESSenderDomain|Roundtrip)$'`
- [x] `go test -tags full,fts5,netgo ./server/service -run
'TestService_EmailConfig$'`
- [ ] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added optional SES sender domain configuration. Users can specify a
custom domain for the email "From" address via config or environment
variable; when unset it falls back to the server hostname.

* **Tests**
* Added and expanded tests to verify sender-domain precedence,
From-header generation, and related error cases.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/43811?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-05-19 11:21:46 -05:00
Lucas Manuel Rodriguez 18671eba94 Move HostDetailResponse type to server/fleet/ (#45718) 
Resolves #45220 (one of several PRs).

## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Consolidated and standardized host detail response handling across
server and CLI, aligning host/device and MDM flows for more consistent
behavior.

* **Tests**
* Updated integration tests to reflect the standardized host detail
response format.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45718?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-18 14:06:38 -03:00
Lucas Manuel Rodriguez fa0b8de739 Fix post-merge after refactor of test utilities (#45616) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
  * Updated internal testing infrastructure for GitOps mode validation.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45616)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 14:11:18 -03:00
Lucas Manuel Rodriguez 1f496781a2 Rename and move testing_utils.go from schedule and orbit tests (#45609) 
Resolves #45220 (one of many small PRs, we are close)

## Testing

- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Refactored test infrastructure for scheduling components to use
centralized test utilities.

---

**Note:** This release contains no user-facing changes. All
modifications are internal testing and code organization improvements.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45609)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 13:23:58 -03:00
Scott Gress c77d1b4ff4 allow gitops mode to be set in yaml (#45537) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45330

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
so many
- [X] QA'd all new/changed functionality manually
  - [X] was able to set gitops mode to enabled via `fleetctl gitops`
- [X] attempting to set gitops mode w/out repository_url in `fleetctl
gitops` failed w/ helpful error
- [X] attempting to set gitops mode w/ invalid repository_url in
`fleetctl gitops` failed w/ helpful error
- [X] attempting to set gitops exceptions in `fleetctl gitops` failed w/
helpful error
  - [X] was able to unset gitops mode via `fleetctl gitops`
- [X] leaving `gitops:` blank in `fleetctl gitops` left the mode
untouched (it would retain its previous value)

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
it is not, but it's not a requirement here and leaving it out is a no-op
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
it is not, nor should it be, as that would clear gitops mode on every
customer currently using it
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
n/a, you still need to be able to do gitops mode in the UI


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * GitOps mode and repository URL can now be set via GitOps YAML.

* **Bug Fixes**
* Server preserves existing GitOps settings during config updates;
requires repository URL when enabling and rejects unsupported exceptions
in GitOps YAML.

* **Tests**
* Added tests covering apply behavior, YAML validation, activity
emission on mode changes, and license-restricted rejection on free tier.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45537)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 11:21:10 -05:00
Lucas Manuel Rodriguez e447a685f0 Rename fleetctl's testing_utils.go to testing_utils_test.go and create separate test package (#45585) 
Resolves #45220 (one of several PRs, we are very close)

## Testing

- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Tests**
* Improved test infrastructure for the CLI: consolidated and renamed
test helpers, added a dedicated in-process CLI test helper, and updated
many test cases to use the new helpers.
* Tightened several test assertions and standardized output/error
validation across unit and integration tests to improve reliability.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45585)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 11:59:18 -03:00
Scott Gress 313df2c45a Fix checkout action version in fleetctl new template (#45502) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves
https://github.com/fleetdm/confidential/issues/15917

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [ ] Added/updated automated tests
- I didn't see any tests that checked the contents of the templates
directly; will update if anything fails.
- [X] QA'd all new/changed functionality manually
- Tested on my test gitops repo:
https://github.com/sgress454/fleet-gitops-test/actions/runs/25875796027/job/76042556514


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Resolved Node-related warnings that appeared when using the Fleet
"new" project and GitOps workflow templates, improving clarity during
template execution and initial project setup.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45502)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 16:38:04 -05:00
Victor Lyuboslavsky c2de7315cd fleetctl get mdm-commands now requires the --host flag (#45476) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44422 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* The CLI command to list MDM commands now requires a --host flag;
calling it without a host will error.
* The API endpoint for listing commands now requires a host_identifier
parameter; requests without it are deprecated.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45476)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 12:58:52 -05:00
Lucas Manuel Rodriguez 057e1615b4 Move mysql/testing_utils.go to a separate mysql/mysqltest package (#45406) 
Resolves #45220 (one of several PRs to achieve removing "testing"
package as dependency in production binary)

## Testing

- [x] QA'd all new/changed functionality manually.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Tests**
* Switched many tests to use a dedicated MySQL test helper package and
consolidated test-only utilities for datastore setup, cleanup, ad‑hoc
SQL, certificate generation, and activity/aggregation helpers.
* Added expanded test utilities for replication, DB connections and test
data seeding to improve integration-test reliability.

* **Chores**
  * No production behavior or user-facing APIs were changed.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45406)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 11:18:20 -03:00
Sharon Katz 47773c58ad Fix enable_host_users defaulting to false on fresh install (#45393) 
Closes #44630

## Summary

- After a fresh Fleet install (`fleet prepare db` + `fleetctl setup`),
`enable_host_users` persisted as `false` despite the documented and
coded default being `true`.
- **Root cause**: During setup, `NewAppConfig` correctly saves
`enable_host_users: true`. However, the starter library then runs
`fleetctl gitops` with a template that has no `features` section. In
`DoGitOps`, when `features` is absent, an empty features map is created.
`enable_software_inventory` was explicitly defaulted to `true`, but
`enable_host_users` was not. The overwrite-mode PATCH then reset
`enable_host_users` to `false` (Go's bool zero value).
- Adds the same defaulting logic for `enable_host_users` as exists for
`enable_software_inventory`, in both the global and team config paths in
`DoGitOps`.

## Test plan

Reproduced locally before and after the fix with a Fleet server +
osqueryd agent (osquery 5.23.0):

**Before fix:**
1. Created a fresh database, ran `fleet prepare db`, started `fleet
serve --dev`, ran `fleetctl setup`.
2. Checked DB: `enable_host_users` was `false` (bug).
3. Enrolled a local osqueryd agent against the server.
4. Queried the host details API: `users` field was `null` (user
collection disabled).
5. Confirmed `features.enable_host_users: false` via `GET
/api/latest/fleet/config`.

**After fix:**
1. Same steps with the fixed binary.
2. Checked DB: `enable_host_users` was `true` (correct).
3. Enrolled a local osqueryd agent against the server.
4. Queried the host details API: `users` field contained 3 collected
users (root, sharonkatz, testuser) -- user collection working.
5. Confirmed `features.enable_host_users: true` via `GET
/api/latest/fleet/config`.

**Unit tests:**
- [x] `TestGitOpsFeatures` -- updated assertion to expect
`enable_host_users: true` when features are omitted from GitOps YAML
(was previously testing the broken behavior).
- [x] All `TestGitOps*` tests pass (`go test ./cmd/fleetctl/fleetctl/
-run TestGitOps`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Bug Fixes
* Fixed default host user collection behavior on fresh Fleet installs.
Host user collection now correctly defaults to enabled, matching
documented settings and ensuring the host details page displays accurate
collection status information instead of incorrectly showing it as
disabled.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45393)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 09:05:45 -04:00
Scott Gress 049f29ee3f Apply labels before consumers in GitOps (#45194) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44046 

# Details

Updates GitOps to ensure that team labels are created before any
consumers (e.g. profiles, policies, software) that might use the labels
are applied. It does this by adding a new `afterTeamApply` callback
option to `ApplyGroup` that is called after team config is applied --
this is when team labels are now created, instead of after `ApplyGroup`
runs.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually




<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed GitOps deployments failing when a label and a profile that
references it are created in the same run.
* Ensures the correct apply ordering so dry-run/log output shows label
application before profile application.

* **Tests**
* Added a regression test validating label → profile apply ordering to
prevent future regressions.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45194)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-12 17:15:33 -05:00
Jonathan Katz fd7bf3118b Fix TestGitOpsTeamVPPAppleConfiguration failing (#45305) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Updated test fixtures for Apple VPP configuration in GitOps workflows
to better reflect real-world scenarios.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45305)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-12 18:11:57 -04:00
Lucas Manuel Rodriguez 393007ede1 First move of server/service to server/service/svctest to prevent testing code in Fleet's production binary (#45221) 
**Related issue:** Resolves #45220 (one of many small PRs)

## Testing

- [x] QA'd all new/changed functionality manually. (Ran basic smoke
testing.)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Tests**
* Added a consolidated test utilities package to boot full test servers,
seed users, retrieve auth tokens, and provide common mocks for
integration/service tests.
* Updated integration and service tests to use the new helpers for more
consistent, reliable test setup and wiring.

* **Chores**
* Centralized and reorganized test configuration types and options, and
standardized test wiring for clearer, maintainable test setup.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45221)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-12 17:43:37 -03:00
Carloandjkatz01 55636b3ef6 iOS/iPadOS managed config: GitOps (#43969) (#44933) 
Part of #38790. Stacked on top of #44932.

Closes #43969.

`fleetctl gitops` reads `configuration.path` for iOS / iPadOS VPP apps
and in-house `.ipa` apps, validates the file via
`fleet.ValidateAppleAppConfiguration`, and stores the bytes through the
service layer.

`fleetctl generate-gitops` emits `configuration.path` for apps that have
a stored configuration, writing the XML to
`lib/<team>/software/<app-slug>-config.xml`. Apps without configuration
omit the block entirely.

Round-trip integration tests
(`cmd/fleetctl/integrationtest/gitops/software_test.go`) cover apply +
generate for both VPP and in-house, plus a negative case for invalid
configuration content.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **New Features**
* Added managed app configuration support for enterprise software
deployments through GitOps
* Configurations now support platform-specific formats: XML for
iOS/iPadOS, JSON for Android
* Configuration validation ensures compatibility and prevents invalid
variable references

* **Tests**
* Added integration tests for configuration handling in software
deployment workflows

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44933)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
 2026-05-12 14:15:25 -04:00