24e0ef47c8
Fix observer query bypass: prevent cross-team targeting (#40717)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #36093
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
# Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Queries/reports
### Team user with team report (observer_can_run = true)
Created user with the following assignments:
<img width="596" height="285" alt="Screenshot 2026-03-02 at 4 58 47 PM"
src="https://github.com/user-attachments/assets/a3a8e7dd-2bfc-40f9-948c-b26b016162ae"
/>
Created report on **Workstations (canary)** fleet with
**observers_can_run = true**
<img width="1020" height="711" alt="Screenshot 2026-03-02 at 5 09 25 PM"
src="https://github.com/user-attachments/assets/58aa98c7-8cbd-4a7a-a159-f4b40a65f2c9"
/>
Logged in with newly-created user, selected the report above to run it
as a live report.
- Verified that **Servers (canary)** is disabled => user is **Observer**
on that fleet, but query belongs to **Workstations (canary)**.
- All the other fleets are enabled:
- User is **Observer+ or more** in those fleets.
- User is **Observer** in **Workstations (canary)** => enabled because
report belongs to this fleet, AND **observer_can_run = true**.
<img width="986" height="823" alt="Screenshot 2026-03-02 at 5 07 29 PM"
src="https://github.com/user-attachments/assets/b6b7aa4b-5036-46e3-8497-3a77f93a3a2c"
/>
### Global user with team report (observer_can_run = true)
- Created global Observer user.
- Accessed same report created above for **Workstations (canary)** fleet
with **observers_can_run = true**.
- Logged in with newly-created user, selected the report above to run it
as a live report.
- Verified that the only target available is **Workstations (canary)**:
<img width="1087" height="883" alt="Screenshot 2026-03-03 at 10 47
05 AM"
src="https://github.com/user-attachments/assets/9fc8d4d4-6a38-4ecb-98fe-b56b46ac4f74"
/>
### Global user with global report (observer_can_run = true)
Global Observer user can target all fleets.
<img width="1329" height="609" alt="Screenshot 2026-03-03 at 10 56
03 AM"
src="https://github.com/user-attachments/assets/059d4eb2-546f-4a19-9eee-b64dd0250bf1"
/>
<img width="981" height="818" alt="Screenshot 2026-03-03 at 10 57 50 AM"
src="https://github.com/user-attachments/assets/afa0ee58-3457-4838-a96e-dd508d924079"
/>
### Global user with global report (observer_can_run = false)
Global Observer user can't target any fleet.
<img width="691" height="574" alt="Screenshot 2026-03-03 at 10 59 57 AM"
src="https://github.com/user-attachments/assets/f328d547-ed06-4c30-ac22-5df7bb32240a"
/>
<img width="985" height="814" alt="Screenshot 2026-03-03 at 11 00 06 AM"
src="https://github.com/user-attachments/assets/bb55da11-ea3f-40c7-bd98-652880d9e8f9"
/>
## Policies
On the FE, the same component is used to display the targets for Live
Policies, so just making sure that I didn't introduce any regression.
### Global technician user, all fleets policy
Can select all fleets.
<img width="1130" height="858" alt="Screenshot 2026-03-03 at 11 13
40 AM"
src="https://github.com/user-attachments/assets/8d9d97c4-9946-4c4c-9a8a-d79c65d9cb33"
/>
### Team user with team policy
Created user:
- **Technician** on **Servers**.
- **Observer** on **Servers (canary)**.
<img width="745" height="770" alt="Screenshot 2026-03-03 at 11 18 11 AM"
src="https://github.com/user-attachments/assets/56973c34-49bb-4007-9fac-09cf5315bdff"
/>
Can only select **Servers** as a target:
<img width="999" height="754" alt="Screenshot 2026-03-03 at 11 18 56 AM"
src="https://github.com/user-attachments/assets/82d14a8f-46e1-41f5-9355-d717477c85d8"
/>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2026-03-05 15:12:04 -03:00
..
2026-02-25 15:35:29 -06:00
2026-02-23 09:42:36 -07:00
2026-02-24 12:15:59 -03:00
2026-02-09 15:41:31 -03:00
2026-02-17 08:00:36 -07:00
2026-02-16 11:02:48 -06:00
2026-02-12 12:11:01 -06:00
2026-02-12 15:15:02 -08:00
2026-02-24 14:00:32 -05:00
2026-02-24 14:00:32 -05:00
2026-02-27 12:21:45 -05:00
2026-03-02 09:18:30 -07:00
2026-02-26 07:43:24 -04:00
2026-02-13 16:42:17 -05:00
2026-02-12 15:21:59 -07:00
2026-02-23 08:48:53 -05:00
2026-02-13 13:34:02 -08:00
2026-02-20 08:34:22 -08:00
2026-02-10 13:03:23 -06:00
2026-02-12 10:15:26 -08:00
2026-02-10 15:40:44 -05:00
2026-02-16 13:59:40 -06:00
2026-02-18 12:52:06 -05:00
2026-02-16 12:11:40 -08:00
2026-02-04 14:18:06 -05:00
2026-02-04 13:08:22 -05:00
2026-02-27 14:30:05 -06:00
2026-02-24 15:35:02 -06:00
2026-03-02 12:16:31 -05:00
2026-03-05 15:12:04 -03:00
2026-02-13 13:32:09 -06:00
2026-02-09 14:46:30 -05:00
2026-02-07 09:21:10 -04:00
2026-02-11 08:56:01 -06:00
2026-02-05 17:11:09 +01:00
2026-02-27 14:57:43 -04:00
2026-02-19 13:05:04 -03:00
2026-02-26 12:47:52 -05:00
2026-02-04 09:16:11 -05:00
2026-03-03 14:29:28 -05:00
2026-02-03 14:56:16 -05:00
2026-02-18 12:53:24 -06:00
2026-03-03 12:33:31 -05:00
2026-02-27 16:07:33 -05:00
2026-02-13 16:21:39 -05:00
2026-03-02 15:25:46 -05:00
2026-02-13 09:20:56 -05:00
2026-02-09 15:29:12 -06:00
2026-02-25 14:11:03 -06:00
2026-02-06 14:45:58 -05:00
2026-02-06 09:15:30 -03:00
2026-02-06 18:57:28 -06:00
2026-03-04 11:53:59 -05:00
2026-02-11 15:00:10 -03:00
2026-03-04 13:22:44 -05:00
2026-02-19 09:26:22 -06:00
2026-02-11 11:35:00 -05:00
2026-02-25 09:43:08 -04:00
2026-02-03 09:42:12 -05:00
2026-02-06 10:46:25 -05:00
2026-02-14 13:04:41 -06:00
2026-02-05 13:13:38 -06:00
2026-02-18 12:52:21 -04:00
2026-02-18 18:16:56 -03:00
2026-02-18 10:13:47 -04:00
2026-02-11 18:55:59 -08:00
2026-02-03 12:41:52 -05:00
2026-02-17 14:04:07 -04:00
2026-03-03 14:14:29 -05:00
2026-02-17 07:10:52 -06:00
2026-02-27 14:05:15 -05:00
2026-02-18 08:11:33 -06:00
2026-02-09 12:48:19 -05:00
2026-02-06 11:06:22 -06:00
2026-02-27 10:34:46 -05:00
2026-02-26 11:42:00 -05:00
2026-02-17 15:19:33 -06:00
2026-02-19 13:53:32 -06:00
2026-02-06 11:19:35 -05:00
2026-02-13 16:42:09 -03:00
2026-02-11 14:07:11 -05:00
2026-02-26 11:42:00 -05:00
2026-02-09 08:43:02 -06:00
2026-02-10 20:26:43 -06:00
2026-02-17 13:20:24 -04:00
2026-02-12 09:13:24 -07:00
2026-02-17 19:54:36 -06:00
2026-02-16 15:31:20 -08:00
2026-02-20 17:09:41 -05:00
2026-02-18 12:02:19 -05:00
2026-02-19 16:05:29 -03:00
2026-02-25 15:52:09 -06:00
2026-03-02 15:14:19 -05:00
2026-02-19 16:06:00 -06:00
2026-02-23 09:26:58 -06:00
2026-03-03 14:14:58 -05:00
2026-02-20 17:22:50 -06:00
2026-02-20 12:21:55 -06:00
2026-03-02 16:25:48 -08:00
2026-03-02 22:18:36 -06:00
2026-02-26 07:47:12 -06:00
2026-02-25 18:01:47 -03:00
2026-02-26 12:49:52 -06:00
2026-02-26 14:12:22 -03:00
2026-02-27 08:37:07 -06:00
2026-02-27 16:15:34 -06:00
2026-03-04 11:39:04 -03:00
2026-03-02 16:38:52 -03:00
2026-03-02 16:38:52 -03:00
2026-03-03 17:44:49 -06:00
2026-03-04 09:58:27 -06:00
2026-03-03 17:16:10 -06:00
2026-03-04 14:03:34 -05:00
2026-03-04 12:25:20 -06:00
2026-02-27 17:09:54 -03:00
2026-02-25 18:01:47 -03:00
2026-02-23 09:14:07 -03:00
2026-02-24 11:25:00 -03:00
2026-02-19 16:36:47 -05:00
2026-02-26 17:05:13 +00:00
2026-03-05 17:02:21 +00:00
2026-02-18 12:00:17 +00:00
2026-03-04 13:12:33 +00:00
2026-02-19 13:19:52 +00:00
2026-02-27 17:03:52 +00:00
2026-02-27 17:04:14 +00:00
2026-02-24 12:51:48 -06:00
2026-02-18 08:15:29 -06:00
2026-02-20 10:33:27 -06:00