Add multiple Apple Business Manager and Volume Purchasing Program connections

[zwass]

Goal

User story
As an administrator at an MSP that offers a white-label MDM solution built on top of Fleet,
I want to add multiple Apple Business Manager (ABM) and Volume Purchasing Program (VPP) connections in Fleet
so that I can use one Fleet server to build automatic enrollment and App Store app workflows for all my clients' macOS, iOS, and iPadOS hosts.

Context

• Product designer: @marko-lisica

Changes

Product

• Reference documentation changes: Changes are in the CLI/API design PR here.
• UI changes: Figma wireframes are here.
• CLI usage changes: CLI design PR is here
  • Maintain support for fleetctl get apple-bm if there's one ABM token. Wireframes are in Figma here.
• REST API changes: API design PR is here
• Fleet's agent (fleetd) changes: No fleetd changes.
• Permissions changes: Only global admins and GitOps users can modify ABM and VPP options.
  • Permissions PR is here: Permissions guide: Apple Business Manager and Volume Purchasing Program #22336
• Changes to paid features or tiers: ABM and VPP are Fleet Premium only.
  • PR to pricing page: Update pricing-features-table.yml #22049

Engineering

• Contributor API endpoints to support best practice GitOps (fleetctl gitops) and backwards compatibility GitOps (fleetctl apply). Please add these to the existing reference docs PR here.
• Feature guide changes: Update feature guides that walkthrough mdm settings (UI changes)
• Database schema migrations: Subtask
• Load testing: No

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

@noahtalerman:

• Be aware of a similar bug for this multiple ABM/VPP connections story: Configuration profiles have old label name #21163
  • I think let's make sure to test that the team name change is reflected because we have made similar mistakes in the past.
• Test generic error state in Figma here. We don't want this error state to block the user (showing error state) if they need to renew APNs, ABM, or VPP. Or accept new terms for ABM.
  • We've had a bug w/ blocking the user in the error state in the past: Apple Business Manager connection is broken/uneditable after ABM user is deleted #20090

added by @mna:

• Important to test migrating from previous version with an existing ABM and VPP token, using the same process as our users. The migration of existing tokens is a two-step process, one during the DB migration, and one soon (seconds) after the fleet server restart.

added by @PezHub:

Confirm all copy -

• Empty state for ABM and VPP
• Navigate directly to /settings/integrations/mdm/abm shows correct page
• Once MDM is turned on

End User Authentication -

• Remove Default Team option (it moved to ABM page)
• Confirm updated copy once enabled

ABM -

• Confirm empty states, uploads, renewals
• Try to upload existing token + invalid token and confirm error
• Ensure all teams are set to “no team” upon creation
• When more than one org, list Alphabetically
• Test actions items all function - Edit, Renew, Delete
• Tooltips over Teams Tabs show correct hover display
• Verify Team behavior for ABM

VPP -

• Empty state for adding apps when none are available in ABM (could not test since Apple makes it near impossible to remove software titles from Apps & Books in ABM once they are added.)
• Verify Team behavior for VPP
• Verify copy and hover tooltips
• Can only assign 1 team per token
• Can’t assign any teams if “all teams” is linked to another VPP org

Banners VPP & ABM -

• Renew
• Expired
• ABM accept new terms banner
• Banners display one at a time in the correct priority
• Redirect link to page works
• Orange, red, green dots next to org names reflect expire dates

GitOps

Miscellaneous -

• Free version - confirmed MABM not available without Premium subscription
• Test team name changes are reflected for both ABM and VPP pages (per Noah’s suggestion above)
• Test deleting a team from the UI - ensure it reverts to “no team” for ABM and gets removed for VPP

End-to-end Tests -

• Ensure ADE devices enroll to the assigned team listed in ABM
• Test Host page team assignment (transfer option for those awaiting enrollment) vs ABM page ADE team assignment
• make sure manual assignment on host page overrides ABM page
• Ensure VPP apps install from the correct Org/Token
• Ensure VPP apps work from SS and are removed from fleetd when host moves teams
• Test migrating from 4.55 to 4.56 with an ABM and VPP token configured prior. Make sure no renewal banners show (per Martin’s suggestion above)
• VPP apps are removed from host when Token is moved, changed or deleted

[marko-lisica]

@zayhanlon @zwass We didn't get to this one in the current design sprint. Adding it to feature fest.