Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 19 Packages Projects Releases Wiki Activity
24,222 Commits 2 Branches 0 Tags
957089f95013ef5f6aebbfafe1f00a6befa4b63c
Commit Graph
4233 Commits
Author SHA1 Message Date
Magnus Jensen 2935856f37 validate apple payload scope conflict, and unknown variable use in dry-run (#45139) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44456 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Dry-run now performs Apple config profile payload scope conflict
validation and reports unknown Fleet variables for all profile types
before completing.

* **Tests**
* Added tests covering Apple config profile scope-conflict validation
and dry-run/batch profile workflows to ensure conflicts are detected in
both dry-run and live flows.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45139)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-12 08:51:30 +02:00
Nico b0dc97006c Dedupe network errors so usage_statistics cron stops failing (#45142) 
**Related issue:** Resolves #42613

Dedupes errors that report HTTP 408 (request timeouts). As of now, I
believe this only fires for timeouts on the
**/api/v1/osquery/distributed/write** endpoint.
This is so that we have a unique error hash with an incrementing count,
instead of thousands of entries each with count: 1, which produces a
huge JSON payload when passed to
https://fleetdm.com/api/v1/webhooks/receive-usage-analytics for
processing.

Trade-off:
- Before: every occurrence got its own Redis entry so thousands of
near-identical examples coexisted.
- After: they collapse into one entry whose :json value still contains a
representative example, but we'd only keep the last IP+Port instead of
all of them.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

Build a ~5 MB JSON body in a temporary file:

```bash
{ printf '{"node_key":"'; head -c 5000000 /dev/zero | tr '\0' 'x'; printf '"}'; } > /tmp/distwrite-body.json
```

Clear out redis:

```bash
docker exec fleet-redis-1 redis-cli FLUSHDB
```

Send a dummy request and throttle the upload at 100 KB/s → ~50s to send,
read timeout fires at 25s.
I sent this 3 times and got the "request body read error" error back
after each request.

```bash
curl -sk --limit-rate 100K -X POST -H 'Content-Type: application/json' --data-binary @/tmp/distwrite-body.json https://127.0.0.1:8080/api/v1/osquery/distributed/write

{
  "error": "request body read error: i/o timeout",
  "uuid": "95937f50-1008-4625-9423-bc19c7be6818"
}
```

Count the error keys containing "request body read error" as the value. 

```bash
docker exec fleet-redis-1 sh -c 'for k in $(redis-cli --scan --pattern "error:*:json"); do v=$(redis-cli GET "$k"); echo "$v" | grep -q "request body read error" && echo "$k count=$(redis-cli GET "${k%:json}:count")"; done'\

error:{Cco_JmAdBVVVJI9k0XjNNUCmG0z1IKguMQD4VDaejfc=}:json count=3
```

Notice the single entry and count=3 (since I ran the dummy request 3
times).

Running this on main outputs three entries each with count=1.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Network error deduplication for request-timeout errors now normalizes
socket addresses, preventing the usage statistics cron from failing when
many similar network errors accumulate.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45142)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-11 22:21:57 +02:00
Victor Lyuboslavsky 1213e5da12 Fixed validation that rejected enabling end user authentication on Fleet deployments without Apple MDM configured (#45162) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44801 

Note there is a related bug:
https://github.com/fleetdm/fleet/issues/45170

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* End user authentication can now be enabled for Windows-only and
Linux-only fleets without requiring macOS MDM configuration.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45162)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-11 14:55:16 -05:00
Scott Gress fe16654729 Allow glob literals in filenames (#44547) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43598

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] added a script file `some-*-script[].sh` and referred to it in a
gitops file using `path:`. Failed on main; on this branch it
successfully uploaded the script
- [X] still got expected error message when using `path: ` with a value
that had glob characters that _didn't_ match an actual file
- [X] `paths:` still worked and uploaded multiple files, including
`some-*-script[].sh`


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed path validation in fleetctl gitops so path values containing
glob metacharacters (e.g., brackets, asterisks, question marks) are
accepted when a literal file with that name exists on disk; missing
files still produce the appropriate error.

* **Tests**
* Added regression tests covering glob metacharacter handling in path
validation.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44547)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-11 13:49:31 -05:00
Scott Gressandcoderabbitai[bot] c7364d555c Officially deprecated setup_experience.software (#44549) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #42503

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] setting `software:` under `macos_setup` or `setup_experience`
triggers the expected warning.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Deprecations**
* Using setup_experience.software or macos_setup.software now emits a
deprecation warning. Migrate by setting setup_experience: true on
individual software items (packages, App Store apps, or fleet-maintained
apps).

* **Tests**
* Added test coverage to verify the deprecation warning is emitted when
applicable and absent otherwise.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44549)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
 2026-05-11 13:49:11 -05:00
Scott Gress 348fa47c84 Improve name key validation in GitOps (#44553) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
  - [X] omitted `name:` from a file without `org_settings:`, got:
```
	* No `name` was provided in /tmp/testback/fleets/third-fleet.yml. If this file is intended to define org-level settings, add `org_settings:` as a top-level key. Otherwise, use `name` to specify the fleet name.
```
  - [X] omitted `name:` from a file with `org_settings:`, got no error.
  - [X] omitted `name:` from `no-team.yml`, got:
```
	* `name` must be `No Team` for `no-team.yml`
```
  - [X] omitted `name:` from `unassigned.yml`, got:
```
	* `name` must be `Unassigned` for `unassigned.yml`
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved error messages when GitOps YAML files omit the required
`name` field, with specific remediation guidance tailored to each
configuration file type
* Enhanced validation error messaging when top-level `org_settings` is
missing or incorrectly placed, providing clearer instructions on
required YAML structure

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-11 13:49:02 -05:00
Scott Gress 8b779110a8 Remove verb and url from gitops errors (#44555) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43721 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
Added a Google Calendar integration to gitops .yml with `client_email`
missing from the `api_json_key`.
  - [X] on main, got error: 

```
Error: applying fleet config: PATCH /api/latest/fleet/config received status 422 Validation Failed: client_email is required (API time: 13ms)
```

  - [X] on this branch, got:

```
Error: applying fleet config: Validation Failed: client_email is required (API time: 134ms)
```



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Cleaner CLI error messages: removed extraneous HTTP path/status-code
details from GitOps-related errors, making output easier to read.

* **Tests**
* Added tests to verify the improved error message handling and
nil/non-wrapped error behavior.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44555)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-11 13:48:52 -05:00
Scott GressCopilot Autofix powered by AITim Lee
 		f5c59ae3b4 Fix google calendar key validation (#44556) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #42886 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] gitops run with extra keys (besides `client_email` and
`private_key` in `api_key_json` fails on main, passes on this branch
- [X] gitops run with missing `client_email` or `private_key` in
`api_key_json` still fails gitops (including dry run)
- [X] gitops run with extra keys sibling to api_key_json still fails as
expected



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Corrected GitOps validation so Google Calendar API key JSON no longer
rejects valid nested keys; required-field validation for the integration
still enforced.
* **Tests**
* Added test coverage to ensure nested unknown keys are accepted while
sibling-level unknown fields are reported as validation errors.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44556)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Tim Lee <timlee@fleetdm.com>
 2026-05-11 13:41:28 -05:00
Magnus Jensen 42210d0a96 inconsistent alignment fleet premium (#45125) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43646

<img width="809" height="149" alt="image"
src="https://github.com/user-attachments/assets/cf7b55ae-4d79-4686-a9e5-e9e68e4b2e65"
/>

<img width="851" height="190" alt="image"
src="https://github.com/user-attachments/assets/0c70a2b6-091c-4222-b9a9-c4d46f9b0f5b"
/>


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed alignment inconsistency for premium feature messages in Fleet
settings. Premium notifications across Disk Encryption and Passwords
controls now display with proper alignment on Fleet Free tier.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45125)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-11 19:22:53 +02:00
Nico 146f0c8589 LabelForm: replace 'teams' with 'fleets' (#44770) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
Ad-hoc issue detected when reviewing
https://github.com/fleetdm/fleet/pull/44410

Resolves: #45141 

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

### Before
<img width="993" height="603" alt="Screenshot 2026-05-05 at 9 35 13 PM"
src="https://github.com/user-attachments/assets/4c410c92-a44b-4018-b5a5-edba7b83e539"
/>

### After
<img width="982" height="569" alt="Screenshot 2026-05-05 at 9 50 26 PM"
src="https://github.com/user-attachments/assets/36d45053-5595-4758-b515-7a8c854a3986"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **UI Updates**
* Updated label form terminology to refer to "fleets" instead of "teams"
throughout the label management interface
* Modified field names, labels, and help text to use consistent
fleet-related language
* Updated copy on the Edit Label page to mention fleets when applicable
  * Streamlined form field layout for improved presentation

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44770)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-11 16:50:49 +02:00
Juan Fernandez 7742c82eb7 Fix upcoming activity count not refreshing after host software install (#37012) 
Resolves #37012

Invalidate the upcoming-activities cache on software install/uninstall.
 2026-05-11 10:38:20 -04:00
Nico 714ae967fe Fix: SCIM user creation 500s when host already has a SCIM mapping (#44275) 
**Related issue:** Resolves #43656

## Summary

When a new SCIM user is associated to a host that was previously
associated to another SCIM user (different username/email), we the
host_scim_user record is upserted with the new SCIM user's ID (instead
of 500ing).

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

Setup:

- Host associated with a SCIM user. I first enrolled a Linux host with
end user authentication enabled, and logged in with
**nico+testeua@fleetdm.com**. This creates a record in the
**mdm_idp_accounts** table.
- Provisioned the **nico+testeua@fleetdm.com** user from Okta to Fleet
by following this guide:
https://fleetdm.com/guides/foreign-vitals-map-idp-users-to-hosts#step-1-create-application-in-okta.
This creates records in **scim_users** and **host_scim_user** tables.

<img width="705" height="269" alt="Screenshot 2026-05-11 at 10 22 33 AM"
src="https://github.com/user-attachments/assets/1f1a03ee-494c-4b09-a020-fe38b73a6b0b"
/>

<img width="502" height="136" alt="Screenshot 2026-05-11 at 10 26 59 AM"
src="https://github.com/user-attachments/assets/42cd84d7-0a43-4937-90ed-0dbb0066ff32"
/>




#### Before (main branch)

- Changed **username** to **nico+test500main** and **email** to
**nico+test500main@fleetdm.com** on the **mdm_idp_accounts** record from
the setup.
- Replayed the **POST /api/v1/fleet/scim/Users** request from the Setup,
but modified **username** and **email** to
**nico+test500main@fleetdm.com**. This reproduced the 500.

<img width="1201" height="599" alt="Screenshot 2026-05-11 at 10 30
26 AM"
src="https://github.com/user-attachments/assets/abd4541a-b900-4171-9cee-03c7780045a0"
/>

#### After

Performed the same steps as above, now with **nico+test500**:

Request:
<img width="1235" height="708" alt="Screenshot 2026-05-11 at 10 26
42 AM"
src="https://github.com/user-attachments/assets/ef0fde5e-7b2f-48af-ac4b-ed2897a4e54b"
/>

UI:
<img width="697" height="294" alt="Screenshot 2026-05-11 at 10 27 46 AM"
src="https://github.com/user-attachments/assets/2c033f1c-483c-43c5-b901-d949a24a8a5a"
/>

DB: **scim_users** table contains both records and **host_scim_user**
mapping was updated to the new scim_user ID.
<img width="795" height="159" alt="Screenshot 2026-05-11 at 10 26 53 AM"
src="https://github.com/user-attachments/assets/73ecfcd7-d6be-4e47-90ea-760d5f6d6cc3"
/>
<img width="501" height="134" alt="Screenshot 2026-05-11 at 10 27 05 AM"
src="https://github.com/user-attachments/assets/a24140f9-070f-4236-b80d-910a21504efd"
/>



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed HTTP 500 errors on the SCIM Users endpoint when associating a
user with a host that already had an existing SCIM user mapping; host
mappings are now reassigned to the newly created SCIM user as needed.

* **Tests**
* Added a test ensuring creating a second SCIM user for the same host
succeeds and does not create duplicate host–user mappings.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44275)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-11 16:28:46 +02:00
Sharon KatzandCopilot Autofix powered by AI 89517cce2f Warn when labels key appears in no-team/unassigned GitOps files (#44865) 
Closes #42522

## Changes

When `labels:` appears in a no-team/unassigned GitOps file, log a
warning and skip label parsing. This matches the existing pattern used
by `agent_options` and `reports` in no-team files.

A warning (not an error) is used intentionally to avoid breaking
existing customer GitOps pipelines that may already have `labels:` in
their no-team file.

**After fix:**
```
[!] 'labels' is not supported in unassigned.yml. This key will be ignored.
```

## Testing

### Manual testing

Built `fleetctl` from the fixed branch against a local Fleet server
(premium license).

| Scenario | Result |
|---|---|
| `unassigned.yml` dry-run | Warning printed, succeeds |
| `unassigned.yml` real run | Warning printed, succeeds |
| `no-team.yml` dry-run | Warning printed, succeeds |
| `no-team.yml` real run | Warning printed, succeeds |
| `unassigned.yml` without labels | No warning, succeeds (no regression)
|

### Unit tests

- **`TestLabelsIgnoredInNoTeamFile`**: Sub-tests for both `no-team.yml`
and `unassigned.yml` assert: (1) no error, (2) `LabelsPresent` is true,
(3) no labels parsed, (4) warning logged.

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-05-11 09:54:59 -04:00
Lucas Manuel Rodriguez 04d773f10f Fix get policy by id endpoint and unify access in UI (#45048) 
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/44949.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [X] Confirmed that the fix is not expected to adversely impact load
test results.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Policy retrieval now correctly enforces team authorization, preventing
unauthorized cross-team access and ensuring team policies are returned
properly.

* **New Features**
* UI uses a unified policy access path for viewing/editing policies,
improving consistency for inherited/team-scoped policies,
back-navigation, and fleet-name display (All fleets / No team).

* **Tests**
* Added unit and integration tests covering cross-team access rules and
that policy automation fields are populated when policies are returned.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-11 09:39:52 -03:00
Jonathan Katz d439cb1690 Fix missing deleted_policy activity for auto-cleaned patch policies (#45045) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44286

Unset `patch_software_title_id` rather than deleting the policy in
`BatchSetSoftwareInstallers`, so the orphaned policy gets picked up by
the `policiesToDelete` loop in `server/service/client.go:3121`. As a
result, the `deleted_policy` activity is now created properly, and
gitops dry/real runs also report the deletion:

```
dry run:
[-] would've deleted policy macOS - 010 Editor up to date
[-] would've deleted 1 policy

real run:
[-] deleting policy macOS - 010 Editor up to date
[-] deleting 1 policy
[-] deleted 1 policy
```

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed missing deletion activity logs when patch policies are removed
via GitOps so policy deletion events are now recorded.

* **Behavior Changes**
* Batch-updating installers now retains obsolete patch policies but
clears their patch installer reference instead of deleting the policy.

* **Tests**
* Added integration coverage to verify deletion activities are emitted
and installer batch behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-09 00:33:00 -04:00
Magnus Jensen c85d40636e Fix gitops controls set criteria (#45007) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #NA

Found this while just browsing the codebase and testing some gitops
stuff.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed GitOps controls detection to correctly identify when controls
are set with specific configurations, including BitLocker PIN
requirements.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-08 22:43:09 +02:00
RachelElysia d2033df253 Fleet UI: Fix export button dependencies (#45020) 2026-05-08 15:32:37 -04:00
Juan Fernandez f60ce942f8 Make activity list end-date filter consistent (#38437) 
Resolves #38437 

The list activities endpoint applied an implicit `created_at <= now` cap
only when `start_created_at` was set, leaving the upper bound unbounded
in every other case, this was changed so that we now apply that cap
unconditionally and override only when the caller passes an explicit
`end_created_at` (as peer the REST docs).
 2026-05-08 15:29:59 -04:00
Jordan MontgomeryCopilot Autofix powered by AIcoderabbitai[bot]
 		99babf436a Don't write the secret.txt when the secret is the dummy placeholder value (#45041) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44826

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [x] Confirmed that the fix is not expected to adversely impact load
test results


## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Windows MSI builds now correctly exclude placeholder secret values
during installation, preventing unnecessary dummy configuration files
from being created.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
 2026-05-08 15:26:33 -04:00
Magnus Jensen ea3513a1e7 always assign profile to missing devices due to replica lag (#45008) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44980

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually (Not, outside of tests
due to exercising replica lag is difficult)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Bug Fixes**
* Improved reliability of device profile assignment by ensuring all
devices receive profiles consistently, even when replica lag affects
device synchronization from Device Enrollment Program services.

* **Tests**
* Added test coverage validating device profile assignment behavior
under replica lag scenarios.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-08 15:33:36 +02:00
Magnus Jensen 034691966f check push cert staleness after 5 minutes of in-memory cache time (#44919) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44376 

I opted for an in-memory cache here, as it's not a critical cache piece,
we are fine with the cache being different times on different containers
(just means some might rotate to the correct cert faster than 5
minutes).
It's also a small piece of work, rather than pulling in redis etc.

Verified that it now logs, if the cert is stale after a 5 minute
in-memory cache.
```
ts=2026-05-07T11:30:08Z level=info msg="push certificate is stale after re-checking" topic=com.apple.mgmt.External.34c4a9b0-6501-4ce6-afc6-32eac6420ee7 staleToken="\x90C\xe4K\xc6a\x97\xb5?\x1b\x9a\x04'\xe7b\x8d" newHash=".fP\xc7O7\xab\xab\x9d\x92\xd5#\xe4u\xe0\xf6"
ts=2026-05-07T11:30:08Z level=info component=apple-mdm-push msg="retrieved push cert" topic=com.apple.mgmt.External.34c4a9b0-6501-4ce6-afc6-32eac6420ee7
```

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* APNs push certificates now refresh in-memory when rotated; staleness
is detected using certificate checksums with a short grace window.

* **Tests**
* Added tests for certificate retrieval, staleness detection/refresh
behavior, and push-cert storage error handling.

* **Documentation**
* Updated docs to describe the APNs push-certificate refresh and
staleness behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-08 11:02:22 +02:00
Sharon Katz f3f830bd9d Fix GitOps failure when moving labels from global to fleet scope (#44983) 
Closes #44950

## Local reproduction

Reproduced locally using a MySQL integration test against the local test
database. The test simulates the exact GitOps scenario from the issue:

1. Create a label and associate it with an MDM profile
2. Delete the label (FK `ON DELETE SET NULL` sets `label_id = NULL`)
3. Create a new label with the **same name** (simulates moving from
global to fleet scope)
4. Call `batchSetProfileLabelAssociationsDB` with the profile
referencing the new label

**Before fix** (code from `main`, unfixed):
```
$ MYSQL_TEST=1 go test -run "TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated" -v -count=1 ./server/datastore/mysql/...

=== RUN   TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_darwin
    Error: selecting existing profile labels: sql: Scan error on column index 1, name "label_id": converting NULL to uint is unsupported
=== RUN   TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_windows
    Error: selecting existing profile labels: sql: Scan error on column index 1, name "label_id": converting NULL to uint is unsupported
--- FAIL: TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_darwin (0.02s)
--- FAIL: TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_windows (0.02s)
FAIL
```

**After fix:**
```
$ MYSQL_TEST=1 go test -run "TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated" -v -count=1 ./server/datastore/mysql/...

=== RUN   TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_windows
=== RUN   TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_darwin
--- PASS: TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_windows (0.03s)
--- PASS: TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_darwin (0.03s)
PASS
ok  github.com/fleetdm/fleet/v4/server/datastore/mysql  2.761s
```

## Code changes

When a label is deleted, MySQL's `ON DELETE SET NULL` foreign key
constraint automatically sets `label_id = NULL` in the profile-label
association row. The Go code then crashes trying to scan that NULL into
a `uint` field.

- **`server/datastore/mysql/mdm.go`** — Added `COALESCE(label_id, 0)` to
the SELECT in `batchSetProfileLabelAssociationsDB`, so that NULL
`label_id` values are returned as 0 instead of causing a scan error when
Go tries to read NULL into a `uint`.
- **`server/datastore/mysql/apple_mdm.go`** — Same `COALESCE(label_id,
0)` fix in `batchSetDeclarationLabelAssociationsDB`. Also added `OR
label_id IS NULL` to the DELETE statement to clean up broken rows,
matching the profile labels behavior from #42637.

Other queries in the same codebase (e.g.,
`listProfileLabelsForProfiles`) already use `COALESCE(label_id, 0)` —
these two were missed.

## Testing

- `same_label_name_recreated_after_deletion_{darwin,windows}` —
reproduces the exact bug: associates a profile with a label, deletes the
label (NULL label_id), creates a new label with the same name, and
verifies `batchSetProfileLabelAssociationsDB` succeeds, the broken row
is cleaned up, and the correct label association exists
- Full MDM test suite passes: `MYSQL_TEST=1 go test -run "TestMDM"
./server/datastore/mysql/...` (76s)
- `make lint-go-incremental` passes
 2026-05-08 07:49:23 +02:00
Konstantin SykulevandCopilot Autofix powered by AI e15f37d4e0 Optimize OSV vulnerability scanning (#44684) 
**Related issue:** Resolves #44391

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually


I tested this locally 
number of ubuntu hosts: 6,252
average software per host: 2,302
distinct software items: 61,213
host_software rows: 14.4M
generates software_cve rows 305,826
OS sub-versions: 25

The time before my optimization **10m53s** down to **4m26s** the
optimization.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Optimized OSV vulnerability scanning to aggregate work by OS version
and batch lookups, reducing redundant queries for faster scans.

* **Refactor**
* Restructured scanning flow to process OS versions in batched chunks
with clearer logging and early exits when no work is required.

* **Tests**
* Added tests for querying, batching, source filtering, deduplication,
and empty-input behaviors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-05-07 22:21:22 -06:00
Konstantin Sykulev 361a5a402e Creating product index to speed up vulnerability scanning (#44910) 
**Related issue:** Resolves #44391

# Checklist for submitter

If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing
- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Added release notes documenting vulnerability scanning performance
improvements

* **Refactor**
* Optimized vulnerability scanning performance through enhanced CVE
product matching efficiency

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-07 22:20:58 -06:00
Tim Lee dc0c7bd72f Recover stuck SCEP managed-cert state via matcher extension (#44691) 2026-05-07 11:52:25 -06:00
Juan Fernandez 2c7bb2f6eb Fix SSO invite acceptance error when accepting invitation (#34103) 
Resolves #34103 

The SSO invite acceptance page submitted a create-user request without
the invitee's email, because it read `email` from the URL query string
which the invite email link never populates. To resolve this the email
was loaded by calling GET /api/_version_/fleet/invites/{token} endpoint.

As part of this fix, the ConfirmSSOInvite components were refactored
from 'classical' components to functional components.
 2026-05-07 12:25:24 -04:00
Allen Houchins 83b746cc15 Create fleetctl pkg asset every release (#35089) 2026-05-07 10:04:07 -05:00
Juan Fernandez 292bab32f6 Clarify SMTP TLS error and surface STARTTLS toggle (#34104) 
Resolves #34104 

When saving SMTP settings with SSL/TLS off, STARTTLS on, and SSL cert
verification on, the test-email send produced an opaque Go cert error
that gave users no actionable hint. The two TLS-related toggles also
live on different settings cards with no cross-reference, which made the
conflict hard to spot before hitting Save.
 2026-05-07 10:24:18 -04:00
Andrew Mellor 119feeda02 42218 updated ios version number to include supplemental extra (#44727) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #42218

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

Note: Sim update included and validated with and without supplemental,
screen shots attached

<img width="760" height="87" alt="Host List"
src="https://github.com/user-attachments/assets/c55f0ace-a205-4242-95da-510e8e6ec4ad"
/>
<img width="1511" height="523" alt="Standard"
src="https://github.com/user-attachments/assets/74a42e57-9391-4ce0-8b0a-ad3de6ab4745"
/>
<img width="1505" height="526" alt="Supplimental"
src="https://github.com/user-attachments/assets/392fc603-c7a2-4d6f-8ae0-87767cab7e3c"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* iOS/iPadOS devices managed via MDM now include reported supplemental
OS version text (e.g., Rapid Security Response suffixes) in the
displayed OS version string.
* **Bug Fixes**
* Supplemental extras are validated; invalid values are ignored.
Combined version strings are length-limited and safely truncated.
* **Tests**
* Added tests for supplemental handling, validation, fallback, and
truncation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-07 15:16:31 +01:00
Nico d8a1ffae81 Clear stale broken label rows on profile batch upsert (#44847) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #42637

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

### Reproduction steps:

- Created Label X and Label Y as manual labels in the UI.
- Applied gitops referencing the labels. The specified profile
referenced Label X:

```yaml
macos_settings:
    custom_settings:
      - path: ../repro-42637-profile.mobileconfig
        labels_exclude_any:
          - "Repro Label X 42637"
```

- Manually ran a SQL query to update `label_id` to NULL.

<img width="712" height="46" alt="Screenshot 2026-05-06 at 6 19 51 PM"
src="https://github.com/user-attachments/assets/32f386c7-adf3-48e8-adee-03102831e556"
/>


- Re-ran gitops referencing Label Y in the profile config.

```yaml
macos_settings:
    custom_settings:
      - path: ../repro-42637-profile.mobileconfig
        labels_include_any:
          - "Repro Label Y 42637"
```

- Old row was preserved AND a new one was created (association to Label
Y):

<img width="709" height="68" alt="Screenshot 2026-05-06 at 6 22 07 PM"
src="https://github.com/user-attachments/assets/fe2c4644-eb95-45a0-a582-994ad88e45be"
/>

### Testing steps

- Re-built fleetctl with the fix applied and re-ran gitops, still
referencing Label Y for the profile.
- Confirmed the orphan row was deleted.

<img width="740" height="212" alt="Screenshot 2026-05-06 at 6 24 43 PM"
src="https://github.com/user-attachments/assets/da9e9461-c352-4266-80b8-625a98e055ec"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Bug Fixes
* Fixed an issue where MDM configuration profiles would remain enforced
on hosts after their associated labels were deleted during fleetctl
gitops apply operations. Label associations are now properly cleared
when profiles are reapplied with updated targeting.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-07 16:10:15 +02:00
Juan Fernandez 0147f6cde2 Fix IdP department host vital missing when SCIM PATCH carries extra attrs (#41996) 
Resolves #41996 

Some IdPs push SCIM PATCH operations that bundle `department` with other
RFC 7643 §4.3 enterprise attributes that Fleet does not store. Before
this change the SCIM library rejected those payloads with a 400 because
the schema only declared 'department'.

An environment variable was added (FLEET_DEBUG_SCIM_PAYLOADS) for aiding
in further debugging this if the issue persist.
 2026-05-07 08:34:36 -04:00
Magnus Jensen 9d96d6c76a add script output to GitOps (#44728) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44082

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Enhanced GitOps script logging: reports how many scripts would be
applied in dry‑run mode or were actually applied, with per-team and
per-fleet breakdowns.

* **Tests**
* Added test coverage validating logging output for both dry‑run and
real execution, ensuring reported script counts and per-team/fleet
messages are accurate.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-07 09:38:25 +02:00
Scott Gress 917ce99324 Allow disabling chart datasets: frontend (#44797) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** For #44077 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased

## Testing

- [X] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
### Manual QA — Chart disabling (frontend)

  Setup notes:
  - Test as a global admin and (where indicated) a fleet admin
  - Need a Premium deployment to test per-fleet behavior
  - Have at least one fleet (e.g. "Engineering") for fleet-scoped checks
- Be able to flip
`appConfig.features.historical_data.{uptime,vulnerabilities}` and the
equivalent per-fleet keys (via API or settings UI)

  #### Advanced settings page — `/settings/organization/advanced`

  - [ ] "Activity & data retention" subheading appears on the page
  - [ ] Section contains a "Disable hosts online" checkbox
  - [ ] Section contains a "Disable vulnerabilities" checkbox
  - [ ] Section is visible on Free tier
  - [ ] Section is visible on Premium tier
- [ ] With `historical_data.uptime = true` in appConfig, "Disable hosts
online" loads **unchecked**
- [ ] With `historical_data.uptime = false` in appConfig, "Disable hosts
online" loads **checked**
- [ ] With `historical_data.vulnerabilities = false` in appConfig,
"Disable vulnerabilities" loads **checked**
- [ ] Saving with "Disable hosts online" checked sends
`features.historical_data.uptime = false` in the `PATCH
/api/v1/fleet/config` payload (verify in network tab)
- [ ] Saving with "Disable vulnerabilities" unchecked sends
`features.historical_data.vulnerabilities = true`

  #### Per-fleet settings page (Premium only)

  - [ ] Fleet settings page shows an "Activity & data retention" section
- [ ] Section contains "Disable hosts online" and "Disable
vulnerabilities" checkboxes scoped to the active fleet
- [ ] On **Free** tier, the per-fleet TeamSettings page is not reachable
(and therefore the section is not visible)
  - [ ] On **Premium** tier, the section is visible to fleet admins
- [ ] Saving with "Disable vulnerabilities" checked sends
`features.historical_data.vulnerabilities = false` in `PATCH
/api/v1/fleet/teams/{id}` (verify in network tab)

  #### Per-fleet checkbox locks when global is disabled

- [ ] With global `historical_data.uptime = false`, fleet's "Disable
hosts online" is **disabled / non-interactive**
- [ ] Hovering the locked fleet checkbox shows the tooltip "Disabled
globally"
  - [ ] **Stored value preserved across lockout**:
    - [ ] Set fleet `historical_data.uptime = false` (saved)
- [ ] Then set global to `false` — fleet checkbox renders **checked but
disabled**
- [ ] Flip global back to `true` — fleet checkbox renders **checked and
interactive** (fleet's `false` survived the round trip)

  #### Confirmation modal on Save (both global and per-fleet)

- [ ] Loading with `uptime = true`, then checking "Disable hosts online"
and clicking Save → modal opens listing **"Hosts online"**
  - [ ] No PATCH is issued until the user confirms
- [ ] No-op save (page loaded with `uptime = false`, no changes, click
Save) → modal does **not** open
- [ ] Re-enable (page loaded with `uptime = false`, uncheck "Disable
hosts online", Save) → modal does **not** open; PATCH is issued
- [ ] Disabling **both** datasets at once → modal lists **both** "Hosts
online" and "Vulnerabilities"
- [ ] Modal "Save and disable" button issues the PATCH and modal closes
once it resolves successfully
- [ ] Modal Cancel closes the modal, no PATCH is issued, checkboxes
remain checked (form state unchanged, ready to retry or revert)

  #### Confirmation modal copy by scope

- [ ] Modal opened from Advanced page → body describes the change as
affecting the **entire Fleet deployment**
- [ ] Modal opened from fleet "Engineering" settings → body **references
"Engineering" by name** and describes the change as affecting **only
that fleet**

  #### GitOps mode lockout

  - [ ] With GitOps mode enabled, on `/settings/organization/advanced`:
    - [ ] "Disable hosts online" is disabled with the GitOps tooltip
    - [ ] "Disable vulnerabilities" is disabled with the GitOps tooltip
  - [ ] With GitOps mode enabled, on a fleet's settings page:
    - [ ] "Disable hosts online" is disabled with the GitOps tooltip
    - [ ] "Disable vulnerabilities" is disabled with the GitOps tooltip
- [ ] When **both** GitOps mode and "Disabled globally" would apply, the
fleet checkbox shows the **GitOps tooltip** (GitOps wins)

  #### Dashboard chart card — empty state

- [ ] With `appConfig.features.historical_data.uptime = false`, viewing
dashboard in "All teams" with the **uptime** dataset selected →
visualization area shows the **"Data collection disabled"** empty state
- [ ] Dataset selector, time range selector, and filter gear remain
visible **and functional** while the empty state is shown
- [ ] With global `vulnerabilities = true` but the active fleet's
`historical_data.vulnerabilities = false`, viewing the dashboard scoped
to that fleet with a vulnerabilities-driven dataset selected → empty
state shown
- [ ] With both global and fleet sub-keys `true` (or fleet sub-key
absent in All-teams scope) → visualization renders normally; empty state
does **not** appear
- [ ] Switching from a disabled dataset (A) to an enabled dataset (B)
replaces the empty state with B's visualization
- [ ] A dataset whose internal name has no `DATASET_CONFIG_KEY` mapping
renders normally (no empty state — implicitly enabled)

  #### Empty-state content

- [ ] When the empty state is rendered for the "Hosts online" dataset,
"Hosts online" appears as the dataset name
- [ ] Link text describes re-enabling collection (e.g. "Manage data
collection in Advanced settings")
- [ ] Empty state includes a link to `/settings/organization/advanced`
when viewing All Fleets as a global admin
- [ ] Empty state includes a link to the correct Fleet settings page
when viewing a specific fleet as a global or team admin
- [ ] Empty state includes no link or call to action when viewed as a
non-admin

  #### Activity feed rendering

- [ ] `enabled_historical_dataset` with `dataset = "uptime"`, `fleet_id
= null` → renders **"Enabled data collection for Hosts online."**
("Hosts online" bolded)
- [ ] `disabled_historical_dataset` with `dataset = "vulnerabilities"`,
`fleet_id = null` → renders **"Disabled data collection for
Vulnerabilities."**
- [ ] `enabled_historical_dataset` with `dataset = "uptime"`, `fleet_id
= 7`, `fleet_name = "Engineering"` → renders **"Enabled data collection
for Hosts online for the Engineering fleet."**
- [ ] `disabled_historical_dataset` with `dataset = "vulnerabilities"`,
`fleet_id = 7`, `fleet_name = "Engineering"` → renders **"Disabled data
collection for Vulnerabilities for the Engineering fleet."**
- [ ] `disabled_historical_dataset` with an **unknown** `dataset =
"policy_compliance"` → does **not** throw; renders **"Disabled data
collection for Policy compliance."** (raw key sentence-cased — `_` →
space, first letter capitalized)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Org- and team-level controls to enable/disable historical data
collection for "Hosts online" and "Vulnerabilities."
  * Updated chart label: "Hosts active" → "Hosts online."
* Confirmation modal and a disabled-state UI when data collection is
turned off; per-team confirmation flow to prevent accidental data loss.
* Activity feed now records enable/disable actions for historical
dataset collection with readable dataset labels and scope.

* **Tests**
* Added comprehensive tests for controls, confirmation flows, disabled
states, chart headings, and activity items.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-06 16:28:37 -05:00
Magnus JensenandLucas Manuel Rodriguez d3775bda86 Check device auth token individual before querying host tables on auth (#44817) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
Resolves #44816.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## Summary by CodeRabbit

* **Performance**
* Improved device authentication efficiency by optimizing token
resolution, reducing database load for both valid and invalid token
scenarios in Fleet Desktop.

* **Tests**
* Added comprehensive test coverage for device authentication fast-fail
scenarios, including handling of non-existent tokens, expired tokens,
and edge cases.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-05-06 16:55:35 -03:00
Victor Lyuboslavsky c79d33a3a6 Add support for SAN in Android certificate templates. (#44690) 
2/3rds of this PR is OpenSpec and tests. Use OpenSpec files as a
reference (if needed). They're there to help the review, and not to be a
review surface themselves.

- Backend implementation for `subject_alternative_name` in certificate
templates.
- Includes schema migration, variable expansion, GitOps support.
- Limits SAN types to `DNS`, `EMAIL`, `UPN`, `IP`, and `URI`.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41472 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.

## New Fleet configuration settings

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Android certificate templates support Subject Alternative Name (SAN)
with validation (DNS, EMAIL, UPN, IP, URI), Fleet-variable substitution,
runtime expansion, and delivery; SAN use is gated by Premium license
  * GitOps now validates and includes SAN in Android certificate flows

* **Chores**
  * Database schema updated to store SAN on certificate templates
  * Changelog entry added

* **Tests**
* Added unit and end-to-end tests covering SAN validation, variable
expansion, and GitOps behavior
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-06 14:43:09 -05:00
Marko LisicaandCarlo e988dd4756 Support VPP apps from non-US App Store regions (#44368) 
**Related issue:** Resolves #43846

---------

Co-authored-by: Carlo <1778532+cdcme@users.noreply.github.com>
 2026-05-06 12:01:07 -04:00
Nico 55d63e9100 Dark mode tweaks: error pages text contrast, dropdown borders, table corners (#44771) 
**Related issue:** N/A — ad-hoc dark-mode polish (revives fixes from the
closed #43675)

## Summary

- **Error pages (403/404/500)**: replaced hardcoded `#333` body text
with `$core-fleet-black` so the copy adapts to dark mode.
- **Dropdown menu border**: added border to `ActionsDropdown` ONLY in
dark mode (light mode already has a box-shadow which in dark mode is
basically not visible so it's hard to distinguish what's in front and
what's behind when opening a dropdown).
- **Table bottom-right corner**: tables such as UsersTable have the
Actions dropdown in the last cell, and I think this made the
bottom-right corner to be cut because of a missing border-radius on the
inner cell that matches the table's border radius.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually

| # | Before | After |
  |---|--------|-------|
| Not found page | <img height="700" alt="Screenshot 2026-05-06 at 3 43
44 PM"
src="https://github.com/user-attachments/assets/c52b7bf8-6c5e-4e2e-8635-6f660c59ee90"
/> | <img height="700" alt="Screenshot 2026-05-06 at 3 35 03 PM"
src="https://github.com/user-attachments/assets/e92c324f-92a9-4e5e-a048-ab2b1d3c87a3"
/> |
| Access denied page | <img height="700" alt="Screenshot 2026-05-06 at 3
43 58 PM"
src="https://github.com/user-attachments/assets/9093f51a-e8ce-495b-9820-37ab5a7ff4cf"
/> | <img height="700" alt="Screenshot 2026-05-06 at 3 34 54 PM"
src="https://github.com/user-attachments/assets/3b9fe930-0ba1-4d48-824b-1b2cda713211"
/> |
| ActionsDropdown border + Table bottom corners (*) | <img height="700"
alt="Screenshot 2026-05-06 at 3 46 35 PM"
src="https://github.com/user-attachments/assets/c16b5a52-4746-4603-9f26-92be82f24225"
/> | <img height="700" alt="Screenshot 2026-05-06 at 3 31 33 PM"
src="https://github.com/user-attachments/assets/0a77cc95-40c4-43d2-9c6b-24c81782b275"
/> |
  
(*) Note that in the Users table, which has the Actions dropdown, the
right bottom corner is cut because the inner element doesn't respect the
table's border radius. Fixed this by adding the same border-radius to
that cell.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed a display issue where data table bottom-right corners were being
cut off, ensuring complete visibility of table content.
* Improved dark mode contrast and readability on error pages (403, 404,
and 500 errors).

* **New Features**
* Added visual borders to dropdown menus for improved clarity and user
interaction feedback.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-06 16:41:46 +02:00
Nico fd3ec5a9aa Add SVG support for custom organization logos (#44748) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Follow-up to #44390 (BE/FE) and #44550 (GitOps).
Parent story #39016.

## Summary

Accepts `.svg` for organization logo uploads in addition to
PNG/JPEG/WebP, with strict server-side validation since SVGs can carry
scripts.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually



https://github.com/user-attachments/assets/318d320e-ff78-41fe-ad3a-55d6dace8dc0



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Organization logos now accept SVG in addition to PNG, JPEG, and WebP.
  * Stored SVG logos are re-validated when served.

* **Security**
* Server applies strict SVG sanitization to block scripts, unsafe
elements, event handlers, and unsafe URL schemes.
* SVG logo responses include headers to prevent content-type sniffing
and restrict execution.

* **Tests**
* Added tests covering SVG detection, validation, allowed/rejected
cases, and serving behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-06 15:20:53 +02:00
Magnus Jensen 7e8994d6db CSAH: clear state on ABM re-enrollment (#44722) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43945 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Configurable option to preserve past host activity history during
Apple Business Manager re-enrollment.
* Re-enrollment can perform a targeted reset of host MDM state and
upcoming activities when preservation is disabled.
* Token-update flow now conditionally triggers the reenrollment reset
based on device/migration state and the preserve flag.

* **Bug Fixes**
* Host vitals and host-scoped data are cleared on ABM re-enrollment when
preservation is disabled.
* Reset is skipped during specific migration scenarios to avoid
disruption.

* **Tests**
* Added tests and mocks validating reset behavior, the preservation
flag, and migration-based skip logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-06 09:57:58 +02:00
Carlo b9933f45a2 Fix gitops 500 when software title icon bytes are missing (#44735) 
Fixes #43511
 2026-05-05 18:47:16 -04:00
Lucas Manuel RodriguezandCopilot Autofix powered by AI e9334bc666 Update changelog for fleetd 1.55.0 release (#44733) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved error handling for Windows registry enumeration to prevent
failures from malformed entries.

* **Chores**
* Removed debugging symbols from Orbit and Fleet Desktop executables for
optimized builds.
* Updated macadmins/osquery-extension dependency to v1.4.1, adding
network_quality table support.
  * Updated Go runtime to version 1.26.2.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-05-05 19:18:08 -03:00
Sharon Katz 1c522097d0 Fix missing GitOps label validation for invalid field combinations (#44410) 
**Related issue:** Closes #34229

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

---

`fleetctl gitops` silently accepted labels with invalid parameter
combinations (e.g. manual labels with query/criteria/platform). Added
per-type field validation in a centralized
`fleet.ValidateLabelMembershipFields` function, called from the GitOps
parser, `ApplyLabelSpecs`, and `NewLabel`.

| Type | Allowed | Now rejects |
|------|---------|-------------|
| `manual` | `name`, `description`, `hosts` | `query`, `criteria`,
`platform` |
| `dynamic` | `name`, `description`, `query`, `platform` | `criteria`,
`hosts`; validates platform value |
| `host_vitals` | `name`, `description`, `criteria` | `query`,
`platform`, `hosts` |

### Automated tests

- `TestLabelInvalidFieldCombinations` in `pkg/spec/gitops_test.go` — 17
sub-tests covering every invalid combination per label type, plus 3
valid happy-path cases.
- `TestNewLabelFieldValidation` in `server/service/labels_test.go` — 4
cases for NewLabel validation.
- `TestApplyLabelSpecsManualLabelNilHosts` — 10 sub-cases for
ApplyLabelSpecs field validation.
- `TestWhenCreatingNewLabelsPlatformIsValidated` — platform validation
across NewLabel and ApplyLabelSpecs.

All existing `pkg/spec` and `server/service` label tests pass.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Labels now reject invalid field combinations for manual, dynamic, and
host_vitals types with clear error responses instead of failing
silently.
* **Tests**
* Added comprehensive tests covering valid and invalid label
configurations across membership types.
* **Documentation**
  * Changelog entry describing the behavioral fix.  
* **Chores**
* Removed an unnecessary platform constraint from a label configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---

### Manual test results

Ran against a local Fleet server with the built binary.

**API - NewLabel (POST /api/latest/fleet/labels)**

| Test | Input | Expected | Result |
|------|-------|----------|--------|
| 1 | manual + platform=darwin | 422, field=`platform` | PASS |
| 2 | dynamic + platform=invalidplatform | 422, field=`platform` | PASS
|
| 3 | dynamic + platform=darwin + query | 200 | PASS |
| 4 | manual (no platform) | 200 | PASS |
| 5 | host_vitals + platform=darwin | 422, field=`platform` | PASS |
| 6 | dynamic + whitespace-only query | 422, field=`query` | PASS |

**API - ApplyLabelSpecs (POST /api/latest/fleet/spec/labels)**

| Test | Input | Expected | Result |
|------|-------|----------|--------|
| 7 | manual + query | 422, field=`query` | PASS |
| 8 | dynamic + hosts | 422, field=`hosts` | PASS |
| 9 | valid dynamic | 200 | PASS |

**Round-trip: get labels --yaml then apply**

| Test | Scenario | Result |
|------|----------|--------|
| 10 | Legacy manual label with platform=darwin in DB | Platform
stripped from YAML, re-apply succeeds — PASS |
| 11 | Dynamic label with platform=darwin | Platform preserved in YAML,
re-apply succeeds — PASS |

**GitOps parser (fleetctl gitops --dry-run)**

| Test | Input | Result |
|------|-------|--------|
| 12 | manual + query + platform + criteria | All 3 errors surfaced at
once — PASS |
| 13 | valid manual label | No validation errors — PASS |
| 14 | dynamic + invalid platform | Error surfaced — PASS |

---

### Code walkthrough

**`server/fleet/labels.go`** — Added
`ValidateLabelMembershipFields(*LabelSpec) *InvalidArgumentError`. This
is the single source of truth for label field validation, returning
field-specific errors (`platform`, `query`, `criteria`, `hosts`). Lives
here because this package defines the label types both callers import.
Also uses `strings.TrimSpace` to reject whitespace-only queries.

**`server/service/labels.go`** — Three changes: (1) Removed the early
blanket platform check from `NewLabel` that ran before the membership
type was known. (2) Added `ValidateLabelMembershipFields` call in
`NewLabel` after type inference, so the API rejects invalid combos at
creation time. (3) Replaced three incomplete inline checks in
`ApplyLabelSpecs` with a single call to the centralized function, using
`err.WithStatus(422)` to preserve field-specific error shape in the API
response.

**`pkg/spec/gitops.go`** — Replaced the inline validation switch and a
standalone `ValidLabelPlatformVariants` check with a call to
`ValidateLabelMembershipFields`. Unwraps the returned errors
individually into `multiError` so all validation problems are reported
to the user at once.

**`cmd/fleetctl/fleetctl/generate_gitops.go`** — Gated platform emission
on `LabelMembershipTypeDynamic` so legacy manual/host_vitals labels with
a stored platform don't produce YAML that fails re-import.

**`cmd/fleetctl/fleetctl/get.go`** — Added `stripMismatchedLabelFields`
which clears type-inappropriate fields (query, platform, criteria,
hosts) per membership type before YAML output. Called in both code
paths: listing all labels and fetching a single label by name. Ensures
the `get labels --yaml` → `apply` round-trip works for legacy data.

**`server/datastore/mysql/labels.go`** — Added missing `l.criteria`
column to `GetLabelSpec` SELECT, matching `GetLabelSpecs`. Without it,
host_vitals labels fetched by name lost their criteria in the YAML
output, causing re-import to fail with the new validation.
 2026-05-05 16:19:41 -04:00
Juan Fernandez 7088dfa32c Add include_all label scope to GitOps and fleetctl (#41566) 
Resolves #41566 

Wires labels_include_all to GitOps and fleetctl for policies and reports.
 2026-05-05 15:13:22 -04:00
Scott Gress e72c38ad60 Allow GitOps user to list software (#44721) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44696

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] reproduced issue on main branch (with software exceptions on and
policies with software automation, `fleetctl gitops` failed for a gitops
user with a 403)
- [X] verified issue fixed on this branch -- `fleetctl gitops` synced
successfully

For unreleased bug fixes in a release candidate, one of:

- [X] Confirmed that the fix is not expected to adversely impact load
test results


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Expanded GitOps permissions to read and list software inventory,
software titles, installable software, and maintained apps at both
global and team scopes; adjusted related read behaviors and
capitalization in messaging.
* **Tests**
* Updated and added authorization and integration tests to reflect the
new GitOps read/list behavior across software-related and maintained-app
endpoints, including team-scoped scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-05 13:27:57 -05:00
Magnus Jensen b6ffd30c6f fix UI elements in script library not respecting GitOps mode (#44743) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44196 



https://github.com/user-attachments/assets/4a013290-0089-4b98-86a6-544ca26d1896


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Script library UI now respects GitOps mode: editor is read-only and
save actions are disabled when enabled.
* Action buttons no longer inadvertently propagate clicks, preventing
unintended interactions in the script list.

* **Tests**
* Added tests verifying GitOps-mode behavior for edit/delete/download
actions and download handling without external calls.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-05 18:56:18 +02:00
Nico f2b2e23b0a GitOps changes for custom org's logo uploads (#44550) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44333

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests. Also added some integration tests
as a follow-up of the first PR
(https://github.com/fleetdm/fleet/pull/44390).

- [x] QA'd all new/changed functionality manually

#### generate-gitops

- Branched off to main, no URLs set, then ran generate-gitops on this
branch. Deprecated keys gone, new keys present.

<img width="447" height="170" alt="nourls_new"
src="https://github.com/user-attachments/assets/61931615-d61b-44d3-8095-f7a2b9bd8871"
/>

- Branched off to main, set external URLs for both light and dark modes,
then ran generate-gitops on this branch. Deprecated keys gone, new keys
set with the external URLs.

<img width="637" height="471" alt="externalurl_main"
src="https://github.com/user-attachments/assets/c3782756-acc2-4b99-812d-86e145f11ad5"
/>

<img width="459" height="168" alt="externalurl_new"
src="https://github.com/user-attachments/assets/aa2d8825-3c47-40ba-ab91-bb8202afe81a"
/>

- Within this branch, after uploading a custom logo for light mode, ran
generate-gitops. The logo was saved in lib/org_logo/light.webp

<img width="1510" height="639" alt="Screenshot 2026-05-04 at 4 06 59 PM"
src="https://github.com/user-attachments/assets/13318c24-8fa4-4e29-b629-ff723d4afe5a"
/>
<img width="786" height="172" alt="Screenshot 2026-05-04 at 4 07 30 PM"
src="https://github.com/user-attachments/assets/b46bd1df-7dcd-4489-b7da-4cbad77b25b8"
/>


#### gitops

- Applied gitops with two external URLs. Verified in the UI that those
are still present

<img width="944" height="189" alt="Screenshot 2026-05-04 at 7 54 53 AM"
src="https://github.com/user-attachments/assets/a34813ca-beb1-403e-9793-d42cc9c72f8b"
/>
<img width="637" height="259" alt="Screenshot 2026-05-04 at 8 01 04 AM"
src="https://github.com/user-attachments/assets/74c2cd56-ab1d-4ddd-9b8e-22c49e9ae9d5"
/>

- Applied gitops with "" as the URLs to clear them. Verified the default
fleet logo is shown.

<img width="460" height="201" alt="Screenshot 2026-05-04 at 8 15 11 AM"
src="https://github.com/user-attachments/assets/dcbafea3-b4ea-44aa-9045-08c4f5a64e98"
/>
<img width="648" height="269" alt="Screenshot 2026-05-04 at 8 15 50 AM"
src="https://github.com/user-attachments/assets/451a28f9-e929-4b84-93d3-a7dd9afd5eca"
/>

- Applied gitops with a custom logo for light theme, using
**org_logo_path_light_mode**:

<img width="948" height="207" alt="Screenshot 2026-05-04 at 4 10 05 PM"
src="https://github.com/user-attachments/assets/b1418cd4-31cc-4e53-b566-9af11ec21970"
/>
<img width="774" height="168" alt="Screenshot 2026-05-04 at 4 10 35 PM"
src="https://github.com/user-attachments/assets/63f596eb-308f-4122-ad86-e1d718e9b525"
/>



## New Fleet configuration settings

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- See https://github.com/fleetdm/fleet/pull/43808.
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* GitOps support for uploading custom org logos (dark/light) via local
files.
* `fleetctl generate-gitops` exports Fleet-hosted logos as local files
and inserts path references.
  * New API endpoints to upload, delete, and fetch org logos.

* **Deprecated**
* Legacy logo keys consolidated into mode-specific URL keys
(`org_logo_url_dark_mode`, `org_logo_url_light_mode`).

* **Bug Fixes / Validation**
* Validation/error when both a path and URL are provided for the same
mode; file size and image-format checks enforced.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-05 18:18:08 +02:00
Jordan MontgomeryCopilotLucas Manuel Rodriguez
 		227e94de5b 🤖 Chore: remove deprecated appendListOptionsWithCursorToSQL (#44385) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44723

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Strengthened validation of sorting/order parameters across many list
and cursor-based endpoints — unsupported sort keys now return explicit
errors and prevent unsafe queries.
* Labels listing: label-list pagination query name changed; ordering by
host_count is rejected when host counts are disabled (validated at
request parsing).

* **Tests**
* Added/expanded tests covering allowed order keys, rejection of unknown
keys, and pagination behavior for multiple listing APIs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-05-05 10:26:47 -04:00
RachelElysia 0448ac1f95 Fleet UI: Fix dataset text alignment (#44659) 2026-05-05 08:50:18 -04:00
Nico b4a207fb5a Add ability to upload custom org logos (#44390) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44330, Resolves #44331

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests. (I'd defer integration tests to a
separate PR since this one is pretty large already.)

- [x] QA'd all new/changed functionality manually. I've tested this on
both the setup flow and the organization settings page. I haven't had
the time to test this on other places where we render the logo (macOS
setup experience / MDM migration dialog).


https://github.com/user-attachments/assets/95d4eae5-3da6-40f4-98a1-8575b97d96b3

## New Fleet configuration settings

- [x] Setting(s) is/are explicitly excluded from GitOps.

Will handle GitOps in a separate PR.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Organizations can upload custom logos for light and dark modes.
* Registration and Org Settings support logo file upload, preview,
per-mode replace/delete, and validation (size & image formats).
* Activity feed records logo changes/deletions; site nav displays
uploaded logos per theme.
* File uploader/preview adds a Fleet logo graphic option and improved
logo validation.
  * Config/GitOps outputs now include separate dark/light logo fields.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-05 14:42:52 +02:00
Tim Lee 8d37ec690c Revert "Fix SCEP autorenew failing for offline hosts (#44250)" (#44535) 2026-05-04 13:33:42 -06:00