Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 15 Packages Projects Releases Wiki Activity
25,251 Commits 2 Branches 0 Tags
89b2a5e4701037f441fd8d005a41fe63f463531d
Commit Graph
1674 Commits
Author SHA1 Message Date
Jonathan Katz 89b2a5e470 Change self-service categories GitOps to not require dedicated key (#47439) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
    - Not needed

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Batch software installer and app-association endpoints now return the
list of referenced self-service categories.
* Category fields support an “omit when unset” JSON behavior so omitted
vs empty categories are distinguishable.

* **Bug Fixes**
* Improved category validation (trim + case-insensitive dedupe) and
GitOps reconciliation to remove unused categories.

* **Chores**
* GitOps schema simplified: no separate top-level
self_service_categories; categories are defined inline with packages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-11 16:19:11 -04:00
Allen Houchins 289938438c Add Logi Tune as a macOS FMA (#47399) 
Add support for Logi Tune: include a Homebrew input manifest and
install/uninstall scripts, add a transformer to override the installer
URL to Logitech's enterprise PKG (and set SHA256 to "no_check"), and
register the app in outputs. Also add darwin output refs with version,
installer URL and embedded script refs, update apps.json to list Logi
Tune, and add a frontend icon component + PNG asset and icon map entry.
The PKG override is used because the Homebrew DMG contains a GUI-only
installer without a silent mode; version is still sourced from Homebrew.



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **New Features**
* Added Logi Tune application support on macOS, including installation,
removal, and visual identification in the software catalog.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-11 10:49:26 -05:00
Scott GressandLucas Manuel Rodriguez ffbbb9e866 Validate SSO settings correctly for GitOps (#46487) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43371 

# Details

* Ensures that if `enable_sso: true` is set in a global config, then all
required sso keys (`entity_id`, `idp_name` and one of
`metadata`/`metadata_url`) are provided
* Ensures that if `end_user_authentication: true` is set on a fleet,
then all required sso keys (`entity_id`, `idp_name` and one of
`metadata`/`metadata_url`) are provided, _even if the fleet's config
file is not provided in the gitops run_.
* Ensures that if `end_user_authentication: true` is set in a fleet
config in a gitops run, then all required sso keys (`entity_id`,
`idp_name` and one of `metadata`/`metadata_url`) are provided, _even if
the global config file is not provided in the gitops run_.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
  ### Org SSO — gitops client validation (`fleetctl gitops`)
- [x] `enable_sso: true` with **empty `metadata` and `metadata_url`** →
fails (metadata-or-url)
  - [x] `enable_sso: true` with **empty `idp_name`** → fails (idp_name)
- [x] `enable_sso: true` with **empty `entity_id`** → fails (entity_id)
- [x] Multiple fields missing at once → **one error line per missing
field**
  - [x] `enable_sso: true` + complete IdP (`metadata_url`) → succeeds
- [x] `enable_sso: true` + complete IdP using inline `metadata` (no url)
→ succeeds
  - [x] `enable_sso: false` + empty IdP fields → succeeds
- [x] `sso_settings` key **omitted entirely** → succeeds, and apply
**clears** stored SSO
- [x] The literal `generate-gitops` output (`metadata: # TODO: ...`)
applied as-is → **rejected**

  ### MDM EUA — gitops group cross-file validation
- [x] Team file enables EUA **+** global file **omits** the EUA IdP
block → fails
- [x] **#43371 core repro:** stored team EUA on, file NOT in run,
global-only run blanks metadata → fails, names the team
- [x] Same but the team's file **is** in the run with EUA `false` →
succeeds
  - [x] EUA disabled everywhere + **empty** stored IdP → succeeds

  ### `--delete-other-fleets`
- [x] Run with `--delete-other-fleets` degrading the IdP while a stored
not-in-run team has EUA on → succeeds
  - [x] Confirm the omitted team is actually deleted on apply
- [x] Known corner: `--delete-other-fleets` + omitted ABM/VPP team with
EUA on + degraded IdP → fails at apply time

  ### Server-side backstop (REST API)
- [x] `PATCH /config` (overwrite=false), `enable_sso:true`, metadata
omitted, existing has metadata → **200**, metadata preserved
- [x] `PATCH /config?overwrite=true`, `enable_sso:true` + empty
metadata/url → **422** field `metadata`
- [x] `?overwrite=true`, metadata_url set, empty `entity_id`/`idp_name`
→ **422** both `required`
- [x] `?overwrite=true`, `enable_sso:false` → **200** (no IdP required
when disabled); `sso_settings` omitted entirely → clears (covered by
gitops POS-2)

  ### Server-side EUA (`euaStrict` keyed on incoming global flag only)
- [x] `?overwrite=true` + incoming **global** EUA enabled + incomplete
IdP → **422** `entity_id`/`idp_name`
- [x] `?overwrite=true` + global EUA **off** + stored team EUA + payload
degrades IdP → **succeeds** (via gitops #43371-OVERRIDE)
- [x] `?overwrite=true` + global EUA off + payload **fully clears** IdP
while a team has EUA → **422** `end_user_authentication` (IsEmpty guard)

  ### Regression / false-positive guards
- [x] Multi-file gitops `--dry-run` configuring IdP AND enabling team
EUA (empty stored IdP) → dry-run passes (EE dry-run skip)
- [x] A previously-working gitops run with a complete SSO/EUA config →
still applies cleanly

  ### End state verification
  - [x] After any **rejected** run, stored SSO/EUA config **unchanged**
- [ ] After a valid complete-IdP run, SSO login + ADE/EUA enrollment
works end-to-end (live device)



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* GitOps now validates SSO and MDM end-user authentication (EUA) configs
before applying changes, rejecting incomplete settings when SSO/EUA are
enabled globally or for any team. Overwrite (GitOps) mode enforces
stricter validation than standard updates; dry-run behavior adjusted to
avoid spurious EUA rejections.

* **Tests**
* Added comprehensive tests covering SSO/EUA validation, overwrite vs
patch semantics, cross-file EUA scenarios, and delete-other-fleets
behavior.

* **Refactor**
* Reorganized validation and config-parsing helpers for reuse in GitOps
checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-06-09 11:38:48 -05:00
Rajendra kadam 2def0f22f1 Extract geoIP and mail service initialization out of runServeCmd (#47151) 
Extracts the geoIP provider and mail service setup out of `runServeCmd`
and into new `cmd/fleet/geoip.go` and `cmd/fleet/mail.go`. Same pattern
as the prior extractions on this issue (#44929, #45343, #45583, #46166,
#46421, #46517, #46742, #46830, #46893). Both are best-effort startup
providers — they log and fall back rather than aborting boot — so they
group naturally.

Functions:

- `initGeoIP` — returns the GeoIP provider. When no database path is
configured, or the MaxMind database fails to load, it returns a no-op
provider and logs rather than aborting startup.
- `initMailService` — configures the mail service; a construction
failure is logged and the (possibly nil) service is returned, matching
the prior best-effort behavior.
- `shouldForceSMTPBackend` — the SMTP-vs-custom-backend rule, pulled out
so the decision is its own testable unit: SMTP and a custom email
backend are mutually exclusive, and an already-enabled SMTP
configuration wins.

Behavior is preserved — `runServeCmd` calls these in the same place with
the same arguments, and the full `cmd/fleet` suite passes against MySQL
+ Redis. The mail block's `config.Email.EmailBackend` reset is local to
mail construction (nothing downstream reads it), so moving it into
`initMailService` is behavior-identical.

On test scope: `TestInitGeoIP` pins the not-fatal fallback for both the
missing-path and invalid-path cases — GeoIP being best-effort is a real
guarantee worth locking. `TestShouldForceSMTPBackend` covers the backend
mutual-exclusion decision, including the nil app config / nil SMTP
settings edges. I didn't add a full `initMailService` happy-path unit
test: `mail.NewService` builds real SMTP/SES backends, so that path is
exercised by booting the server.

**Related issue:** Refs #33370

# Checklist for submitter

- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Refactor**
* Improved GeoIP initialization with automatic fallback when database
configuration is unavailable
* Enhanced mail service initialization with better error handling during
startup
  * Refined SMTP backend precedence logic

* **Tests**
* Added comprehensive unit tests for GeoIP and mail service
initialization scenarios

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-09 10:19:42 +02:00
Jonathan Katz b7adf2751d Add detailed error for generate-gitops when a patch policy installer is missing an FMA (#47136) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43770
Just updates the error message to make it say what's wrong and what can
be done about it. We still abort the entire export because it would be
wrong to create a patch policy not associated to an FMA.


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


New error message:
```
$ fleetctl generate-gitops --dir ./my-gitops --fleet Example-Fleet
Generating GitOps configuration files...
Error generating policies for fleet Example-Fleet: The patch policy "macOS - Zen Browser up to date" references a software installer that is no longer a Fleet-maintained app. Please delete the policy manually.
Error: Something's gone wrong. Please try again. If this keeps happening please file an issue:
https://github.com/fleetdm/fleet/issues/new/choose
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Enhanced error handling in the `generate-gitops` command to provide
clearer messaging when a patch policy references a Fleet-maintained
application that has been removed from the catalog. The command will now
abort with explicit guidance, instructing users to manually remove the
orphaned policy.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 17:49:02 -04:00
Nico 3f5944626c Fix Fleet startup crash on read-only filesystem without S3 bucket (#47099) 
**Related issue:** Resolves #47090

Fleet crashes into `CrashLoopBackOff` on startup when deployed on
Kubernetes with `readOnlyRootFilesystem: true` and **no** S3 software
installers bucket configured:

```
Failed to start: initializing filesystem org logo store: mkdir /tmp/org-logos: read-only file system
```

I realised I was calling `initFatal` when failing to create a directory
on the filesystem which doesn't match the pattern of `logging` +
`creating a "failing" store` (one that is initialized but fails all
operations) as we do for e.g. software title icons (see
NewFailingSoftwareTitleIconStore).

Per this slack conversation:
https://fleetdm.slack.com/archives/C084F4MKYSJ/p1780931127976389, we
decided to fall back to a database-backed storage:

<img width="737" height="114" alt="Screenshot 2026-06-08 at 3 16 28 PM"
src="https://github.com/user-attachments/assets/2a6ff75f-b382-40ba-81d9-3be3cfbd648a"
/>


# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

Commented out this line to force filesystem usage:

<img width="615" height="71" alt="Screenshot 2026-06-08 at 1 18 53 PM"
src="https://github.com/user-attachments/assets/85043c88-5c8c-48a0-8145-098fba9513bd"
/>


#### Before

Server crashes

<img width="1278" height="124" alt="Screenshot 2026-06-08 at 1 18 17 PM"
src="https://github.com/user-attachments/assets/7b788a24-131a-47a3-8580-fcd9fda8b449"
/>


#### After

Server starts and logo upload works

- Without --dev_license



https://github.com/user-attachments/assets/58c5ebf9-cf52-4ba0-ac98-9675e7eef92c



- With --dev_license




https://github.com/user-attachments/assets/117bb812-31bd-4849-927c-93cafd1a71d7








<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **New Features**
- Organization logos now support database storage as the fallback option
when S3 software installers bucket is not configured, replacing local
filesystem storage for improved reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 17:15:14 -03:00
Allen Houchins 055ef891b8 Add Microsoft Office as a Fleet-maintained app for Windows (#43938) 2026-06-08 14:33:23 -05:00
Steven Palmesano 20c0963331 Fix GitOps when using All fleets in VPP settings (#46855) 
**Related issue:** Resolves #46824

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed an issue where volume purchasing program assignments failed when
"All fleets" was selected; validation and token assignment now treat the
"All fleets" label consistently, preventing errors during configuration
application.
* **Tests**
* Added an end-to-end GitOps test case verifying "All fleets" is
supported for volume purchasing program entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 13:27:57 -05:00
Allen Houchins b23f808ab5 Add Ableton Live Suite as a macOS FMA (#47058) 
Add Ableton Live Suite to maintained apps and frontend. Creates a
homebrew input
(ee/maintained-apps/inputs/homebrew/ableton-live-suite.json) and a
darwin output
(ee/maintained-apps/outputs/ableton-live-suite/darwin.json) with version
12.4.1, installer URL, sha256, and installer/uninstaller script refs.
Update apps index (ee/maintained-apps/outputs/apps.json) to include the
new app. Add a React SVG icon component and PNG asset, and register the
icon in the icons index so the UI displays the new app.



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added support for Ableton Live Suite app installation and management
on macOS, including automatic backup of existing installations.
  * Added UI icon for Ableton Live Suite in the software catalog.

* **Improvements**
* Enhanced shell command escaping to safely handle special characters
and paths in app uninstall operations.

* **Tests**
* Added comprehensive unit tests for shell escaping functionality,
including apostrophe handling in uninstall scripts.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 12:02:24 -05:00
Jonathan Katz e34126ab3a Merge branch 'main' of github.com:fleetdm/fleet into feat/39018-self-service-categories 
Bump migration, fix failing test and nilaway check
 2026-06-08 12:12:33 -04:00
Allen Houchins 827d86d0fc Add SQL Server Management Studio as a Windows FMA (#47003) 
Add a new winget maintained-app entry for SQL Server Management Studio
(SSMS) 22. Includes input JSON (Microsoft.SQLServerManagementStudio.22)
and two PowerShell scripts: an installer wrapper that runs the Visual
Studio bootstrapper (vs_SSMS.exe) with --quiet --norestart --wait, and
an uninstaller that looks up the ARP entry for SSMS 22.x and invokes the
Visual Studio Installer uninstall verb with silent switches. Also update
outputs: add the app to apps.json and add version metadata (installer
URL, sha256, and embedded script refs) in
outputs/sql-server-management-studio/windows.json.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* SQL Server Management Studio 22 is now supported for installation and
management on Windows platforms, providing database developers and
administrators with essential tools for development and administration

* **Improvements**
* Extended Windows script execution timeout to support installation of
large and complex applications with substantial installation payloads

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 09:42:29 -05:00
Lucas Manuel Rodriguez 863363561b Fix fleet-scoped host vitals labels (#46953) 
**Related issue:** Resolves #46869

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Host vitals labels based on identity-provider group membership now
correctly apply to both global and team-scoped hosts, preventing
cross-team leakage.

* **Tests**
* Added and updated tests to validate IdP-group-backed vitals label
membership across global and per-team hosts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 10:46:56 -03:00
Rajendra kadam 836695a651 Extract osquery logging initialization out of runServeCmd (#46893) 
Extracts the osquery status, result, and audit JSON logger setup out of
`runServeCmd` and into a new `cmd/fleet/logging.go`. Same pattern as the
prior extractions on this issue (#44929, #45343, #45583, #46166, #46421,
#46517, #46742, #46830). Continues trimming `runServeCmd` toward the
`serve.go` coverage goal on #33370 — this is the largest single slice so
far (~100 lines out).

Three functions come out of the inline block:

- `initOsqueryLogging` — builds the status and result loggers, plus the
audit logger when enabled. Mutates the shared `logging.Config` per
logger in the same sequence as before, so the constructed loggers are
identical.
- `buildLoggingConfig` — maps `config.FleetConfig` into the common
`logging.Config` shared by all three loggers.
- `shouldEnableAuditLog` — the premium-and-enabled gate for the audit
logger, pulled out so the decision is its own testable unit.

Behavior is preserved — `runServeCmd` calls this in the same place with
the same arguments, the per-logger config mutation order is unchanged,
and the full `cmd/fleet` suite passes against MySQL + Redis.
`initOsqueryLogging` returns early after `initFatal` so it's safe when
the caller's `initFatal` doesn't terminate (the case in tests), and it
guards a nil license up front since the audit gate dereferences it
(matching the nil-guard precedent from #46742/#46830).

On test scope: `TestShouldEnableAuditLog` covers all four combinations
of license tier and the config flag — audit logging is a premium
feature, so the gate is the meaningful decision here.
`TestBuildLoggingConfigMapsConfig` is a light check that the config
mapping is wired through. I didn't add a full `initOsqueryLogging`
happy-path unit test: `logging.NewJSONLogger` constructs real log sinks,
so that path is exercised by booting the server rather than by standing
up logger backends in a unit test.

**Related issue:** Refs #33370

# Checklist for submitter

- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Audit logging support is now available for premium license holders.

* **Refactor**
  * Improved logging initialization and configuration management.

* **Tests**
* Added test coverage for audit logging enablement and configuration
mapping.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 12:27:09 +02:00
CarloandJonathan Katz fb9e4c4701 Auth in-house iOS app downloads with install tokens (#46819) 
# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

  ## Testing

  - [x] Added/updated automated tests
  - [x] QA'd all new/changed functionality manually

  ## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **New Features**
* In-house iOS app manifest and package downloads now use secure
per-install tokens embedded in the URL path instead of query parameters
* Installation tokens are bound to specific devices and teams, enhancing
security
  * Installation tokens automatically expire after 6 hours
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Jonathan Katz <yehonatankatz@gmail.com>
 2026-06-05 16:34:20 -04:00
Rajendra kadam 8bda07655c Extract Redis initialization out of runServeCmd (#46830) 
Extracts the Redis pool and the cached_mysql / mysqlredis datastore
wrappers out of `runServeCmd` and into a new `cmd/fleet/redis.go`. Same
pattern as the prior extractions on this issue (#44929, #45343, #45583,
#46166, #46421, #46517, #46742). Continues the path toward `serve.go`
>60% coverage per the discussion on #33370.

Three functions come out of the inline block:

- `initRedis` — builds the Redis pool, wraps the datastore with
`cached_mysql.New`, and applies `mysqlredis.New` with the
license-enforced host limit and host-cache options. Returns the pool,
the fully wrapped `fleet.Datastore`, and the outermost
`*mysqlredis.Datastore` (a few callers need the concrete type).
- `buildRedisPoolConfig` — translates `config.RedisConfig` into the
`redis.PoolConfig`, including the `redis://` scheme strip.
- `validateRedisConfig` — encodes the host-cache invariant:
`HostCacheEnabled` requires `HostCacheTTL > 0`. Returns an error so the
caller (or in this case `initRedis` via `initFatal`) can refuse boot
without that decision being buried inside a pure builder.

Behavior is preserved — `runServeCmd` calls these in the same order with
the same arguments, the host-cache validation still aborts startup when
violated, and the full `cmd/fleet` suite passes against MySQL + Redis.
`initRedis` returns early after `initFatal` so it's safe when the
caller's `initFatal` doesn't terminate (the case in tests). Following
the precedent established on #46742, the caller also has a loud
`initFatal` + `return` guard against a nil pool (covers the same nilaway
flow we hit on the datastore slice).

On test scope: `TestValidateRedisConfig` covers all four combinations of
`HostCacheEnabled` and `HostCacheTTL` — that's the real
boot/refuse-to-boot decision. `TestBuildRedisPoolConfigStripsScheme`
pins the `redis://` scheme-strip contract for Render-style URIs. I
didn't add a `buildRedisPoolConfig` field-mapping matrix or an
`initRedis` happy-path unit test: the former would just re-state the
struct literal, and the latter needs a real Redis pool (the smoke boot
exercises it end-to-end instead).

This completes the four named init-block extractions on this issue. If
further coverage gains are needed beyond what these have already moved,
the next conversation is whether to test `runServeCmd` directly via the
injected `initFatal`.

**Related issue:** Refs #33370

# Checklist for submitter

- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Consolidated Redis initialization and datastore wrapping into a
dedicated helper; startup now validates the Redis pool and handles
initialization failures explicitly.

* **Tests**
* Added unit tests for Redis address handling and host-cache TTL
validation to ensure config behavior is enforced.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-05 13:19:15 +02:00
Magnus Jensen 07129edc66 Clean up Apple reconciler queries, no longer used (#46712) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Final part of Optimize apple reconciler queries.

It does include a slight logic change, when cleaning up for the setup
experience status and release DEP worker, checking for pending profiles.

🤑🤑🤑
<img width="106" height="35" alt="image"
src="https://github.com/user-attachments/assets/68498b1c-31cb-494c-9643-ed5da2602615"
/>


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. Added in another PR.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Move Apple MDM profile and declaration reconciliation to
batched/scheduled processing.
* Stop immediate bulk-updating of pending host profiles after
creating/editing profiles or declarations; Android remains synchronous
while Apple/Windows are deferred.

* **New Features**
* Added targeted per-host pending-profile detection for Apple devices to
improve reconcile accuracy.

* **Tests**
* Reworked and expanded Apple MDM reconciliation tests; removed
legacy/obsolete batch tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-05 11:43:16 +02:00
Victor Lyuboslavsky dd33976faf osquery_perf: Windows MDM push (#46777) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46567 

Note: Hide whitespace for better review

## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Server-triggered on-demand Windows MDM check-ins for immediate device
syncs
* Dynamic adjustment of the device polling interval based on server
directives
* Enhanced metrics: tracking and reporting of on-demand MDM
synchronization sessions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-05 01:13:03 -05:00
Scott Gress 07df7c5cfd Track software deletions in GitOps (#46764) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43729

# Details

Adds output to GitOps runs indicating which custom/FMA software packages
would be deleted. This involves adding a `deleted_packages` key to the
`/software/batch/:request_uuid` ("Get status of software batch-apply
request") API, which will be documented separately.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] verified that a GitOps dry run produces one "would've deleted"
line per custom package / fma that would be deleted
- [X] verified that a GitOps real run produces one "deleted" line per
custom package / fma that was deleted
  - [X] verified that adding software is unaffected



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* GitOps batch software operations now report packages pending deletion:
dry-runs show "would've deleted" warnings and real runs show deletions;
apply flows surface per-package deletion messages.
* Empty payload dry-run now still reports pending deletions when
applicable.

* **Tests**
* Added integration and datastore tests validating deletion-warning
output, pending-deletion detection, and related result handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-04 13:11:49 -05:00
Scott Gress 10f65595f8 Update error message for GitOps exceptions violations (#46700) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45306 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<img width="1470" height="19" alt="image"
src="https://github.com/user-attachments/assets/726b1efe-176f-4460-a140-a1f571990010"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Bug Fixes**
* Enhanced GitOps exception enforcement error messages for labels,
secrets, and software to include a direct link to the Fleet settings
page where exceptions can be disabled. Users now receive actionable
guidance when enforcement is triggered, improving troubleshooting
efficiency and reducing time spent resolving configuration issues.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-04 09:50:04 -05:00
Scott Gress 9cf20fbab3 Fix preview config (#46677) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46560 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- updated preview test. This won't run in CI right now b/c we didn't
update fleetctl, but I ran it successfully locally
- [X] QA'd all new/changed functionality manually
- [x] on main, did `fleetctl preview` with the 4.86.0 tag and verified
that charts were disabled
  - [x] on this branch, did the same and verified charts were enabled 



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Dashboard chart data collection (Hosts online and Vulnerability
exposure) is no longer disabled when starting preview mode.

* **Chores**
* Software inventory config moved to the current features flag so
historical chart data is preserved.

* **Tests**
* Added regression checks to ensure uptime, vulnerabilities, and
host-users historical data remain enabled in preview.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-04 09:49:47 -05:00
Rajendra kadam 210331ba1e Extract datastore initialization out of runServeCmd (#46742) 
Extracts the MySQL datastore initialization out of `runServeCmd` and
into a new `cmd/fleet/datastore.go`. Same pattern as the prior
extractions on this issue (#44929, #45343, #45583, #46166, #46421,
#46517). Continues the path toward `serve.go` >60% coverage per the
discussion on #33370.

Three functions come out of the inline block:

- `initDatastore` — builds the shared DB connections, the datastore, and
the carve store (S3-backed when configured, otherwise the datastore
itself).
- `buildMySQLOpts` — assembles the DB options: base logger and config,
plus the optional read replica, dev SQL interceptor, and tracing.
- `evalMigrationStatus` — prints any operator guidance for the migration
status and returns whether `runServeCmd` should exit. The `os.Exit`
stays in `runServeCmd`, so the boot/refuse-to-boot decision becomes
unit-testable without the function terminating the test binary.

Behavior is preserved — `runServeCmd` calls these in the same order with
the same arguments, the migration-exit conditions are unchanged, and the
full `cmd/fleet` suite passes against MySQL + Redis. `initDatastore`
returns early after `initFatal` so it's safe when the caller's
`initFatal` doesn't terminate (the case in tests).

On test scope: `TestEvalMigrationStatus` covers every migration status
code across the dev-mode and allow-missing-migrations combinations —
that's the real decision logic. I deliberately didn't add unit tests for
`initDatastore`/`buildMySQLOpts`: their only failure paths are paranoid
`initFatal` wrapping around constructors that don't dial at construction
time, and the option builder returns opaque option closures. Those
success paths are already exercised by booting the server, so a full
datastore mock wasn't worth it for coverage's sake.

Remaining slice per the broader plan: Redis init.

**Related issue:** Refs #33370

# Checklist for submitter

- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Reorganized database startup initialization and migration status
evaluation for improved maintainability.

* **Tests**
* Added comprehensive test coverage for database migration status
handling across various scenarios.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-04 09:39:49 +02:00
Konstantin Sykulev e8bd1d525a Android provision certificates before dependent profiles (#46759) 
**Related issue:** Resolves #45022

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Prevented intermittent Android profile failures during host/team
transfers by ensuring pending Android certificates are created for
transferred devices before dependent profiles are applied. Profiles now
apply reliably, including when devices are moved off a team.
* **Tests**
* Added and updated tests to cover Android certificate provisioning
during host transfers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-03 20:46:08 -05:00
Jonathan Katz a3338d032e Self service categories - GitOps support (#46671) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46392 
A few things in this PR:
- updated the conversion from old default category to the new ones with
the emoji included that was introduced in the feature branch. It takes
into account what exists in the database now so if an admin wants to add
for example "Productivity" without the emoji as a category it won't get
overwritten.
- updated a few places to ignore missing categories rather than error
(what we do for adding a single FMA currently)
- updated permissions for "gitops" users 
- added everything needed for gitops, generate-gitops support using the
existing endpoints from the last PR.

Didn't add logs like "[+] applied X self service categories" since it
wasn't mentioned in the docs, but wouldn't be too hard to add.


# Checklist for submitter


## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## New Fleet configuration settings

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
    - Currently missing, at least on this branch
 2026-06-03 15:23:44 -04:00
Jordan Montgomery 356caea6fd 42508 Rename abm to ab in API (#46657) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #42508 

Renames abm/apple_business_manager to ab/apple_business in API and
fleetctl. Uses existing renameto logic with a slight twist: added
"inline" option to handle cases particularly where a single object tree
has renames in multiple versions so that we don't break backwards
compatibiility since the default behavior when you have multi-level
renames is a new/old split at the top level

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Canonical Apple Business (AB) API endpoints and CLI:
/api/v1/fleet/ab_tokens, /api/v1/fleet/mdm/apple/ab_public_key, plus new
fleetctl get mdm-ab and fleetctl generate mdm-ab
  * New GitOps/config key: mdm.apple_business
* Admin UI updated to show Apple Business tokens with fleet-based
associations and updated labels

* **Deprecations**
* Legacy ABM endpoints, CLI aliases, and config keys remain supported
but emit deprecation warnings pointing to the new AB equivalents
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-03 14:58:17 -04:00
Andrew Mellor d7d9a96aa3 Add combined include/exclude label targeting for MDM profiles (API and GitOps) (#46437) 
**Related issue:** Resolves #45180

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [x] Confirmed that the fix is not expected to adversely impact load
test results


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* MDM profiles can combine label inclusion (include-all/include-any)
with exclusion (exclude-any) so you can target hosts by labels while
excluding specific labeled hosts.
* Profile validation now enforces a single include-mode and explicitly
rejects any label used in both include and exclude lists.

* **Bug Fixes**
* Deleting a label that’s referenced by an MDM configuration profile or
declaration is blocked and returns an error to prevent broken targeting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-03 15:24:33 +01:00
Rajendra kadam 6020c74764 Extract Apple MDM initialization out of runServeCmd (#46517) 
Extracts the Apple MDM initialization out of `runServeCmd` into testable
functions in a new `cmd/fleet/mdm_apple.go`. Continues the chain of
extractions on this issue (#44929, #45343, #45583, #46166, #46421)
toward the `serve.go` >60% coverage target discussed on #33370.

Five functions come out of the inline block:

- `initAppleMDMStorages` — constructs the MDM, DEP, and SCEP storages.
- `initAppleMDMPushService` — picks the no-op pusher under
`FLEET_DEV_MDM_APPLE_DISABLE_PUSH=1`, otherwise the real APNs pusher.
- `checkMDMAssetsExist` — promotes the inline `checkMDMAssets` closure
to a package function. It was already used at several call sites; they
now all share this one.
- `reconcileAppleMDMAPNsAndSCEPAssets` / `reconcileAppleMDMABMAssets` —
the APNs/SCEP and ABM asset reconciliation blocks.

Behavior is preserved — `runServeCmd` calls these in the same order with
the same arguments, and the full `cmd/fleet` suite passes unchanged
against MySQL + Redis. Each function returns early after `initFatal` so
it's also safe when the caller's `initFatal` doesn't terminate (the case
in tests).

On test scope: the new unit tests cover the dev-mode push gate, all four
branches of `checkMDMAssetsExist`, and the no-op and missing-private-key
paths of both reconcilers. The storage construction and the actual
asset-insert paths need a real datastore, so those stay covered by the
existing integration tests rather than new unit tests — I didn't want to
stand up a full datastore mock for paths that are already exercised
end-to-end.

**Related issue:** Refs #33370

# Checklist for submitter

- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Apple MDM initialization and configuration management for APNs,
SCEP, and Apple Business Manager with automatic reconciliation of
missing assets and a dev-mode option to disable push.

* **Tests**
* Added unit tests covering push-service behavior, asset-existence
checks, reconciliation logic, and fail-fast handling when required key
material is missing.

* **Refactor**
* Simplified Apple MDM initialization flow by extracting initialization,
push-service, and reconciliation logic into helpers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-03 16:15:11 +02:00
Juan Fernandez 7cf8190552 Changed semantics around api_endpoints init. 
Fixes #46190

- Added a package init() to load the catalog from the embedded YAML
once.
- Init() now no longer runs any initialization logic just validation, so
it was renamed to Validate.
 2026-06-03 10:13:11 -04:00
Victor Lyuboslavsky 59a673bc15 Added trace sampler to use OTEL in prod. (#46595) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44652 

Docs: https://github.com/fleetdm/fleet/pull/46631

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [x] Setting(s) is/are explicitly excluded from GitOps

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Route-aware OpenTelemetry trace sampling with tiered default ratios
(very low for select high-volume routes, reduced rate for admin reads,
full sampling otherwise).
* Admin-only GET/PATCH /debug/trace_sampler to view and update sampling
ratios and a runtime "force full" toggle.
* Liveness probe endpoints (/healthz, /version, /metrics) are excluded
from tracing; settings propagate to replicas at runtime without restart.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-02 18:53:00 -05:00
Scott Gress 2bd7fec8a7 Handle edge case of adding new fleet + vpp at the same time (#46533) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44444 

# Details

This PR fixes the following edge case when running `fleetctl gitops`:

1. A new fleet is added
2. That fleet is declared as an ABM default fleet and/or a fleet in a
VPP token location
3. The _other_ fleets declared as ABM defaults or VPP fleets are _not_
all provided in the GitOps run

In that case, the GitOps run would fail with an error that one of the
previously-existing fleets could not be found. This PR fixes the bug by
making sure that GitOps looks at both the currently-persisted fleets
(via the API) and any fleets that are being created in the current run.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- Reproduced the issue on `main` by attempting to create a new fleet
_and_ add it both as an ABM default fleet and to the set of VPP token
users in a single run, and getting an error about one of the existing
fleets not being found
- Verified that I was able to complete a gitops run successfully on this
branch with a new fleet as a VPP token user and a default ABM fleet



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Bug Fixes**
* Improved validation for Apple Business Manager and Volume Purchasing
Program token team assignments with clearer error messages when
referenced teams aren't found in Fleet.
* Enhanced team name matching to properly handle Unicode characters,
ensuring consistent team identification across GitOps configurations.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-02 14:47:54 -05:00
Magnus Jensen a4d1cfab1f CSUD: Add validation for OS Update profiles and OS updates being configured (#46545) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45282

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Deploy custom OS update configuration profiles for Apple
(macOS/iOS/iPadOS) and Windows; tracks and enforces one custom OS‑update
profile per scope.

* **Improvements**
* Prevent changing OS update settings when a custom profile exists;
returns guidance to remove the custom profile first.
* Batch upload now detects OS‑update payloads and enforces license
requirements.
  * UI error handling surfaces API-specific messages.
* FileVault control separated from OS updates and gated behind a
configurable flag/license.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-02 17:28:58 +02:00
Victor Lyuboslavsky 1072c852e8 Added support for validating Microsoft Entra v2 access tokens (#46416) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46388 

Video demo: https://www.youtube.com/watch?v=t3yuGh0kwP8
Docs PR: https://github.com/fleetdm/fleet/pull/46483

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.

## New Fleet configuration settings

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* UI to add/remove Entra application (client) IDs for Windows automatic
enrollment; add/delete modals and list management.

* **Enhancements**
  * Activity feed entries for added/removed Entra client IDs.
* Entra client ID allowlist surfaced in GitOps and persisted config;
client IDs normalized (trim/lowercase) and de-duplicated.

* **Documentation**
* Note: from July 1, 2026 new on‑prem Windows MDM apps receive Entra v2
tokens with aud = client ID; v1 tokens remain supported.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-01 17:58:51 -05:00
Jonathan Katz abd38218fa Self service categories endpoints + activities (#46593) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46391 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually
 2026-06-01 15:53:06 -04:00
Allen Houchins 698c99dd00 Add Adobe Acrobat Pro as a Windows FMA (#43829) 
Add Winget support for Adobe Acrobat Pro: new input JSON,
install/uninstall PowerShell scripts, and Windows output manifest (with
script refs and installer metadata). Rename Homebrew input and apps
listing to "Adobe Acrobat Pro" and add a Windows entry to apps.json.
Improve winget ingester to try version directories in descending order,
skip grouping dirs that don't contain expected manifests, fetch and
unmarshal installer and locale manifests with better logging and error
handling, and return a clear error when no valid version manifest is
found.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added support for Adobe Acrobat Pro on Windows with automated install
and uninstall capabilities.

* **Bug Fixes**
* Improved version handling during app installation to try multiple
candidate versions if needed.
  * Enhanced error messaging for app uninstall validation.

* **Updates**
* Standardized Adobe Acrobat Pro product naming across platforms for
consistency.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/43829?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-01 09:54:34 -05:00
Lucas Manuel Rodriguez 9032883b47 Fix fleetctl get fleets to use source of truth (DB) for software (#46480) 
Resolves #44970 (1/2).

---

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* `fleetctl get fleets` / `get teams` now display software and setup
experience from authoritative software endpoints.
* Preserve literal setup_experience fields (avoid erroneous macos_setup
renames) when applying and when transmitting JSON for software entries.
* **Tests**
* Added regression tests and test helpers to ensure
software/setup_experience are sourced correctly and to prevent nil
panics in related tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-01 11:41:34 -03:00
Juan Fernandez 66667c3248 Fix S3 carve cleanup never running and panic on empty carves (#43045) (#46462) 
Resolves #43045 

Fixed a bug where the carve cleanup cron job called the MySQL
implementation instead of the S3-aware implementation on S3-configured
deployments, meaning expired carves were never marked as expired in S3.
Also fixed a panic in S3 carve cleanup that occurred when there were no
non-expired carves.
 2026-06-01 10:11:49 -04:00
Harrison RavazzoloandAllen Houchins e7bf5e60ae Windows FMA - Amazon WorkSpaces (#46304) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Amazon WorkSpaces support on Windows: app listing, version
entry, installer/uninstaller metadata, and a UI icon.

* **Improvements**
* Relaxed input validation to allow comma (,) and ampersand (&)
characters in query filters.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46304?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
 2026-06-01 08:31:55 -05:00
Steven PalmesanoandScott Gress 64f601891e Fix fleetctl apply ignoring spec.fleet (#44894) 
**Related issue:** Resolves #44892

Claude also added tests, since this wasn't covered before, but I've kept
them in a separate commit in case they're not needed.

# Checklist for submitter

## Testing

- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved spec parsing to correctly accept resources declared as either
team or fleet, handling nested spec keys consistently and preserving
backward-compatible behavior.

* **Tests**
* Added and updated tests and fixtures to validate parsing across both
team/fleet variants and to assert specific conflict/reporting behavior
when both keys are present.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44894?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Scott Gress <scott@fleetdm.com>
 2026-05-29 11:23:19 -05:00
Rajendra kadam 06aba2c0d8 Extract OTEL provider initialization out of runServeCmd (#46421) 
Extracts the OTEL trace, metric, and log provider setup out of
`runServeCmd` and into `initOTELProviders` in a new `cmd/fleet/otel.go`.
Same pattern as the prior extractions on this issue (#44929, #45343,
#45583, #46166). Side effects (`otel.SetTracerProvider`,
`otel.SetMeterProvider`) are preserved inside the extracted function, so
runtime behavior is identical.

Three unit tests in `cmd/fleet/otel_test.go`:
- OTEL disabled (the common production path) returns `(nil, nil, nil)`
and never calls `initFatal`.
- OTEL enabled without log export returns non-nil trace and meter
providers; logger provider stays nil.
- Log export enabled returns all three providers non-nil.

One honest note on coverage: the four `initFatal` sites inside the
function are paranoid wrapping for OTEL SDK constructors that don't dial
at construction time, so the error paths are hard to drive in tests
without mocking the SDK. The tests above exercise the success paths and
the disabled gate, which is the bulk of the realistic flow.

This continues the path toward `serve.go` >60% coverage per the
discussion on #33370 — `serve.go` is now ~100 lines shorter and the OTEL
phase is testable as a unit. Remaining slices per the broader plan: MDM
Apple init, datastore init, Redis init.

**Related issue:** Refs #33370

# Checklist for submitter

- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Centralized OpenTelemetry provider initialization into a single setup
path, simplifying startup and shutdown behavior and making observability
configuration clearer.

* **Tests**
* Added unit tests covering disabled/enabled telemetry paths and
optional log export, plus cleanup logic to ensure providers are shut
down correctly.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46421?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-29 06:45:47 -05:00
Magnus JensenandClaude b42a154cf6 Optimize Apple profile reconciler approach by moving logic to code (#45573) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Closes #46153 

This PR is big, but I found it worth it to include in the same PR to
keep the mental change context in one place.

This PR moves away from our previous version of a big SQL computing the
desired state and label membership with big union branches. It does so
by switching the model up completely, first:
- We batch read hosts (current hardcoded is 5k), and we always iterate
5k hosts and then decide if they have changes, so that means a tick
(30s) could read 5k hosts that DOES NOT require changes, but that is
computed in code after, rather than relying on a big SQL to do it
(twice).
- We then for those hosts, bulk fetch label memberships, their related
team profiles and current rows. This performs much better as we can
lookup everything we need by primary key or super fast indexed columns,
simple fetch all these calls.
- Then once gathered the information we move to the code to determine if
the operation is install, remove, NO-OP (Desired state calculation),
then we check the label membership to further determine it's final
action.
- We then move to what we did before, which is queue the correct command
etc.

It comes with some slight caveats, which is we now load a lot more data
into memory (but before we could spike worse), so when loadtesting we
watched CPU/Memory utilization, which never seemed to spike as the
datasets are kept as small as possible.

_Cleanup will come in a follow-up PR where we remove all the old code._

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [X] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Performance**
* Optimized Apple profile and DDM (Declarations) reconciliation engine
with batched processing for significantly improved performance in
environments with large numbers of Apple-enrolled hosts.
* Implemented cursor-based pagination for more efficient reconciliation
across large fleets.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45573?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-05-29 09:46:17 +02:00
Jordan Montgomery c70f6796a0 Add cert rollover tool, update Filevault key decryption for rollover process (#46226) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46226

# Checklist for submitter

If some of the following don't apply, delete the relevant line.


- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Add CA certificate rollover CLI to renew MDM CA certs with an
extend-years option while preserving the private key and certificate
properties.
* **Improvements**
* Decryption logic updated to accept previously-rolled CA certificates
so escrowed disk-encryption keys can be decrypted after rollover.
* **Tests**
  * Expanded tests and mocks to cover rollover and decryption scenarios.
* **Chores**
* Updated ignore rules and added a changelog entry for the rollover
process.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46226?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-28 16:31:18 -04:00
Lucas Manuel Rodriguez a1d91464ea Fix issue with permissions in host activity list for fleet-users (#46362) 
**Related issue:** Resolves #46009.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Resolved an authorization issue preventing users from viewing past
host activities on hosts that contained user-initiated operations such
as lock, wipe, run script, or install software.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46362?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-28 14:57:27 -03:00
Tim Lee 132d5e3515 Clear MDM-delivered certs when a host leaves MDM (#46289) 2026-05-28 10:38:26 -06:00
Allen Houchins 1651b6e36a Add Amazon Corretto 25 as a Windows FMA (#46220) 
Add support for Amazon Corretto 25 across the repo: new winget input
definition, Windows output metadata (version 25.0.3.9) including
installer/uninstaller PowerShell scripts, SHA256 and upgrade_code, and
register the app in ee/maintained-apps/outputs/apps.json. Also add a
frontend SVG icon component, map it in the icons index, and include the
2x PNG asset so the app is displayed in the UI. This enables Fleet to
install and uninstall Amazon Corretto 25 on Windows.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **New Features**
* Added complete Amazon Corretto 25 support for Windows including
detection, installation, and lifecycle management capabilities
* Enhanced Windows application detection to support matching by multiple
registry identifiers, improving detection accuracy for installed
programs

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46220?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-26 21:10:05 -05:00
Lucas Manuel Rodriguez 5b2427d187 Add backend changes for continuous automations on policies (#45999) 
Resolves #45149 and #45150.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## Database migrations

- [X] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [X] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [X] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [X] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added team policy setting continuous_automations_enabled (default:
false) to re-run software/script automations on every failing
evaluation; exposed in APIs and GitOps YAML. Disallowed for "All fleets"
and requires a premium license.

* **Tests**
* Added integration tests for CRUD, GitOps, and re-queuing behavior
validating continuous automations.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45999?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-26 21:11:18 -03:00
Allen Houchins bc28a51a99 Add PhpStorm as a Windows FMA (#46217) 
This pull request adds Windows support for managing PhpStorm as a
maintained app, including installation and uninstallation automation,
and improves the ingestion logic to handle publisher information for
better normalization. The most important changes are:

**Windows support for PhpStorm:**

* Added a new maintained app definition for PhpStorm on Windows,
including metadata and references to install/uninstall scripts
(`phpstorm.json`).
* Implemented a PowerShell install script for PhpStorm that runs the
NSIS installer silently (`phpstorm_install.ps1`).
* Implemented a PowerShell uninstall script that finds the correct
PhpStorm uninstaller via registry, ensures it's the JetBrains version,
and runs it silently (`phpstorm_uninstall.ps1`).
* Added PhpStorm for Windows to the `apps.json` output and created a
versioned output file with install/uninstall logic and metadata
(`apps.json`, `phpstorm/windows.json`).
[[1]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1404-R1410)
[[2]](diffhunk://#diff-0286e1ea4f71a5a6d429728675f1b3d8eb8bb14241c86c1ce7697e454b9cbe4dR1-R22)

**Improvements to ingestion logic:**

* Updated the app existence check in `windows.go` to select and
propagate the `publisher` field, and set the `Vendor` on ingested
software, ensuring publisher-based normalization (important for
JetBrains build-number handling).
[[1]](diffhunk://#diff-a0970c0b97aa9bac9f771a8ecb164afea2bc7245206844f6e32aa5b69d964f4aL55-R55)
[[2]](diffhunk://#diff-a0970c0b97aa9bac9f771a8ecb164afea2bc7245206844f6e32aa5b69d964f4aR74)
[[3]](diffhunk://#diff-a0970c0b97aa9bac9f771a8ecb164afea2bc7245206844f6e32aa5b69d964f4aR84-R91)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added support for PhpStorm on Windows, including automated
installation and removal capabilities.
* Enhanced Windows application detection to retrieve publisher
information for improved vendor identification.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46217?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-26 15:37:00 -05:00
Victor Lyuboslavsky e790260b85 Android commands backend (#46031) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41683 

Support for Android lock, wipe, and clear passcode commands. Behavior is
slightly different between BYOD and CODO. The fleetdm.com proxy isn't
wired up, so they only work with direct Google connection.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Clear-passcode CLI plus Android Lock and Wipe commands (Wipe
restricted to company-owned devices).
* BYO unenroll now removes only the work profile, preserving personal
data.
* Commands issued with a 10-year duration; UI/CLI show Android-specific
messaging and command IDs.

* **Improvements**
* Host MDM pages reflect command lifecycle transitions (pending →
acknowledged or error with code/message) via Pub/Sub updates.

* **Documentation**
* Updated docs for Android MDM commands, ownership rules, and command
duration.

* **Tests**
  * New unit and integration tests for Android MDM flows.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46031?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-26 12:16:03 -05:00
Jonathan Katz 5d59b0e627 Skip VPP label validation in dry runs (#46106) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45844
Skips label validation against the database in dry runs, because if new
ones are being applied in the same run then they wouldnt be in the db
ahead of time.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.


## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually
- Added a new label and vpp reference to it, both dry run and real run
worked.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

**Bug Fixes**
* GitOps dry runs no longer fail when a VPP app references a label that
is introduced within the same run.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46106?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-25 12:04:06 -04:00
Rajendra kadam d94e38076b Extract Apple APNs/SCEP pair validation onto MDMConfig (#46166) 
Extracts the Apple APNs/SCEP both-or-neither check out of `runServeCmd`
and puts it on `MDMConfig` as `ValidateAppleAPNSAndSCEPPair(initFatal)`.
Same pattern as `ConditionalAccessConfig.Validate`,
`AndroidAgentConfig.Validate`, and the validators added in #45583.

The call site (inside the existing `if len(toInsert) > 0` gate) goes
from six lines of inline conditional `initFatal` calls to one method
call. Behavior, error messages, and gating are unchanged.

Tests live in `server/config/config_test.go`: one smoke case plus two
error branches (APNs-only and SCEP-only). Skipped the "neither set" case
on purpose — the outer `if config.MDM.IsAppleAPNsSet() ||
config.MDM.IsAppleSCEPSet()` gate in `runServeCmd` guarantees at least
one is set before the validator is ever reached.

This is the last pure config validation left in `runServeCmd` per the
broader-plan note on #45583. Remaining `initFatal` sites are runtime
failure paths (datastore init, Redis init, MDM init wiring) which need
the injection from #45343 — those would be the next slice.

**Related issue:** Refs #33370

# Checklist for submitter

- [x] Added/updated automated tests
- [x] Input validation (validator method plus tests; no SQL/JS/shell
paths involved)
- Changes file: not applicable, internal refactor with no user-visible
behavior change


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved Apple MDM configuration validation to ensure APNs and SCEP
certificates are properly paired during setup.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46166?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-25 17:57:24 +02:00
Steven Palmesano 4676042542 Update note about no-teams -> unassigned (#45486) 
On my Fleet instance, "No team" was automatically named "Unassigned" in
the UI. If this isn't the case for a user, they need to rename the fleet
in the UI first, before changing the name in git.

Reference:
https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#:~:text=When%20renaming%20a,g.%20software%20packages

> When renaming a fleet, first update the name in the UI, then update
your YAML.

# Checklist for submitter

## Testing

- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated deprecation warning message for legacy configuration files to
provide clearer migration instructions, guiding users to update fleet
names and rename files to align with new naming conventions.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45486)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-25 14:38:05 +02:00
Rajendra kadam 2395d06e5b Extract early config validation from runServeCmd into testable helpers (#45583) 
Extracts early config-validation logic out of `runServeCmd` and puts it
on the relevant config types in `server/config/`, following the existing
pattern used by `ConditionalAccessConfig.Validate(initFatal)` and
`AndroidAgentConfig.Validate(initFatal)`. (First commit on this branch
did the extraction into a separate file in `cmd/fleet/`; reshaped per
review.)

`runServeCmd` is now a series of `config.X.Validate(initFatal)` calls:

- `config.Logging.Validate(initFatal)` — OTEL logs requires tracing
enabled
- `config.Osquery.Validate(initFatal)` — `host_identifier` must be one
of `provided`, `instance`, `uuid`, `hostname`
- `config.Server.NormalizeURLPrefix()` +
`config.Server.ValidateURLPrefix(initFatal)` — Normalize mutates,
ValidateURLPrefix is pure
- `config.Server.Validate(initFatal)` — `private_key` vs
`private_key_arn` mutex check (called before Secrets Manager retrieval
so a misconfig fails fast without paying for an external lookup)
- `config.Server.ValidatePrivateKeyLength(initFatal)` — minimum 32 bytes
(called after Secrets Manager retrieval so an SM-provided short key is
also caught)

The private-key checks are split into two methods rather than folded
into one because the XOR check has to fire before the SM call, and SM
retrieval populates `PrivateKey` — so a single Validate called twice
would false-positive the XOR check post-SM whenever the user originally
configured only `private_key_arn`. Open to feedback if a different split
is preferred.

Tests live in `server/config/config_test.go` next to the existing config
Validate tests, structured as one smoke case plus error branches per the
existing convention.

Behavior is preserved: `runServeCmd` still calls `initFatal` at the same
points with the same descriptions.

## Broader plan

Issue #33370 calls for moving logic out of `serve.go` ("should only
contain critical config and dependency injection logic"). This PR is one
slice. Follow-ups, each in their own small PR:

- Extract more config validations (Apple APNs/SCEP both-or-neither,
etc.)
- Use the `initFatal` injection from #45343 to cover runtime failure
paths (datastore init, Redis init, MDM init)
- Larger extractions (license init, MDM wiring, mailer init)

**Related issue:** Refs #33370

# Checklist for submitter

- [x] Added/updated automated tests
- [x] Input data is properly validated (validators added, no
SQL/JS/shell paths involved)
- Changes file: not applicable — internal refactor with no user-visible
behavior change


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes & Improvements**
  * Centralized and strengthened startup configuration validation.
* Enforced mutual exclusivity for private key sources and minimum
private-key length.
* Added URL-prefix normalization (ensure leading slash, trim trailing
slash) and validation.
  * Ensured OTEL logging requires tracing when enabled.
  * Restricted osquery host identifier to supported values.

* **Tests**
* Added tests covering validation rules and URL-prefix
normalization/validation.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45583?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-21 12:33:37 -05:00