Merge branch 'main' into 23115-vpp-policy-be

.github/workflows/check-automated-doc.yml

@@ -38,8 +38,6 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
-        with:
-          fetch-depth: 0
 
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
@@ -51,7 +49,8 @@ jobs:
           make generate-doc
           if [[ $(git diff) ]]; then
             echo "❌ fail: uncommited changes"
-            echo "please run `make generate-doc` and commit the changes"
+            echo "please run 'make generate-doc' and commit the changes"
+            git --no-pager diff
             exit 1
           fi
 
@@ -62,6 +61,7 @@ jobs:
           ./node_modules/sails/bin/sails.js run generate-merged-schema
           if [[ $(git diff) ]]; then
             echo "❌ fail: uncommited changes"
-            echo "please run `cd website && npm install && ./node_modules/sails/bin/sails.js run generate-merged-schema` and commit the changes"
+            echo "please run 'cd website && npm install && ./node_modules/sails/bin/sails.js run generate-merged-schema' and commit the changes"
+            git --no-pager diff
             exit 1
           fi

.github/workflows/goreleaser-fleet.yaml

@@ -106,8 +106,8 @@ jobs:
         continue-on-error: true
         id: image_digests
         run: |
-          echo "digest_fleet=$(cat ./dist/artifact.json | jq -r '.[]|select(.type == "Published Docker Image" and (.name | contains("fleetdm/fleet:${{ steps.commit.outputs.short_commit }}"))) | select(. != null)|.extra.Digest')" >> "$GITHUB_OUTPUT"
-          echo "digest_fleetctl=$(cat ./dist/artifact.json | jq -r '.[]|select(.type == "Published Docker Image" and (.name | contains("fleetdm/fleetctl:${{ steps.commit.outputs.short_commit }}"))) | select(. != null)|.extra.Digest')" >> "$GITHUB_OUTPUT"
+          echo "digest_fleet=$(cat ./dist/artifacts.json | jq -r '.[]|select(.type == "Published Docker Image" and (.name | contains("fleetdm/fleet:${{ steps.commit.outputs.short_commit }}"))) | select(. != null)|.extra.Digest')" >> "$GITHUB_OUTPUT"
+          echo "digest_fleetctl=$(cat ./dist/artifacts.json | jq -r '.[]|select(.type == "Published Docker Image" and (.name | contains("fleetdm/fleetctl:${{ steps.commit.outputs.short_commit }}"))) | select(. != null)|.extra.Digest')" >> "$GITHUB_OUTPUT"
 
       - name: Attest Fleet image
         uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0

.github/workflows/test-go.yaml

@@ -42,7 +42,7 @@ jobs:
   test-go:
     strategy:
       matrix:
-        suite: ["integration", "core", "mysql", "fleetctl", "vuln"]
+        suite: ["integration-core", "integration-enterprise", "integration-mdm", "core", "mysql", "fleetctl", "vuln"]
         os: [ubuntu-latest]
         mysql: ["mysql:8.0.36", "mysql:8.4.3", "mysql:9.1.0"] # make sure to update supported versions docs when this changes
         isCron:
@@ -120,9 +120,15 @@ jobs:
         if [[ "${{ matrix.suite }}" == "core" ]]; then
           CI_TEST_PKG=main
           RUN_TESTS_ARG='-skip=^TestIntegrations'
-        elif [[ "${{ matrix.suite }}" == "integration" ]]; then
-          CI_TEST_PKG=main
-          RUN_TESTS_ARG='-run=^TestIntegrations'
+        elif [[ "${{ matrix.suite }}" == "integration-core" ]]; then
+          CI_TEST_PKG=integration
+          RUN_TESTS_ARG='-run=^TestIntegrations -skip "^(TestIntegrationsMDM|TestIntegrationsEnterprise)"'
+        elif [[ "${{ matrix.suite }}" == "integration-mdm" ]]; then
+          CI_TEST_PKG=integration
+          RUN_TESTS_ARG='-run=^TestIntegrationsMDM'
+        elif [[ "${{ matrix.suite }}" == "integration-enterprise" ]]; then
+          CI_TEST_PKG=integration
+          RUN_TESTS_ARG='-run=^TestIntegrationsEnterprise'
         else
           CI_TEST_PKG="${{ matrix.suite }}"
           RUN_TESTS_ARG=''

Makefile

@@ -158,6 +158,8 @@ dlv_test_pkg_to_test := $(addprefix github.com/fleetdm/fleet/v4/,$(PKG_TO_TEST))
 DEFAULT_PKG_TO_TEST := ./cmd/... ./ee/... ./orbit/pkg/... ./orbit/cmd/orbit ./pkg/... ./server/... ./tools/...
 ifeq ($(CI_TEST_PKG), main)
 	CI_PKG_TO_TEST=$(shell go list ${DEFAULT_PKG_TO_TEST} | grep -v "server/datastore/mysql" | grep -v "cmd/fleetctl" | grep -v "server/vulnerabilities" | sed -e 's|github.com/fleetdm/fleet/v4/||g')
+else ifeq ($(CI_TEST_PKG), integration)
+	CI_PKG_TO_TEST="server/service"
 else ifeq ($(CI_TEST_PKG), mysql)
 	CI_PKG_TO_TEST="server/datastore/mysql/..."
 else ifeq ($(CI_TEST_PKG), fleetctl)

articles/deploy-software-packages.md

@@ -30,8 +30,6 @@ Learn more about automatically installing software in a separate guide [here](ht
 
 * Select the hosts that you want to target with this software, under "Target". Select "All hosts" if you want the software to be available to all your hosts. Select "Custom" to scope the software to specific groups of hosts based on label membership. You can select "Include any", which will scope the software to hosts that have any of the labels you select, or "Exclude any", which will scope the software to hosts that do _not_ have the selected labels.
 
-* Select the hosts that you want to target with this software, under "Target". Select "All hosts" if you want the software to be available to all your hosts. Select "Custom" to scope the software to specific groups of hosts based on label membership. You can select "Include any", which will scope the software to hosts that have any of the labels you select, or "Exclude any", which will scope the software to hosts that do _not_ have the selected labels.
-
 * To allow users to install the software from Fleet Desktop, check the “Self-service” checkbox.
 
 * To customize installer behavior, click on “Advanced options.”

articles/fleet-4.62.0.md

@@ -22,7 +22,7 @@ Fleet now creates policies automatically when you add a custom package. This eli
 
 ### Hide secrets in configuration profiles and scripts
 
-Fleet ensures that GitHub or GitLab secrets, like API tokens and license keys used in scripts (Shell & PowerShell) and configuration profiles (macOS & Windows), are hidden when viewed or downloaded in Fleet. This protects sensitive information, keeping it secure until it’s deployed to the hosts. Learn more about secrets [here](https://fleetdm.com/secret-variables).
+Fleet ensures that GitHub or GitLab secrets, like API tokens and license keys used in scripts (Shell & PowerShell) and configuration profiles (macOS & Windows), are hidden when viewed or downloaded in Fleet. This protects sensitive information, keeping it secure until it’s deployed to the hosts. Learn more about secrets [here](https://fleetdm.com/guides/secret-variables).
 
 ## Changes
 

changes/24038-agent-options-key-error

@@ -0,0 +1 @@
+- Display the correct path for agent options when a key is placed in the wrong object

changes/24618-make-email-logo-dark-mode-compatible

@@ -0,0 +1 @@
+* Use an email logo compatible with dark modes

cmd/fleetctl/package.go

@@ -13,6 +13,7 @@ import (
 
 	eefleetctl "github.com/fleetdm/fleet/v4/ee/fleetctl"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/packaging"
+	"github.com/fleetdm/fleet/v4/orbit/pkg/update"
 	"github.com/fleetdm/fleet/v4/pkg/filepath_windows"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/rs/zerolog"
@@ -127,7 +128,7 @@ func packageCommand() *cli.Command {
 			&cli.StringFlag{
 				Name:        "update-url",
 				Usage:       "URL for update server",
-				Value:       "https://tuf.fleetctl.com",
+				Value:       update.DefaultURL,
 				Destination: &opt.UpdateURL,
 			},
 			&cli.StringFlag{

cmd/fleetctl/preview.go

@@ -762,7 +762,7 @@ func previewResetCommand() *cli.Command {
 				return fmt.Errorf("Failed to stop orbit: %w", err)
 			}
 
-			if err := os.RemoveAll(filepath.Join(orbitDir, "tuf-metadata.json")); err != nil {
+			if err := os.RemoveAll(filepath.Join(orbitDir, update.MetadataFileName)); err != nil {
 				return fmt.Errorf("failed to remove preview update metadata file: %w", err)
 			}
 			if err := os.RemoveAll(filepath.Join(orbitDir, "bin")); err != nil {

docs/Contributing/API-for-contributors.md

@@ -4179,7 +4179,7 @@ _Available in Fleet Premium._
 ```json
 {
   "team_name": "Foobar",
-  "app_store_apps": {
+  "app_store_apps": [
     {
       "app_store_id": "597799333",
       "self_service": false
@@ -4188,7 +4188,7 @@ _Available in Fleet Premium._
       "app_store_id": "497799835",
       "self_service": true,
     }
-  }
+  ]
 }
 ```
 

ee/server/service/teams.go

@@ -414,6 +414,23 @@ func (svc *Service) ModifyTeamAgentOptions(ctx context.Context, teamID uint, tea
 
 	if teamOptions != nil {
 		if err := fleet.ValidateJSONAgentOptions(ctx, svc.ds, teamOptions, true); err != nil {
+			if field := fleet.GetJSONUnknownField(err); field != nil {
+				correctKeyPath, keyErr := fleet.FindAgentOptionsKeyPath(*field)
+				if keyErr != nil {
+					level.Error(svc.logger).Log("err", err, "msg", "error parsing generated agent options structs")
+				}
+				var keyPathJoined string
+				switch pathLen := len(correctKeyPath); {
+				case pathLen > 1:
+					keyPathJoined = fmt.Sprintf("%q", strings.Join(correctKeyPath[:len(correctKeyPath)-1], "."))
+				case pathLen == 1:
+					keyPathJoined = "top level"
+				}
+				if keyPathJoined != "" {
+					err = fmt.Errorf("%q should be part of the %s object", *field, keyPathJoined)
+				}
+			}
+
 			err = fleet.NewUserMessageError(err, http.StatusBadRequest)
 			if applyOptions.Force && !applyOptions.DryRun {
 				level.Info(svc.logger).Log("err", err, "msg", "force-apply team agent options with validation errors")

frontend/components/TableContainer/TableContainer.tsx

@@ -83,7 +83,7 @@ interface ITableContainerProps<T = any> {
   onQueryChange?:
     | ((queryData: ITableQueryData) => void)
     | ((queryData: ITableQueryData) => number);
-  customControl?: () => JSX.Element;
+  customControl?: () => JSX.Element | null;
   /** Filter button right of the search rendering alternative responsive design where search bar moves to new line but filter button remains inline with other table headers */
   customFiltersButton?: () => JSX.Element;
   stackControls?: boolean;
@@ -288,11 +288,11 @@ const TableContainer = <T,>({
     const opacity = isLoading ? { opacity: 0.4 } : { opacity: 1 };
 
     // New preferred pattern uses grid container/box to allow for more dynamic responsiveness
-    // At low widths, search bar (3rd div of 4) moves above other 3 divs
-    if (customFiltersButton) {
+    // At low widths, right header stacks on top of left header
+    if (stackControls) {
       return (
         <div className="container">
-          <div className="box">
+          <div className="stackable-header">
             {renderCount && !disableCount && (
               <div
                 className={`${baseClass}__results-count ${
@@ -304,8 +304,9 @@ const TableContainer = <T,>({
               </div>
             )}
           </div>
-          <div className="box">
-            {actionButton && !actionButton.hideButton && (
+
+          {actionButton && !actionButton.hideButton && (
+            <div className="stackable-header">
               <Button
                 disabled={disableActionButton}
                 onClick={actionButton.onActionButtonClick}
@@ -317,10 +318,10 @@ const TableContainer = <T,>({
                   {actionButton.iconSvg && <Icon name={actionButton.iconSvg} />}
                 </>
               </Button>
-            )}
+            </div>
+          )}
+          <div className="stackable-header top-shift-header">
             {customControl && customControl()}
-          </div>
-          <div className="box search">
             {searchable && !wideSearch && (
               <div className={`${baseClass}__search`}>
                 <div
@@ -347,8 +348,8 @@ const TableContainer = <T,>({
                 </ReactTooltip>
               </div>
             )}
+            {customFiltersButton && customFiltersButton()}
           </div>
-          <div className="box"> {customFiltersButton()} </div>
         </div>
       );
     }

frontend/components/TableContainer/_styles.scss

@@ -6,14 +6,14 @@
   // Container is responsive design used when customFilters is rendered
   .container {
     display: grid;
-    grid-template-columns: 1fr auto auto; /* First column takes all remaining space */
-    grid-template-rows: auto auto; /* Two rows */
+    grid-template-columns: 1fr auto; /* First column takes all remaining space */
+    grid-template-rows: auto auto; /* Two rows for smaller screens*/
     width: 100%;
     height: max-content;
     gap: $pad-small $pad-medium;
   }
 
-  .box {
+  .stackable-header {
     min-width: max-content;
     align-content: center;
     display: flex;
@@ -24,56 +24,46 @@
       display: flex;
       flex-direction: row;
     }
+
+    // only if in stackable header
+    .table-container__search {
+      width: 100%;
+    }
   }
 
-  .search {
+  .top-shift-header {
     grid-column: 1 / -1; /* Span across all columns */
     grid-row: 1; /* Place in the first row */
-  }
 
-  .box:nth-child(1) {
-    grid-column: 1 / span 2; /* Make Box 1 expand across two columns */
-    grid-row: 2;
+    .Select-multi-value-wrapper {
+      height: 36px; // Fixes height issues
+      width: 236px;
+    }
   }
 
-  .box:nth-child(2) {
-    grid-column: 2; /* Place Box 2 in the second row, second column */
+  .stackable-header:nth-child(1) {
+    grid-column: 1 / span 2; /* Make Header 1 expand across two columns */
     grid-row: 2;
-  }
 
-  .box:nth-child(4) {
-    grid-column: 3; /* Place Box 4 in the second row, third column */
-    grid-row: 2;
-    max-width: min-content;
+    .form-field--dropdown {
+      width: 235px;
+    }
   }
 
   /* Media query for larger screens */
-  @media (min-width: $table-controls-break) {
+  @media (min-width: $break-md) {
     .container {
-      grid-template-columns: 1fr auto auto auto; /* First column takes all remaining space */
+      grid-template-columns: 1fr auto; /* First column takes all remaining space */
       grid-template-rows: auto; /* Single row */
     }
 
-    .search {
-      grid-column: 1 / -1; /* Keep spanning across all columns if needed */
-      grid-row: auto;
+    .top-shift-header {
+      grid-column: 2; /* Single row */
     }
 
-    .box:nth-child(1) {
-      grid-column: 1; /* Ensure Box 1 stays in the first column */
-    }
-
-    .box:nth-child(2) {
-      grid-column: 2; /* Place Box 2 in the second column */
-    }
-
-    .box:nth-child(3) {
-      grid-column: 3; /* Place Box 3 in the third column */
-      grid-row: 2;
-    }
-
-    .box:nth-child(4) {
-      grid-column: 4; /* Place Box 4 in the fourth column */
+    .stackable-header:nth-child(1) {
+      grid-column: 1; /* Ensure Header 1 stays in the first column */
+      grid-row: 1; /* Single row */
     }
   }
 
@@ -138,10 +128,6 @@
         justify-content: space-between;
       }
     }
-
-    .Select-multi-value-wrapper {
-      height: 38px; // Fixes overlap with .Select outline
-    }
   }
 
   &__results-count {