fleet/frontend/components/LiveQuery/SelectTargets.tests.tsx

540 lines
14 KiB
TypeScript
Raw Normal View History

Fix observer query bypass: prevent cross-team targeting (#40717) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. # Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Queries/reports ### Team user with team report (observer_can_run = true) Created user with the following assignments: <img width="596" height="285" alt="Screenshot 2026-03-02 at 4 58 47 PM" src="https://github.com/user-attachments/assets/a3a8e7dd-2bfc-40f9-948c-b26b016162ae" /> Created report on **Workstations (canary)** fleet with **observers_can_run = true** <img width="1020" height="711" alt="Screenshot 2026-03-02 at 5 09 25 PM" src="https://github.com/user-attachments/assets/58aa98c7-8cbd-4a7a-a159-f4b40a65f2c9" /> Logged in with newly-created user, selected the report above to run it as a live report. - Verified that **Servers (canary)** is disabled => user is **Observer** on that fleet, but query belongs to **Workstations (canary)**. - All the other fleets are enabled: - User is **Observer+ or more** in those fleets. - User is **Observer** in **Workstations (canary)** => enabled because report belongs to this fleet, AND **observer_can_run = true**. <img width="986" height="823" alt="Screenshot 2026-03-02 at 5 07 29 PM" src="https://github.com/user-attachments/assets/b6b7aa4b-5036-46e3-8497-3a77f93a3a2c" /> ### Global user with team report (observer_can_run = true) - Created global Observer user. - Accessed same report created above for **Workstations (canary)** fleet with **observers_can_run = true**. - Logged in with newly-created user, selected the report above to run it as a live report. - Verified that the only target available is **Workstations (canary)**: <img width="1087" height="883" alt="Screenshot 2026-03-03 at 10 47 05 AM" src="https://github.com/user-attachments/assets/9fc8d4d4-6a38-4ecb-98fe-b56b46ac4f74" /> ### Global user with global report (observer_can_run = true) Global Observer user can target all fleets. <img width="1329" height="609" alt="Screenshot 2026-03-03 at 10 56 03 AM" src="https://github.com/user-attachments/assets/059d4eb2-546f-4a19-9eee-b64dd0250bf1" /> <img width="981" height="818" alt="Screenshot 2026-03-03 at 10 57 50 AM" src="https://github.com/user-attachments/assets/afa0ee58-3457-4838-a96e-dd508d924079" /> ### Global user with global report (observer_can_run = false) Global Observer user can't target any fleet. <img width="691" height="574" alt="Screenshot 2026-03-03 at 10 59 57 AM" src="https://github.com/user-attachments/assets/f328d547-ed06-4c30-ac22-5df7bb32240a" /> <img width="985" height="814" alt="Screenshot 2026-03-03 at 11 00 06 AM" src="https://github.com/user-attachments/assets/bb55da11-ea3f-40c7-bd98-652880d9e8f9" /> ## Policies On the FE, the same component is used to display the targets for Live Policies, so just making sure that I didn't introduce any regression. ### Global technician user, all fleets policy Can select all fleets. <img width="1130" height="858" alt="Screenshot 2026-03-03 at 11 13 40 AM" src="https://github.com/user-attachments/assets/8d9d97c4-9946-4c4c-9a8a-d79c65d9cb33" /> ### Team user with team policy Created user: - **Technician** on **Servers**. - **Observer** on **Servers (canary)**. <img width="745" height="770" alt="Screenshot 2026-03-03 at 11 18 11 AM" src="https://github.com/user-attachments/assets/56973c34-49bb-4007-9fac-09cf5315bdff" /> Can only select **Servers** as a target: <img width="999" height="754" alt="Screenshot 2026-03-03 at 11 18 56 AM" src="https://github.com/user-attachments/assets/82d14a8f-46e1-41f5-9355-d717477c85d8" /> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2026-03-05 18:12:04 +00:00
import React from "react";
import { screen, waitFor } from "@testing-library/react";
import { http, HttpResponse } from "msw";
import mockServer from "test/mock-server";
import { baseUrl, createCustomRenderer } from "test/test-utils";
import createMockUser from "__mocks__/userMock";
import SelectTargets from "./SelectTargets";
const MOCK_LABELS = [
{ id: 1, name: "All Hosts", label_type: "builtin", description: "" },
{ id: 2, name: "macOS", label_type: "builtin", description: "" },
];
const MOCK_TEAMS = [
{ id: 1, name: "Team Alpha", host_count: 10, user_count: 5 },
{ id: 2, name: "Team Beta", host_count: 20, user_count: 8 },
];
const labelSummariesHandler = http.get(baseUrl("/labels/summary"), () => {
return HttpResponse.json({ labels: MOCK_LABELS });
});
Update API calls in front-end to use new, non-deprecated URLs and params (#41515) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41391 # Details This PR updates front-end API calls to use new URLs and API params, so that the front end doesn't cause deprecation warnings to appear on the server. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. n/a, should not be user-visible ## Testing - [X] Added/updated automated tests - [ ] QA'd all new/changed functionality manually The biggest risk here is not that we missed a spot that still causes a deprecation warning, but that we might inadvertently make a change that breaks the front end, for instance by sending `fleet_id` to a function that drops it silently and thus sends no ID to the server. Fortunately we use TypeScript in virtually every place affected by these changes, so the code would not compile if there were mismatches between the API expectation and what we're sending. Still, spot checking as many places as possible both for deprecation-warning leaks and loss of functionality is important. ## Summary by CodeRabbit * **Refactor** * Updated API nomenclature across the application to use "fleets" instead of "teams" and "reports" instead of "queries" in endpoint paths and request/response payloads. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-03-13 03:26:48 +00:00
const teamsHandler = http.get(baseUrl("/fleets"), () => {
Fix observer query bypass: prevent cross-team targeting (#40717) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. # Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Queries/reports ### Team user with team report (observer_can_run = true) Created user with the following assignments: <img width="596" height="285" alt="Screenshot 2026-03-02 at 4 58 47 PM" src="https://github.com/user-attachments/assets/a3a8e7dd-2bfc-40f9-948c-b26b016162ae" /> Created report on **Workstations (canary)** fleet with **observers_can_run = true** <img width="1020" height="711" alt="Screenshot 2026-03-02 at 5 09 25 PM" src="https://github.com/user-attachments/assets/58aa98c7-8cbd-4a7a-a159-f4b40a65f2c9" /> Logged in with newly-created user, selected the report above to run it as a live report. - Verified that **Servers (canary)** is disabled => user is **Observer** on that fleet, but query belongs to **Workstations (canary)**. - All the other fleets are enabled: - User is **Observer+ or more** in those fleets. - User is **Observer** in **Workstations (canary)** => enabled because report belongs to this fleet, AND **observer_can_run = true**. <img width="986" height="823" alt="Screenshot 2026-03-02 at 5 07 29 PM" src="https://github.com/user-attachments/assets/b6b7aa4b-5036-46e3-8497-3a77f93a3a2c" /> ### Global user with team report (observer_can_run = true) - Created global Observer user. - Accessed same report created above for **Workstations (canary)** fleet with **observers_can_run = true**. - Logged in with newly-created user, selected the report above to run it as a live report. - Verified that the only target available is **Workstations (canary)**: <img width="1087" height="883" alt="Screenshot 2026-03-03 at 10 47 05 AM" src="https://github.com/user-attachments/assets/9fc8d4d4-6a38-4ecb-98fe-b56b46ac4f74" /> ### Global user with global report (observer_can_run = true) Global Observer user can target all fleets. <img width="1329" height="609" alt="Screenshot 2026-03-03 at 10 56 03 AM" src="https://github.com/user-attachments/assets/059d4eb2-546f-4a19-9eee-b64dd0250bf1" /> <img width="981" height="818" alt="Screenshot 2026-03-03 at 10 57 50 AM" src="https://github.com/user-attachments/assets/afa0ee58-3457-4838-a96e-dd508d924079" /> ### Global user with global report (observer_can_run = false) Global Observer user can't target any fleet. <img width="691" height="574" alt="Screenshot 2026-03-03 at 10 59 57 AM" src="https://github.com/user-attachments/assets/f328d547-ed06-4c30-ac22-5df7bb32240a" /> <img width="985" height="814" alt="Screenshot 2026-03-03 at 11 00 06 AM" src="https://github.com/user-attachments/assets/bb55da11-ea3f-40c7-bd98-652880d9e8f9" /> ## Policies On the FE, the same component is used to display the targets for Live Policies, so just making sure that I didn't introduce any regression. ### Global technician user, all fleets policy Can select all fleets. <img width="1130" height="858" alt="Screenshot 2026-03-03 at 11 13 40 AM" src="https://github.com/user-attachments/assets/8d9d97c4-9946-4c4c-9a8a-d79c65d9cb33" /> ### Team user with team policy Created user: - **Technician** on **Servers**. - **Observer** on **Servers (canary)**. <img width="745" height="770" alt="Screenshot 2026-03-03 at 11 18 11 AM" src="https://github.com/user-attachments/assets/56973c34-49bb-4007-9fac-09cf5315bdff" /> Can only select **Servers** as a target: <img width="999" height="754" alt="Screenshot 2026-03-03 at 11 18 56 AM" src="https://github.com/user-attachments/assets/82d14a8f-46e1-41f5-9355-d717477c85d8" /> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2026-03-05 18:12:04 +00:00
return HttpResponse.json({ teams: MOCK_TEAMS });
});
const defaultProps = {
baseClass: "select-targets",
selectedTargets: [],
targetedHosts: [],
targetedLabels: [],
targetedTeams: [],
goToQueryEditor: jest.fn(),
goToRunQuery: jest.fn(),
setSelectedTargets: jest.fn(),
setTargetedHosts: jest.fn(),
setTargetedLabels: jest.fn(),
setTargetedTeams: jest.fn(),
setTargetsTotalCount: jest.fn(),
};
const getTeamButton = (name: string) =>
screen.getByText(name).closest("button");
describe("SelectTargets - team disabling", () => {
beforeEach(() => {
mockServer.use(labelSummariesHandler, teamsHandler);
});
describe("plain observer (not observer+)", () => {
const plainObserverOnBothTeams = createMockUser({
global_role: null,
teams: [
{ ...MOCK_TEAMS[0], role: "observer" },
{ ...MOCK_TEAMS[1], role: "observer" },
],
});
it("disables all observer teams for live policies", async () => {
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: plainObserverOnBothTeams,
isPremiumTier: true,
isOnGlobalTeam: false,
},
},
});
render(
<SelectTargets
{...defaultProps}
isLivePolicy
isObserverCanRunQuery={false}
/>
);
await waitFor(() => {
expect(getTeamButton("Team Alpha")).toBeDisabled();
expect(getTeamButton("Team Beta")).toBeDisabled();
});
});
it("disables observer teams when query does not have observer_can_run", async () => {
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: plainObserverOnBothTeams,
isPremiumTier: true,
isOnGlobalTeam: false,
},
},
});
render(
<SelectTargets
{...defaultProps}
isObserverCanRunQuery={false}
queryTeamId={1}
/>
);
await waitFor(() => {
expect(getTeamButton("Team Alpha")).toBeDisabled();
expect(getTeamButton("Team Beta")).toBeDisabled();
});
});
Follow-up changes to observer live query bypass (#41146) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 This is a follow-up of https://github.com/fleetdm/fleet/pull/40717 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Verified that the manual test cases I described in https://github.com/fleetdm/fleet/pull/40717 still pass. Used the following setup: - 1 host on Servers. - 1 host on Servers (canary). - 9999 hosts on Unassigned. <img width="1292" height="448" alt="Screenshot 2026-03-10 at 9 41 33 PM" src="https://github.com/user-attachments/assets/37ba2ad9-aa7b-4d40-b134-56a943e2635c" /> Users: - Team user with these assignments for test cases 1 and 2. <img width="570" height="269" alt="Screenshot 2026-03-10 at 9 42 41 PM" src="https://github.com/user-attachments/assets/f4bcf180-b7cc-4d80-a727-26ce887cbe84" /> - Global observer user for test cases 3 to 5. ### Test case 1 Report on Workstations (canary) with observers_can_run=true <img width="470" height="538" alt="Screenshot 2026-03-10 at 9 42 30 PM" src="https://github.com/user-attachments/assets/11c02ee9-c6eb-463a-9d4b-168a6155feed" /> Tested that I'm only able to target that host using "All hosts", "macOS" and other labels. Also, searching for specific hosts under "Target specific hosts" only retrieves that host. https://github.com/user-attachments/assets/150d986a-b4f2-49ab-86d9-0308685873eb ### Test case 2 Confirmed that I'm not able to target `perf-host-1` from `Servers (canary)` using a manual label with the same report above. For this, I created a manual label and assigned only to `perf-host-1`: <img width="603" height="349" alt="Screenshot 2026-03-10 at 9 50 52 PM" src="https://github.com/user-attachments/assets/98b4a27a-4e46-466e-a377-622d36903feb" /> Note that 0 hosts are targeted and **Run** is disabled: <img width="950" height="814" alt="Screenshot 2026-03-10 at 9 52 26 PM" src="https://github.com/user-attachments/assets/3b42c0e9-3005-40cc-8733-85b9b729ce89" /> ### Test case 3 Accessed same report in `Workstations (canary)` above with a Global Observer user. Confirmed that no hosts can be targeted in any way: <img width="977" height="649" alt="Screenshot 2026-03-11 at 8 29 26 AM" src="https://github.com/user-attachments/assets/ac87ac7e-3097-4228-a724-1d9324dec504" /> <img width="986" height="746" alt="Screenshot 2026-03-11 at 8 30 06 AM" src="https://github.com/user-attachments/assets/5ca592d2-be8c-43c0-8a27-d18fdee35442" /> <img width="1017" height="812" alt="Screenshot 2026-03-11 at 8 30 12 AM" src="https://github.com/user-attachments/assets/fb92940d-3ab2-4136-9e04-825f2c5eb3fe" /> <img width="998" height="809" alt="Screenshot 2026-03-11 at 8 30 17 AM" src="https://github.com/user-attachments/assets/67cc9c0a-e1aa-49df-ad68-1988d6471d32" /> <img width="1444" height="311" alt="Screenshot 2026-03-11 at 8 30 35 AM" src="https://github.com/user-attachments/assets/4b725bf1-0d6d-4458-840e-a96666a34903" /> <img width="1444" height="303" alt="Screenshot 2026-03-11 at 8 30 42 AM" src="https://github.com/user-attachments/assets/54a9cd65-90f5-4454-a713-334e23118295" /> ### Test case 4 As a global observer, accessing a global report with observers_can_run=true, I can target all the hosts across all teams. <img width="951" height="640" alt="Screenshot 2026-03-11 at 8 34 58 AM" src="https://github.com/user-attachments/assets/3c235b3d-acd5-4801-834f-6fe6cd67d3dd" /> <img width="1448" height="527" alt="Screenshot 2026-03-11 at 8 35 06 AM" src="https://github.com/user-attachments/assets/0f5f663d-8597-4320-aceb-ee6f168ec552" /> <img width="1474" height="179" alt="Screenshot 2026-03-11 at 8 35 14 AM" src="https://github.com/user-attachments/assets/042eda04-e7f6-4c21-9503-878a23435fcd" /> ### Test case 5 With the same report from test case 4, but observers_can_run=false, I can't target any hosts. <img width="971" height="804" alt="Screenshot 2026-03-11 at 8 36 49 AM" src="https://github.com/user-attachments/assets/3a3a9fe3-a159-4ef9-8b08-4c987b9c0828" /> <img width="967" height="813" alt="Screenshot 2026-03-11 at 8 37 00 AM" src="https://github.com/user-attachments/assets/aba5588d-dd96-4b88-9911-ebdd743bfa65" />
2026-03-11 16:42:33 +00:00
it("enables only the query's team when observer_can_run is true", async () => {
Fix observer query bypass: prevent cross-team targeting (#40717) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. # Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Queries/reports ### Team user with team report (observer_can_run = true) Created user with the following assignments: <img width="596" height="285" alt="Screenshot 2026-03-02 at 4 58 47 PM" src="https://github.com/user-attachments/assets/a3a8e7dd-2bfc-40f9-948c-b26b016162ae" /> Created report on **Workstations (canary)** fleet with **observers_can_run = true** <img width="1020" height="711" alt="Screenshot 2026-03-02 at 5 09 25 PM" src="https://github.com/user-attachments/assets/58aa98c7-8cbd-4a7a-a159-f4b40a65f2c9" /> Logged in with newly-created user, selected the report above to run it as a live report. - Verified that **Servers (canary)** is disabled => user is **Observer** on that fleet, but query belongs to **Workstations (canary)**. - All the other fleets are enabled: - User is **Observer+ or more** in those fleets. - User is **Observer** in **Workstations (canary)** => enabled because report belongs to this fleet, AND **observer_can_run = true**. <img width="986" height="823" alt="Screenshot 2026-03-02 at 5 07 29 PM" src="https://github.com/user-attachments/assets/b6b7aa4b-5036-46e3-8497-3a77f93a3a2c" /> ### Global user with team report (observer_can_run = true) - Created global Observer user. - Accessed same report created above for **Workstations (canary)** fleet with **observers_can_run = true**. - Logged in with newly-created user, selected the report above to run it as a live report. - Verified that the only target available is **Workstations (canary)**: <img width="1087" height="883" alt="Screenshot 2026-03-03 at 10 47 05 AM" src="https://github.com/user-attachments/assets/9fc8d4d4-6a38-4ecb-98fe-b56b46ac4f74" /> ### Global user with global report (observer_can_run = true) Global Observer user can target all fleets. <img width="1329" height="609" alt="Screenshot 2026-03-03 at 10 56 03 AM" src="https://github.com/user-attachments/assets/059d4eb2-546f-4a19-9eee-b64dd0250bf1" /> <img width="981" height="818" alt="Screenshot 2026-03-03 at 10 57 50 AM" src="https://github.com/user-attachments/assets/afa0ee58-3457-4838-a96e-dd508d924079" /> ### Global user with global report (observer_can_run = false) Global Observer user can't target any fleet. <img width="691" height="574" alt="Screenshot 2026-03-03 at 10 59 57 AM" src="https://github.com/user-attachments/assets/f328d547-ed06-4c30-ac22-5df7bb32240a" /> <img width="985" height="814" alt="Screenshot 2026-03-03 at 11 00 06 AM" src="https://github.com/user-attachments/assets/bb55da11-ea3f-40c7-bd98-652880d9e8f9" /> ## Policies On the FE, the same component is used to display the targets for Live Policies, so just making sure that I didn't introduce any regression. ### Global technician user, all fleets policy Can select all fleets. <img width="1130" height="858" alt="Screenshot 2026-03-03 at 11 13 40 AM" src="https://github.com/user-attachments/assets/8d9d97c4-9946-4c4c-9a8a-d79c65d9cb33" /> ### Team user with team policy Created user: - **Technician** on **Servers**. - **Observer** on **Servers (canary)**. <img width="745" height="770" alt="Screenshot 2026-03-03 at 11 18 11 AM" src="https://github.com/user-attachments/assets/56973c34-49bb-4007-9fac-09cf5315bdff" /> Can only select **Servers** as a target: <img width="999" height="754" alt="Screenshot 2026-03-03 at 11 18 56 AM" src="https://github.com/user-attachments/assets/82d14a8f-46e1-41f5-9355-d717477c85d8" /> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2026-03-05 18:12:04 +00:00
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: plainObserverOnBothTeams,
isPremiumTier: true,
isOnGlobalTeam: false,
},
},
});
Follow-up changes to observer live query bypass (#41146) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 This is a follow-up of https://github.com/fleetdm/fleet/pull/40717 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Verified that the manual test cases I described in https://github.com/fleetdm/fleet/pull/40717 still pass. Used the following setup: - 1 host on Servers. - 1 host on Servers (canary). - 9999 hosts on Unassigned. <img width="1292" height="448" alt="Screenshot 2026-03-10 at 9 41 33 PM" src="https://github.com/user-attachments/assets/37ba2ad9-aa7b-4d40-b134-56a943e2635c" /> Users: - Team user with these assignments for test cases 1 and 2. <img width="570" height="269" alt="Screenshot 2026-03-10 at 9 42 41 PM" src="https://github.com/user-attachments/assets/f4bcf180-b7cc-4d80-a727-26ce887cbe84" /> - Global observer user for test cases 3 to 5. ### Test case 1 Report on Workstations (canary) with observers_can_run=true <img width="470" height="538" alt="Screenshot 2026-03-10 at 9 42 30 PM" src="https://github.com/user-attachments/assets/11c02ee9-c6eb-463a-9d4b-168a6155feed" /> Tested that I'm only able to target that host using "All hosts", "macOS" and other labels. Also, searching for specific hosts under "Target specific hosts" only retrieves that host. https://github.com/user-attachments/assets/150d986a-b4f2-49ab-86d9-0308685873eb ### Test case 2 Confirmed that I'm not able to target `perf-host-1` from `Servers (canary)` using a manual label with the same report above. For this, I created a manual label and assigned only to `perf-host-1`: <img width="603" height="349" alt="Screenshot 2026-03-10 at 9 50 52 PM" src="https://github.com/user-attachments/assets/98b4a27a-4e46-466e-a377-622d36903feb" /> Note that 0 hosts are targeted and **Run** is disabled: <img width="950" height="814" alt="Screenshot 2026-03-10 at 9 52 26 PM" src="https://github.com/user-attachments/assets/3b42c0e9-3005-40cc-8733-85b9b729ce89" /> ### Test case 3 Accessed same report in `Workstations (canary)` above with a Global Observer user. Confirmed that no hosts can be targeted in any way: <img width="977" height="649" alt="Screenshot 2026-03-11 at 8 29 26 AM" src="https://github.com/user-attachments/assets/ac87ac7e-3097-4228-a724-1d9324dec504" /> <img width="986" height="746" alt="Screenshot 2026-03-11 at 8 30 06 AM" src="https://github.com/user-attachments/assets/5ca592d2-be8c-43c0-8a27-d18fdee35442" /> <img width="1017" height="812" alt="Screenshot 2026-03-11 at 8 30 12 AM" src="https://github.com/user-attachments/assets/fb92940d-3ab2-4136-9e04-825f2c5eb3fe" /> <img width="998" height="809" alt="Screenshot 2026-03-11 at 8 30 17 AM" src="https://github.com/user-attachments/assets/67cc9c0a-e1aa-49df-ad68-1988d6471d32" /> <img width="1444" height="311" alt="Screenshot 2026-03-11 at 8 30 35 AM" src="https://github.com/user-attachments/assets/4b725bf1-0d6d-4458-840e-a96666a34903" /> <img width="1444" height="303" alt="Screenshot 2026-03-11 at 8 30 42 AM" src="https://github.com/user-attachments/assets/54a9cd65-90f5-4454-a713-334e23118295" /> ### Test case 4 As a global observer, accessing a global report with observers_can_run=true, I can target all the hosts across all teams. <img width="951" height="640" alt="Screenshot 2026-03-11 at 8 34 58 AM" src="https://github.com/user-attachments/assets/3c235b3d-acd5-4801-834f-6fe6cd67d3dd" /> <img width="1448" height="527" alt="Screenshot 2026-03-11 at 8 35 06 AM" src="https://github.com/user-attachments/assets/0f5f663d-8597-4320-aceb-ee6f168ec552" /> <img width="1474" height="179" alt="Screenshot 2026-03-11 at 8 35 14 AM" src="https://github.com/user-attachments/assets/042eda04-e7f6-4c21-9503-878a23435fcd" /> ### Test case 5 With the same report from test case 4, but observers_can_run=false, I can't target any hosts. <img width="971" height="804" alt="Screenshot 2026-03-11 at 8 36 49 AM" src="https://github.com/user-attachments/assets/3a3a9fe3-a159-4ef9-8b08-4c987b9c0828" /> <img width="967" height="813" alt="Screenshot 2026-03-11 at 8 37 00 AM" src="https://github.com/user-attachments/assets/aba5588d-dd96-4b88-9911-ebdd743bfa65" />
2026-03-11 16:42:33 +00:00
// Query belongs to team 1; observer may only target that team.
Fix observer query bypass: prevent cross-team targeting (#40717) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. # Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Queries/reports ### Team user with team report (observer_can_run = true) Created user with the following assignments: <img width="596" height="285" alt="Screenshot 2026-03-02 at 4 58 47 PM" src="https://github.com/user-attachments/assets/a3a8e7dd-2bfc-40f9-948c-b26b016162ae" /> Created report on **Workstations (canary)** fleet with **observers_can_run = true** <img width="1020" height="711" alt="Screenshot 2026-03-02 at 5 09 25 PM" src="https://github.com/user-attachments/assets/58aa98c7-8cbd-4a7a-a159-f4b40a65f2c9" /> Logged in with newly-created user, selected the report above to run it as a live report. - Verified that **Servers (canary)** is disabled => user is **Observer** on that fleet, but query belongs to **Workstations (canary)**. - All the other fleets are enabled: - User is **Observer+ or more** in those fleets. - User is **Observer** in **Workstations (canary)** => enabled because report belongs to this fleet, AND **observer_can_run = true**. <img width="986" height="823" alt="Screenshot 2026-03-02 at 5 07 29 PM" src="https://github.com/user-attachments/assets/b6b7aa4b-5036-46e3-8497-3a77f93a3a2c" /> ### Global user with team report (observer_can_run = true) - Created global Observer user. - Accessed same report created above for **Workstations (canary)** fleet with **observers_can_run = true**. - Logged in with newly-created user, selected the report above to run it as a live report. - Verified that the only target available is **Workstations (canary)**: <img width="1087" height="883" alt="Screenshot 2026-03-03 at 10 47 05 AM" src="https://github.com/user-attachments/assets/9fc8d4d4-6a38-4ecb-98fe-b56b46ac4f74" /> ### Global user with global report (observer_can_run = true) Global Observer user can target all fleets. <img width="1329" height="609" alt="Screenshot 2026-03-03 at 10 56 03 AM" src="https://github.com/user-attachments/assets/059d4eb2-546f-4a19-9eee-b64dd0250bf1" /> <img width="981" height="818" alt="Screenshot 2026-03-03 at 10 57 50 AM" src="https://github.com/user-attachments/assets/afa0ee58-3457-4838-a96e-dd508d924079" /> ### Global user with global report (observer_can_run = false) Global Observer user can't target any fleet. <img width="691" height="574" alt="Screenshot 2026-03-03 at 10 59 57 AM" src="https://github.com/user-attachments/assets/f328d547-ed06-4c30-ac22-5df7bb32240a" /> <img width="985" height="814" alt="Screenshot 2026-03-03 at 11 00 06 AM" src="https://github.com/user-attachments/assets/bb55da11-ea3f-40c7-bd98-652880d9e8f9" /> ## Policies On the FE, the same component is used to display the targets for Live Policies, so just making sure that I didn't introduce any regression. ### Global technician user, all fleets policy Can select all fleets. <img width="1130" height="858" alt="Screenshot 2026-03-03 at 11 13 40 AM" src="https://github.com/user-attachments/assets/8d9d97c4-9946-4c4c-9a8a-d79c65d9cb33" /> ### Team user with team policy Created user: - **Technician** on **Servers**. - **Observer** on **Servers (canary)**. <img width="745" height="770" alt="Screenshot 2026-03-03 at 11 18 11 AM" src="https://github.com/user-attachments/assets/56973c34-49bb-4007-9fac-09cf5315bdff" /> Can only select **Servers** as a target: <img width="999" height="754" alt="Screenshot 2026-03-03 at 11 18 56 AM" src="https://github.com/user-attachments/assets/82d14a8f-46e1-41f5-9355-d717477c85d8" /> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2026-03-05 18:12:04 +00:00
render(
<SelectTargets
{...defaultProps}
isObserverCanRunQuery
queryTeamId={1}
/>
);
await waitFor(() => {
expect(getTeamButton("Team Alpha")).toBeEnabled();
expect(getTeamButton("Team Beta")).toBeDisabled();
});
});
Follow-up changes to observer live query bypass (#41146) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 This is a follow-up of https://github.com/fleetdm/fleet/pull/40717 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Verified that the manual test cases I described in https://github.com/fleetdm/fleet/pull/40717 still pass. Used the following setup: - 1 host on Servers. - 1 host on Servers (canary). - 9999 hosts on Unassigned. <img width="1292" height="448" alt="Screenshot 2026-03-10 at 9 41 33 PM" src="https://github.com/user-attachments/assets/37ba2ad9-aa7b-4d40-b134-56a943e2635c" /> Users: - Team user with these assignments for test cases 1 and 2. <img width="570" height="269" alt="Screenshot 2026-03-10 at 9 42 41 PM" src="https://github.com/user-attachments/assets/f4bcf180-b7cc-4d80-a727-26ce887cbe84" /> - Global observer user for test cases 3 to 5. ### Test case 1 Report on Workstations (canary) with observers_can_run=true <img width="470" height="538" alt="Screenshot 2026-03-10 at 9 42 30 PM" src="https://github.com/user-attachments/assets/11c02ee9-c6eb-463a-9d4b-168a6155feed" /> Tested that I'm only able to target that host using "All hosts", "macOS" and other labels. Also, searching for specific hosts under "Target specific hosts" only retrieves that host. https://github.com/user-attachments/assets/150d986a-b4f2-49ab-86d9-0308685873eb ### Test case 2 Confirmed that I'm not able to target `perf-host-1` from `Servers (canary)` using a manual label with the same report above. For this, I created a manual label and assigned only to `perf-host-1`: <img width="603" height="349" alt="Screenshot 2026-03-10 at 9 50 52 PM" src="https://github.com/user-attachments/assets/98b4a27a-4e46-466e-a377-622d36903feb" /> Note that 0 hosts are targeted and **Run** is disabled: <img width="950" height="814" alt="Screenshot 2026-03-10 at 9 52 26 PM" src="https://github.com/user-attachments/assets/3b42c0e9-3005-40cc-8733-85b9b729ce89" /> ### Test case 3 Accessed same report in `Workstations (canary)` above with a Global Observer user. Confirmed that no hosts can be targeted in any way: <img width="977" height="649" alt="Screenshot 2026-03-11 at 8 29 26 AM" src="https://github.com/user-attachments/assets/ac87ac7e-3097-4228-a724-1d9324dec504" /> <img width="986" height="746" alt="Screenshot 2026-03-11 at 8 30 06 AM" src="https://github.com/user-attachments/assets/5ca592d2-be8c-43c0-8a27-d18fdee35442" /> <img width="1017" height="812" alt="Screenshot 2026-03-11 at 8 30 12 AM" src="https://github.com/user-attachments/assets/fb92940d-3ab2-4136-9e04-825f2c5eb3fe" /> <img width="998" height="809" alt="Screenshot 2026-03-11 at 8 30 17 AM" src="https://github.com/user-attachments/assets/67cc9c0a-e1aa-49df-ad68-1988d6471d32" /> <img width="1444" height="311" alt="Screenshot 2026-03-11 at 8 30 35 AM" src="https://github.com/user-attachments/assets/4b725bf1-0d6d-4458-840e-a96666a34903" /> <img width="1444" height="303" alt="Screenshot 2026-03-11 at 8 30 42 AM" src="https://github.com/user-attachments/assets/54a9cd65-90f5-4454-a713-334e23118295" /> ### Test case 4 As a global observer, accessing a global report with observers_can_run=true, I can target all the hosts across all teams. <img width="951" height="640" alt="Screenshot 2026-03-11 at 8 34 58 AM" src="https://github.com/user-attachments/assets/3c235b3d-acd5-4801-834f-6fe6cd67d3dd" /> <img width="1448" height="527" alt="Screenshot 2026-03-11 at 8 35 06 AM" src="https://github.com/user-attachments/assets/0f5f663d-8597-4320-aceb-ee6f168ec552" /> <img width="1474" height="179" alt="Screenshot 2026-03-11 at 8 35 14 AM" src="https://github.com/user-attachments/assets/042eda04-e7f6-4c21-9503-878a23435fcd" /> ### Test case 5 With the same report from test case 4, but observers_can_run=false, I can't target any hosts. <img width="971" height="804" alt="Screenshot 2026-03-11 at 8 36 49 AM" src="https://github.com/user-attachments/assets/3a3a9fe3-a159-4ef9-8b08-4c987b9c0828" /> <img width="967" height="813" alt="Screenshot 2026-03-11 at 8 37 00 AM" src="https://github.com/user-attachments/assets/aba5588d-dd96-4b88-9911-ebdd743bfa65" />
2026-03-11 16:42:33 +00:00
it("enables only the query's team when observer_can_run is true (query on team 2)", async () => {
Fix observer query bypass: prevent cross-team targeting (#40717) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. # Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Queries/reports ### Team user with team report (observer_can_run = true) Created user with the following assignments: <img width="596" height="285" alt="Screenshot 2026-03-02 at 4 58 47 PM" src="https://github.com/user-attachments/assets/a3a8e7dd-2bfc-40f9-948c-b26b016162ae" /> Created report on **Workstations (canary)** fleet with **observers_can_run = true** <img width="1020" height="711" alt="Screenshot 2026-03-02 at 5 09 25 PM" src="https://github.com/user-attachments/assets/58aa98c7-8cbd-4a7a-a159-f4b40a65f2c9" /> Logged in with newly-created user, selected the report above to run it as a live report. - Verified that **Servers (canary)** is disabled => user is **Observer** on that fleet, but query belongs to **Workstations (canary)**. - All the other fleets are enabled: - User is **Observer+ or more** in those fleets. - User is **Observer** in **Workstations (canary)** => enabled because report belongs to this fleet, AND **observer_can_run = true**. <img width="986" height="823" alt="Screenshot 2026-03-02 at 5 07 29 PM" src="https://github.com/user-attachments/assets/b6b7aa4b-5036-46e3-8497-3a77f93a3a2c" /> ### Global user with team report (observer_can_run = true) - Created global Observer user. - Accessed same report created above for **Workstations (canary)** fleet with **observers_can_run = true**. - Logged in with newly-created user, selected the report above to run it as a live report. - Verified that the only target available is **Workstations (canary)**: <img width="1087" height="883" alt="Screenshot 2026-03-03 at 10 47 05 AM" src="https://github.com/user-attachments/assets/9fc8d4d4-6a38-4ecb-98fe-b56b46ac4f74" /> ### Global user with global report (observer_can_run = true) Global Observer user can target all fleets. <img width="1329" height="609" alt="Screenshot 2026-03-03 at 10 56 03 AM" src="https://github.com/user-attachments/assets/059d4eb2-546f-4a19-9eee-b64dd0250bf1" /> <img width="981" height="818" alt="Screenshot 2026-03-03 at 10 57 50 AM" src="https://github.com/user-attachments/assets/afa0ee58-3457-4838-a96e-dd508d924079" /> ### Global user with global report (observer_can_run = false) Global Observer user can't target any fleet. <img width="691" height="574" alt="Screenshot 2026-03-03 at 10 59 57 AM" src="https://github.com/user-attachments/assets/f328d547-ed06-4c30-ac22-5df7bb32240a" /> <img width="985" height="814" alt="Screenshot 2026-03-03 at 11 00 06 AM" src="https://github.com/user-attachments/assets/bb55da11-ea3f-40c7-bd98-652880d9e8f9" /> ## Policies On the FE, the same component is used to display the targets for Live Policies, so just making sure that I didn't introduce any regression. ### Global technician user, all fleets policy Can select all fleets. <img width="1130" height="858" alt="Screenshot 2026-03-03 at 11 13 40 AM" src="https://github.com/user-attachments/assets/8d9d97c4-9946-4c4c-9a8a-d79c65d9cb33" /> ### Team user with team policy Created user: - **Technician** on **Servers**. - **Observer** on **Servers (canary)**. <img width="745" height="770" alt="Screenshot 2026-03-03 at 11 18 11 AM" src="https://github.com/user-attachments/assets/56973c34-49bb-4007-9fac-09cf5315bdff" /> Can only select **Servers** as a target: <img width="999" height="754" alt="Screenshot 2026-03-03 at 11 18 56 AM" src="https://github.com/user-attachments/assets/82d14a8f-46e1-41f5-9355-d717477c85d8" /> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2026-03-05 18:12:04 +00:00
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: plainObserverOnBothTeams,
isPremiumTier: true,
isOnGlobalTeam: false,
},
},
});
Follow-up changes to observer live query bypass (#41146) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 This is a follow-up of https://github.com/fleetdm/fleet/pull/40717 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Verified that the manual test cases I described in https://github.com/fleetdm/fleet/pull/40717 still pass. Used the following setup: - 1 host on Servers. - 1 host on Servers (canary). - 9999 hosts on Unassigned. <img width="1292" height="448" alt="Screenshot 2026-03-10 at 9 41 33 PM" src="https://github.com/user-attachments/assets/37ba2ad9-aa7b-4d40-b134-56a943e2635c" /> Users: - Team user with these assignments for test cases 1 and 2. <img width="570" height="269" alt="Screenshot 2026-03-10 at 9 42 41 PM" src="https://github.com/user-attachments/assets/f4bcf180-b7cc-4d80-a727-26ce887cbe84" /> - Global observer user for test cases 3 to 5. ### Test case 1 Report on Workstations (canary) with observers_can_run=true <img width="470" height="538" alt="Screenshot 2026-03-10 at 9 42 30 PM" src="https://github.com/user-attachments/assets/11c02ee9-c6eb-463a-9d4b-168a6155feed" /> Tested that I'm only able to target that host using "All hosts", "macOS" and other labels. Also, searching for specific hosts under "Target specific hosts" only retrieves that host. https://github.com/user-attachments/assets/150d986a-b4f2-49ab-86d9-0308685873eb ### Test case 2 Confirmed that I'm not able to target `perf-host-1` from `Servers (canary)` using a manual label with the same report above. For this, I created a manual label and assigned only to `perf-host-1`: <img width="603" height="349" alt="Screenshot 2026-03-10 at 9 50 52 PM" src="https://github.com/user-attachments/assets/98b4a27a-4e46-466e-a377-622d36903feb" /> Note that 0 hosts are targeted and **Run** is disabled: <img width="950" height="814" alt="Screenshot 2026-03-10 at 9 52 26 PM" src="https://github.com/user-attachments/assets/3b42c0e9-3005-40cc-8733-85b9b729ce89" /> ### Test case 3 Accessed same report in `Workstations (canary)` above with a Global Observer user. Confirmed that no hosts can be targeted in any way: <img width="977" height="649" alt="Screenshot 2026-03-11 at 8 29 26 AM" src="https://github.com/user-attachments/assets/ac87ac7e-3097-4228-a724-1d9324dec504" /> <img width="986" height="746" alt="Screenshot 2026-03-11 at 8 30 06 AM" src="https://github.com/user-attachments/assets/5ca592d2-be8c-43c0-8a27-d18fdee35442" /> <img width="1017" height="812" alt="Screenshot 2026-03-11 at 8 30 12 AM" src="https://github.com/user-attachments/assets/fb92940d-3ab2-4136-9e04-825f2c5eb3fe" /> <img width="998" height="809" alt="Screenshot 2026-03-11 at 8 30 17 AM" src="https://github.com/user-attachments/assets/67cc9c0a-e1aa-49df-ad68-1988d6471d32" /> <img width="1444" height="311" alt="Screenshot 2026-03-11 at 8 30 35 AM" src="https://github.com/user-attachments/assets/4b725bf1-0d6d-4458-840e-a96666a34903" /> <img width="1444" height="303" alt="Screenshot 2026-03-11 at 8 30 42 AM" src="https://github.com/user-attachments/assets/54a9cd65-90f5-4454-a713-334e23118295" /> ### Test case 4 As a global observer, accessing a global report with observers_can_run=true, I can target all the hosts across all teams. <img width="951" height="640" alt="Screenshot 2026-03-11 at 8 34 58 AM" src="https://github.com/user-attachments/assets/3c235b3d-acd5-4801-834f-6fe6cd67d3dd" /> <img width="1448" height="527" alt="Screenshot 2026-03-11 at 8 35 06 AM" src="https://github.com/user-attachments/assets/0f5f663d-8597-4320-aceb-ee6f168ec552" /> <img width="1474" height="179" alt="Screenshot 2026-03-11 at 8 35 14 AM" src="https://github.com/user-attachments/assets/042eda04-e7f6-4c21-9503-878a23435fcd" /> ### Test case 5 With the same report from test case 4, but observers_can_run=false, I can't target any hosts. <img width="971" height="804" alt="Screenshot 2026-03-11 at 8 36 49 AM" src="https://github.com/user-attachments/assets/3a3a9fe3-a159-4ef9-8b08-4c987b9c0828" /> <img width="967" height="813" alt="Screenshot 2026-03-11 at 8 37 00 AM" src="https://github.com/user-attachments/assets/aba5588d-dd96-4b88-9911-ebdd743bfa65" />
2026-03-11 16:42:33 +00:00
// Query belongs to team 2; only team 2 should be enabled.
Fix observer query bypass: prevent cross-team targeting (#40717) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. # Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Queries/reports ### Team user with team report (observer_can_run = true) Created user with the following assignments: <img width="596" height="285" alt="Screenshot 2026-03-02 at 4 58 47 PM" src="https://github.com/user-attachments/assets/a3a8e7dd-2bfc-40f9-948c-b26b016162ae" /> Created report on **Workstations (canary)** fleet with **observers_can_run = true** <img width="1020" height="711" alt="Screenshot 2026-03-02 at 5 09 25 PM" src="https://github.com/user-attachments/assets/58aa98c7-8cbd-4a7a-a159-f4b40a65f2c9" /> Logged in with newly-created user, selected the report above to run it as a live report. - Verified that **Servers (canary)** is disabled => user is **Observer** on that fleet, but query belongs to **Workstations (canary)**. - All the other fleets are enabled: - User is **Observer+ or more** in those fleets. - User is **Observer** in **Workstations (canary)** => enabled because report belongs to this fleet, AND **observer_can_run = true**. <img width="986" height="823" alt="Screenshot 2026-03-02 at 5 07 29 PM" src="https://github.com/user-attachments/assets/b6b7aa4b-5036-46e3-8497-3a77f93a3a2c" /> ### Global user with team report (observer_can_run = true) - Created global Observer user. - Accessed same report created above for **Workstations (canary)** fleet with **observers_can_run = true**. - Logged in with newly-created user, selected the report above to run it as a live report. - Verified that the only target available is **Workstations (canary)**: <img width="1087" height="883" alt="Screenshot 2026-03-03 at 10 47 05 AM" src="https://github.com/user-attachments/assets/9fc8d4d4-6a38-4ecb-98fe-b56b46ac4f74" /> ### Global user with global report (observer_can_run = true) Global Observer user can target all fleets. <img width="1329" height="609" alt="Screenshot 2026-03-03 at 10 56 03 AM" src="https://github.com/user-attachments/assets/059d4eb2-546f-4a19-9eee-b64dd0250bf1" /> <img width="981" height="818" alt="Screenshot 2026-03-03 at 10 57 50 AM" src="https://github.com/user-attachments/assets/afa0ee58-3457-4838-a96e-dd508d924079" /> ### Global user with global report (observer_can_run = false) Global Observer user can't target any fleet. <img width="691" height="574" alt="Screenshot 2026-03-03 at 10 59 57 AM" src="https://github.com/user-attachments/assets/f328d547-ed06-4c30-ac22-5df7bb32240a" /> <img width="985" height="814" alt="Screenshot 2026-03-03 at 11 00 06 AM" src="https://github.com/user-attachments/assets/bb55da11-ea3f-40c7-bd98-652880d9e8f9" /> ## Policies On the FE, the same component is used to display the targets for Live Policies, so just making sure that I didn't introduce any regression. ### Global technician user, all fleets policy Can select all fleets. <img width="1130" height="858" alt="Screenshot 2026-03-03 at 11 13 40 AM" src="https://github.com/user-attachments/assets/8d9d97c4-9946-4c4c-9a8a-d79c65d9cb33" /> ### Team user with team policy Created user: - **Technician** on **Servers**. - **Observer** on **Servers (canary)**. <img width="745" height="770" alt="Screenshot 2026-03-03 at 11 18 11 AM" src="https://github.com/user-attachments/assets/56973c34-49bb-4007-9fac-09cf5315bdff" /> Can only select **Servers** as a target: <img width="999" height="754" alt="Screenshot 2026-03-03 at 11 18 56 AM" src="https://github.com/user-attachments/assets/82d14a8f-46e1-41f5-9355-d717477c85d8" /> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2026-03-05 18:12:04 +00:00
render(
<SelectTargets
{...defaultProps}
isObserverCanRunQuery
queryTeamId={2}
/>
);
await waitFor(() => {
expect(getTeamButton("Team Alpha")).toBeDisabled();
expect(getTeamButton("Team Beta")).toBeEnabled();
});
});
});
describe("observer+ user", () => {
const observerPlusOnBothTeams = createMockUser({
global_role: null,
teams: [
{ ...MOCK_TEAMS[0], role: "observer_plus" },
{ ...MOCK_TEAMS[1], role: "observer_plus" },
],
});
it("enables all teams for observer+ even on live policies", async () => {
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: observerPlusOnBothTeams,
isPremiumTier: true,
isOnGlobalTeam: false,
},
},
});
render(
<SelectTargets
{...defaultProps}
isLivePolicy
isObserverCanRunQuery={false}
/>
);
await waitFor(() => {
expect(getTeamButton("Team Alpha")).toBeEnabled();
expect(getTeamButton("Team Beta")).toBeEnabled();
});
});
it("enables all teams for observer+ on queries", async () => {
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: observerPlusOnBothTeams,
isPremiumTier: true,
isOnGlobalTeam: false,
},
},
});
render(
<SelectTargets
{...defaultProps}
isObserverCanRunQuery={false}
queryTeamId={1}
/>
);
await waitFor(() => {
expect(getTeamButton("Team Alpha")).toBeEnabled();
expect(getTeamButton("Team Beta")).toBeEnabled();
});
});
});
describe("multi-team user with mixed roles (admin on team 1, observer on team 2)", () => {
const adminObsUser = createMockUser({
global_role: null,
teams: [
{ ...MOCK_TEAMS[0], role: "admin" },
{ ...MOCK_TEAMS[1], role: "observer" },
],
});
it("disables only the observer team for live policies", async () => {
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: adminObsUser,
isPremiumTier: true,
isOnGlobalTeam: false,
},
},
});
render(
<SelectTargets
{...defaultProps}
isLivePolicy
isObserverCanRunQuery={false}
/>
);
await waitFor(() => {
expect(getTeamButton("Team Alpha")).toBeEnabled();
expect(getTeamButton("Team Beta")).toBeDisabled();
});
});
it("disables observer team when observer_can_run query belongs to a different team", async () => {
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: adminObsUser,
isPremiumTier: true,
isOnGlobalTeam: false,
},
},
});
Follow-up changes to observer live query bypass (#41146) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 This is a follow-up of https://github.com/fleetdm/fleet/pull/40717 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Verified that the manual test cases I described in https://github.com/fleetdm/fleet/pull/40717 still pass. Used the following setup: - 1 host on Servers. - 1 host on Servers (canary). - 9999 hosts on Unassigned. <img width="1292" height="448" alt="Screenshot 2026-03-10 at 9 41 33 PM" src="https://github.com/user-attachments/assets/37ba2ad9-aa7b-4d40-b134-56a943e2635c" /> Users: - Team user with these assignments for test cases 1 and 2. <img width="570" height="269" alt="Screenshot 2026-03-10 at 9 42 41 PM" src="https://github.com/user-attachments/assets/f4bcf180-b7cc-4d80-a727-26ce887cbe84" /> - Global observer user for test cases 3 to 5. ### Test case 1 Report on Workstations (canary) with observers_can_run=true <img width="470" height="538" alt="Screenshot 2026-03-10 at 9 42 30 PM" src="https://github.com/user-attachments/assets/11c02ee9-c6eb-463a-9d4b-168a6155feed" /> Tested that I'm only able to target that host using "All hosts", "macOS" and other labels. Also, searching for specific hosts under "Target specific hosts" only retrieves that host. https://github.com/user-attachments/assets/150d986a-b4f2-49ab-86d9-0308685873eb ### Test case 2 Confirmed that I'm not able to target `perf-host-1` from `Servers (canary)` using a manual label with the same report above. For this, I created a manual label and assigned only to `perf-host-1`: <img width="603" height="349" alt="Screenshot 2026-03-10 at 9 50 52 PM" src="https://github.com/user-attachments/assets/98b4a27a-4e46-466e-a377-622d36903feb" /> Note that 0 hosts are targeted and **Run** is disabled: <img width="950" height="814" alt="Screenshot 2026-03-10 at 9 52 26 PM" src="https://github.com/user-attachments/assets/3b42c0e9-3005-40cc-8733-85b9b729ce89" /> ### Test case 3 Accessed same report in `Workstations (canary)` above with a Global Observer user. Confirmed that no hosts can be targeted in any way: <img width="977" height="649" alt="Screenshot 2026-03-11 at 8 29 26 AM" src="https://github.com/user-attachments/assets/ac87ac7e-3097-4228-a724-1d9324dec504" /> <img width="986" height="746" alt="Screenshot 2026-03-11 at 8 30 06 AM" src="https://github.com/user-attachments/assets/5ca592d2-be8c-43c0-8a27-d18fdee35442" /> <img width="1017" height="812" alt="Screenshot 2026-03-11 at 8 30 12 AM" src="https://github.com/user-attachments/assets/fb92940d-3ab2-4136-9e04-825f2c5eb3fe" /> <img width="998" height="809" alt="Screenshot 2026-03-11 at 8 30 17 AM" src="https://github.com/user-attachments/assets/67cc9c0a-e1aa-49df-ad68-1988d6471d32" /> <img width="1444" height="311" alt="Screenshot 2026-03-11 at 8 30 35 AM" src="https://github.com/user-attachments/assets/4b725bf1-0d6d-4458-840e-a96666a34903" /> <img width="1444" height="303" alt="Screenshot 2026-03-11 at 8 30 42 AM" src="https://github.com/user-attachments/assets/54a9cd65-90f5-4454-a713-334e23118295" /> ### Test case 4 As a global observer, accessing a global report with observers_can_run=true, I can target all the hosts across all teams. <img width="951" height="640" alt="Screenshot 2026-03-11 at 8 34 58 AM" src="https://github.com/user-attachments/assets/3c235b3d-acd5-4801-834f-6fe6cd67d3dd" /> <img width="1448" height="527" alt="Screenshot 2026-03-11 at 8 35 06 AM" src="https://github.com/user-attachments/assets/0f5f663d-8597-4320-aceb-ee6f168ec552" /> <img width="1474" height="179" alt="Screenshot 2026-03-11 at 8 35 14 AM" src="https://github.com/user-attachments/assets/042eda04-e7f6-4c21-9503-878a23435fcd" /> ### Test case 5 With the same report from test case 4, but observers_can_run=false, I can't target any hosts. <img width="971" height="804" alt="Screenshot 2026-03-11 at 8 36 49 AM" src="https://github.com/user-attachments/assets/3a3a9fe3-a159-4ef9-8b08-4c987b9c0828" /> <img width="967" height="813" alt="Screenshot 2026-03-11 at 8 37 00 AM" src="https://github.com/user-attachments/assets/aba5588d-dd96-4b88-9911-ebdd743bfa65" />
2026-03-11 16:42:33 +00:00
// Query belongs to team 1 (admin team), observer_can_run is true.
// Team 2 (observer role) should be disabled — observer_can_run is scoped to the query's team.
Fix observer query bypass: prevent cross-team targeting (#40717) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. # Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Queries/reports ### Team user with team report (observer_can_run = true) Created user with the following assignments: <img width="596" height="285" alt="Screenshot 2026-03-02 at 4 58 47 PM" src="https://github.com/user-attachments/assets/a3a8e7dd-2bfc-40f9-948c-b26b016162ae" /> Created report on **Workstations (canary)** fleet with **observers_can_run = true** <img width="1020" height="711" alt="Screenshot 2026-03-02 at 5 09 25 PM" src="https://github.com/user-attachments/assets/58aa98c7-8cbd-4a7a-a159-f4b40a65f2c9" /> Logged in with newly-created user, selected the report above to run it as a live report. - Verified that **Servers (canary)** is disabled => user is **Observer** on that fleet, but query belongs to **Workstations (canary)**. - All the other fleets are enabled: - User is **Observer+ or more** in those fleets. - User is **Observer** in **Workstations (canary)** => enabled because report belongs to this fleet, AND **observer_can_run = true**. <img width="986" height="823" alt="Screenshot 2026-03-02 at 5 07 29 PM" src="https://github.com/user-attachments/assets/b6b7aa4b-5036-46e3-8497-3a77f93a3a2c" /> ### Global user with team report (observer_can_run = true) - Created global Observer user. - Accessed same report created above for **Workstations (canary)** fleet with **observers_can_run = true**. - Logged in with newly-created user, selected the report above to run it as a live report. - Verified that the only target available is **Workstations (canary)**: <img width="1087" height="883" alt="Screenshot 2026-03-03 at 10 47 05 AM" src="https://github.com/user-attachments/assets/9fc8d4d4-6a38-4ecb-98fe-b56b46ac4f74" /> ### Global user with global report (observer_can_run = true) Global Observer user can target all fleets. <img width="1329" height="609" alt="Screenshot 2026-03-03 at 10 56 03 AM" src="https://github.com/user-attachments/assets/059d4eb2-546f-4a19-9eee-b64dd0250bf1" /> <img width="981" height="818" alt="Screenshot 2026-03-03 at 10 57 50 AM" src="https://github.com/user-attachments/assets/afa0ee58-3457-4838-a96e-dd508d924079" /> ### Global user with global report (observer_can_run = false) Global Observer user can't target any fleet. <img width="691" height="574" alt="Screenshot 2026-03-03 at 10 59 57 AM" src="https://github.com/user-attachments/assets/f328d547-ed06-4c30-ac22-5df7bb32240a" /> <img width="985" height="814" alt="Screenshot 2026-03-03 at 11 00 06 AM" src="https://github.com/user-attachments/assets/bb55da11-ea3f-40c7-bd98-652880d9e8f9" /> ## Policies On the FE, the same component is used to display the targets for Live Policies, so just making sure that I didn't introduce any regression. ### Global technician user, all fleets policy Can select all fleets. <img width="1130" height="858" alt="Screenshot 2026-03-03 at 11 13 40 AM" src="https://github.com/user-attachments/assets/8d9d97c4-9946-4c4c-9a8a-d79c65d9cb33" /> ### Team user with team policy Created user: - **Technician** on **Servers**. - **Observer** on **Servers (canary)**. <img width="745" height="770" alt="Screenshot 2026-03-03 at 11 18 11 AM" src="https://github.com/user-attachments/assets/56973c34-49bb-4007-9fac-09cf5315bdff" /> Can only select **Servers** as a target: <img width="999" height="754" alt="Screenshot 2026-03-03 at 11 18 56 AM" src="https://github.com/user-attachments/assets/82d14a8f-46e1-41f5-9355-d717477c85d8" /> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2026-03-05 18:12:04 +00:00
render(
<SelectTargets
{...defaultProps}
isObserverCanRunQuery
queryTeamId={1}
/>
);
await waitFor(() => {
expect(getTeamButton("Team Alpha")).toBeEnabled();
expect(getTeamButton("Team Beta")).toBeDisabled();
});
});
it("enables observer team when observer_can_run query belongs to that team", async () => {
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: adminObsUser,
isPremiumTier: true,
isOnGlobalTeam: false,
},
},
});
// Query belongs to team 2 (observer team) and observer_can_run is true
render(
<SelectTargets
{...defaultProps}
isObserverCanRunQuery
queryTeamId={2}
/>
);
await waitFor(() => {
expect(getTeamButton("Team Alpha")).toBeEnabled();
expect(getTeamButton("Team Beta")).toBeEnabled();
});
});
});
describe("global observer", () => {
const globalObserver = createMockUser({
global_role: "observer",
teams: [],
});
it("disables all teams (including Unassigned) for live policies", async () => {
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: globalObserver,
isPremiumTier: true,
isOnGlobalTeam: true,
},
},
});
render(
<SelectTargets
{...defaultProps}
isLivePolicy
isObserverCanRunQuery={false}
/>
);
await waitFor(() => {
expect(getTeamButton("Unassigned")).toBeDisabled();
expect(getTeamButton("Team Alpha")).toBeDisabled();
expect(getTeamButton("Team Beta")).toBeDisabled();
});
});
it("disables all teams when query does not have observer_can_run", async () => {
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: globalObserver,
isPremiumTier: true,
isOnGlobalTeam: true,
},
},
});
render(
<SelectTargets
{...defaultProps}
isObserverCanRunQuery={false}
queryTeamId={1}
/>
);
await waitFor(() => {
expect(getTeamButton("Unassigned")).toBeDisabled();
expect(getTeamButton("Team Alpha")).toBeDisabled();
expect(getTeamButton("Team Beta")).toBeDisabled();
});
});
Follow-up changes to observer live query bypass (#41146) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 This is a follow-up of https://github.com/fleetdm/fleet/pull/40717 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Verified that the manual test cases I described in https://github.com/fleetdm/fleet/pull/40717 still pass. Used the following setup: - 1 host on Servers. - 1 host on Servers (canary). - 9999 hosts on Unassigned. <img width="1292" height="448" alt="Screenshot 2026-03-10 at 9 41 33 PM" src="https://github.com/user-attachments/assets/37ba2ad9-aa7b-4d40-b134-56a943e2635c" /> Users: - Team user with these assignments for test cases 1 and 2. <img width="570" height="269" alt="Screenshot 2026-03-10 at 9 42 41 PM" src="https://github.com/user-attachments/assets/f4bcf180-b7cc-4d80-a727-26ce887cbe84" /> - Global observer user for test cases 3 to 5. ### Test case 1 Report on Workstations (canary) with observers_can_run=true <img width="470" height="538" alt="Screenshot 2026-03-10 at 9 42 30 PM" src="https://github.com/user-attachments/assets/11c02ee9-c6eb-463a-9d4b-168a6155feed" /> Tested that I'm only able to target that host using "All hosts", "macOS" and other labels. Also, searching for specific hosts under "Target specific hosts" only retrieves that host. https://github.com/user-attachments/assets/150d986a-b4f2-49ab-86d9-0308685873eb ### Test case 2 Confirmed that I'm not able to target `perf-host-1` from `Servers (canary)` using a manual label with the same report above. For this, I created a manual label and assigned only to `perf-host-1`: <img width="603" height="349" alt="Screenshot 2026-03-10 at 9 50 52 PM" src="https://github.com/user-attachments/assets/98b4a27a-4e46-466e-a377-622d36903feb" /> Note that 0 hosts are targeted and **Run** is disabled: <img width="950" height="814" alt="Screenshot 2026-03-10 at 9 52 26 PM" src="https://github.com/user-attachments/assets/3b42c0e9-3005-40cc-8733-85b9b729ce89" /> ### Test case 3 Accessed same report in `Workstations (canary)` above with a Global Observer user. Confirmed that no hosts can be targeted in any way: <img width="977" height="649" alt="Screenshot 2026-03-11 at 8 29 26 AM" src="https://github.com/user-attachments/assets/ac87ac7e-3097-4228-a724-1d9324dec504" /> <img width="986" height="746" alt="Screenshot 2026-03-11 at 8 30 06 AM" src="https://github.com/user-attachments/assets/5ca592d2-be8c-43c0-8a27-d18fdee35442" /> <img width="1017" height="812" alt="Screenshot 2026-03-11 at 8 30 12 AM" src="https://github.com/user-attachments/assets/fb92940d-3ab2-4136-9e04-825f2c5eb3fe" /> <img width="998" height="809" alt="Screenshot 2026-03-11 at 8 30 17 AM" src="https://github.com/user-attachments/assets/67cc9c0a-e1aa-49df-ad68-1988d6471d32" /> <img width="1444" height="311" alt="Screenshot 2026-03-11 at 8 30 35 AM" src="https://github.com/user-attachments/assets/4b725bf1-0d6d-4458-840e-a96666a34903" /> <img width="1444" height="303" alt="Screenshot 2026-03-11 at 8 30 42 AM" src="https://github.com/user-attachments/assets/54a9cd65-90f5-4454-a713-334e23118295" /> ### Test case 4 As a global observer, accessing a global report with observers_can_run=true, I can target all the hosts across all teams. <img width="951" height="640" alt="Screenshot 2026-03-11 at 8 34 58 AM" src="https://github.com/user-attachments/assets/3c235b3d-acd5-4801-834f-6fe6cd67d3dd" /> <img width="1448" height="527" alt="Screenshot 2026-03-11 at 8 35 06 AM" src="https://github.com/user-attachments/assets/0f5f663d-8597-4320-aceb-ee6f168ec552" /> <img width="1474" height="179" alt="Screenshot 2026-03-11 at 8 35 14 AM" src="https://github.com/user-attachments/assets/042eda04-e7f6-4c21-9503-878a23435fcd" /> ### Test case 5 With the same report from test case 4, but observers_can_run=false, I can't target any hosts. <img width="971" height="804" alt="Screenshot 2026-03-11 at 8 36 49 AM" src="https://github.com/user-attachments/assets/3a3a9fe3-a159-4ef9-8b08-4c987b9c0828" /> <img width="967" height="813" alt="Screenshot 2026-03-11 at 8 37 00 AM" src="https://github.com/user-attachments/assets/aba5588d-dd96-4b88-9911-ebdd743bfa65" />
2026-03-11 16:42:33 +00:00
it("enables only the query's team when observer_can_run is true", async () => {
Fix observer query bypass: prevent cross-team targeting (#40717) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. # Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Queries/reports ### Team user with team report (observer_can_run = true) Created user with the following assignments: <img width="596" height="285" alt="Screenshot 2026-03-02 at 4 58 47 PM" src="https://github.com/user-attachments/assets/a3a8e7dd-2bfc-40f9-948c-b26b016162ae" /> Created report on **Workstations (canary)** fleet with **observers_can_run = true** <img width="1020" height="711" alt="Screenshot 2026-03-02 at 5 09 25 PM" src="https://github.com/user-attachments/assets/58aa98c7-8cbd-4a7a-a159-f4b40a65f2c9" /> Logged in with newly-created user, selected the report above to run it as a live report. - Verified that **Servers (canary)** is disabled => user is **Observer** on that fleet, but query belongs to **Workstations (canary)**. - All the other fleets are enabled: - User is **Observer+ or more** in those fleets. - User is **Observer** in **Workstations (canary)** => enabled because report belongs to this fleet, AND **observer_can_run = true**. <img width="986" height="823" alt="Screenshot 2026-03-02 at 5 07 29 PM" src="https://github.com/user-attachments/assets/b6b7aa4b-5036-46e3-8497-3a77f93a3a2c" /> ### Global user with team report (observer_can_run = true) - Created global Observer user. - Accessed same report created above for **Workstations (canary)** fleet with **observers_can_run = true**. - Logged in with newly-created user, selected the report above to run it as a live report. - Verified that the only target available is **Workstations (canary)**: <img width="1087" height="883" alt="Screenshot 2026-03-03 at 10 47 05 AM" src="https://github.com/user-attachments/assets/9fc8d4d4-6a38-4ecb-98fe-b56b46ac4f74" /> ### Global user with global report (observer_can_run = true) Global Observer user can target all fleets. <img width="1329" height="609" alt="Screenshot 2026-03-03 at 10 56 03 AM" src="https://github.com/user-attachments/assets/059d4eb2-546f-4a19-9eee-b64dd0250bf1" /> <img width="981" height="818" alt="Screenshot 2026-03-03 at 10 57 50 AM" src="https://github.com/user-attachments/assets/afa0ee58-3457-4838-a96e-dd508d924079" /> ### Global user with global report (observer_can_run = false) Global Observer user can't target any fleet. <img width="691" height="574" alt="Screenshot 2026-03-03 at 10 59 57 AM" src="https://github.com/user-attachments/assets/f328d547-ed06-4c30-ac22-5df7bb32240a" /> <img width="985" height="814" alt="Screenshot 2026-03-03 at 11 00 06 AM" src="https://github.com/user-attachments/assets/bb55da11-ea3f-40c7-bd98-652880d9e8f9" /> ## Policies On the FE, the same component is used to display the targets for Live Policies, so just making sure that I didn't introduce any regression. ### Global technician user, all fleets policy Can select all fleets. <img width="1130" height="858" alt="Screenshot 2026-03-03 at 11 13 40 AM" src="https://github.com/user-attachments/assets/8d9d97c4-9946-4c4c-9a8a-d79c65d9cb33" /> ### Team user with team policy Created user: - **Technician** on **Servers**. - **Observer** on **Servers (canary)**. <img width="745" height="770" alt="Screenshot 2026-03-03 at 11 18 11 AM" src="https://github.com/user-attachments/assets/56973c34-49bb-4007-9fac-09cf5315bdff" /> Can only select **Servers** as a target: <img width="999" height="754" alt="Screenshot 2026-03-03 at 11 18 56 AM" src="https://github.com/user-attachments/assets/82d14a8f-46e1-41f5-9355-d717477c85d8" /> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2026-03-05 18:12:04 +00:00
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: globalObserver,
isPremiumTier: true,
isOnGlobalTeam: true,
},
},
});
Follow-up changes to observer live query bypass (#41146) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 This is a follow-up of https://github.com/fleetdm/fleet/pull/40717 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Verified that the manual test cases I described in https://github.com/fleetdm/fleet/pull/40717 still pass. Used the following setup: - 1 host on Servers. - 1 host on Servers (canary). - 9999 hosts on Unassigned. <img width="1292" height="448" alt="Screenshot 2026-03-10 at 9 41 33 PM" src="https://github.com/user-attachments/assets/37ba2ad9-aa7b-4d40-b134-56a943e2635c" /> Users: - Team user with these assignments for test cases 1 and 2. <img width="570" height="269" alt="Screenshot 2026-03-10 at 9 42 41 PM" src="https://github.com/user-attachments/assets/f4bcf180-b7cc-4d80-a727-26ce887cbe84" /> - Global observer user for test cases 3 to 5. ### Test case 1 Report on Workstations (canary) with observers_can_run=true <img width="470" height="538" alt="Screenshot 2026-03-10 at 9 42 30 PM" src="https://github.com/user-attachments/assets/11c02ee9-c6eb-463a-9d4b-168a6155feed" /> Tested that I'm only able to target that host using "All hosts", "macOS" and other labels. Also, searching for specific hosts under "Target specific hosts" only retrieves that host. https://github.com/user-attachments/assets/150d986a-b4f2-49ab-86d9-0308685873eb ### Test case 2 Confirmed that I'm not able to target `perf-host-1` from `Servers (canary)` using a manual label with the same report above. For this, I created a manual label and assigned only to `perf-host-1`: <img width="603" height="349" alt="Screenshot 2026-03-10 at 9 50 52 PM" src="https://github.com/user-attachments/assets/98b4a27a-4e46-466e-a377-622d36903feb" /> Note that 0 hosts are targeted and **Run** is disabled: <img width="950" height="814" alt="Screenshot 2026-03-10 at 9 52 26 PM" src="https://github.com/user-attachments/assets/3b42c0e9-3005-40cc-8733-85b9b729ce89" /> ### Test case 3 Accessed same report in `Workstations (canary)` above with a Global Observer user. Confirmed that no hosts can be targeted in any way: <img width="977" height="649" alt="Screenshot 2026-03-11 at 8 29 26 AM" src="https://github.com/user-attachments/assets/ac87ac7e-3097-4228-a724-1d9324dec504" /> <img width="986" height="746" alt="Screenshot 2026-03-11 at 8 30 06 AM" src="https://github.com/user-attachments/assets/5ca592d2-be8c-43c0-8a27-d18fdee35442" /> <img width="1017" height="812" alt="Screenshot 2026-03-11 at 8 30 12 AM" src="https://github.com/user-attachments/assets/fb92940d-3ab2-4136-9e04-825f2c5eb3fe" /> <img width="998" height="809" alt="Screenshot 2026-03-11 at 8 30 17 AM" src="https://github.com/user-attachments/assets/67cc9c0a-e1aa-49df-ad68-1988d6471d32" /> <img width="1444" height="311" alt="Screenshot 2026-03-11 at 8 30 35 AM" src="https://github.com/user-attachments/assets/4b725bf1-0d6d-4458-840e-a96666a34903" /> <img width="1444" height="303" alt="Screenshot 2026-03-11 at 8 30 42 AM" src="https://github.com/user-attachments/assets/54a9cd65-90f5-4454-a713-334e23118295" /> ### Test case 4 As a global observer, accessing a global report with observers_can_run=true, I can target all the hosts across all teams. <img width="951" height="640" alt="Screenshot 2026-03-11 at 8 34 58 AM" src="https://github.com/user-attachments/assets/3c235b3d-acd5-4801-834f-6fe6cd67d3dd" /> <img width="1448" height="527" alt="Screenshot 2026-03-11 at 8 35 06 AM" src="https://github.com/user-attachments/assets/0f5f663d-8597-4320-aceb-ee6f168ec552" /> <img width="1474" height="179" alt="Screenshot 2026-03-11 at 8 35 14 AM" src="https://github.com/user-attachments/assets/042eda04-e7f6-4c21-9503-878a23435fcd" /> ### Test case 5 With the same report from test case 4, but observers_can_run=false, I can't target any hosts. <img width="971" height="804" alt="Screenshot 2026-03-11 at 8 36 49 AM" src="https://github.com/user-attachments/assets/3a3a9fe3-a159-4ef9-8b08-4c987b9c0828" /> <img width="967" height="813" alt="Screenshot 2026-03-11 at 8 37 00 AM" src="https://github.com/user-attachments/assets/aba5588d-dd96-4b88-9911-ebdd743bfa65" />
2026-03-11 16:42:33 +00:00
// Query belongs to team 1; global observer may only target that team.
Fix observer query bypass: prevent cross-team targeting (#40717) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36093 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. # Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Queries/reports ### Team user with team report (observer_can_run = true) Created user with the following assignments: <img width="596" height="285" alt="Screenshot 2026-03-02 at 4 58 47 PM" src="https://github.com/user-attachments/assets/a3a8e7dd-2bfc-40f9-948c-b26b016162ae" /> Created report on **Workstations (canary)** fleet with **observers_can_run = true** <img width="1020" height="711" alt="Screenshot 2026-03-02 at 5 09 25 PM" src="https://github.com/user-attachments/assets/58aa98c7-8cbd-4a7a-a159-f4b40a65f2c9" /> Logged in with newly-created user, selected the report above to run it as a live report. - Verified that **Servers (canary)** is disabled => user is **Observer** on that fleet, but query belongs to **Workstations (canary)**. - All the other fleets are enabled: - User is **Observer+ or more** in those fleets. - User is **Observer** in **Workstations (canary)** => enabled because report belongs to this fleet, AND **observer_can_run = true**. <img width="986" height="823" alt="Screenshot 2026-03-02 at 5 07 29 PM" src="https://github.com/user-attachments/assets/b6b7aa4b-5036-46e3-8497-3a77f93a3a2c" /> ### Global user with team report (observer_can_run = true) - Created global Observer user. - Accessed same report created above for **Workstations (canary)** fleet with **observers_can_run = true**. - Logged in with newly-created user, selected the report above to run it as a live report. - Verified that the only target available is **Workstations (canary)**: <img width="1087" height="883" alt="Screenshot 2026-03-03 at 10 47 05 AM" src="https://github.com/user-attachments/assets/9fc8d4d4-6a38-4ecb-98fe-b56b46ac4f74" /> ### Global user with global report (observer_can_run = true) Global Observer user can target all fleets. <img width="1329" height="609" alt="Screenshot 2026-03-03 at 10 56 03 AM" src="https://github.com/user-attachments/assets/059d4eb2-546f-4a19-9eee-b64dd0250bf1" /> <img width="981" height="818" alt="Screenshot 2026-03-03 at 10 57 50 AM" src="https://github.com/user-attachments/assets/afa0ee58-3457-4838-a96e-dd508d924079" /> ### Global user with global report (observer_can_run = false) Global Observer user can't target any fleet. <img width="691" height="574" alt="Screenshot 2026-03-03 at 10 59 57 AM" src="https://github.com/user-attachments/assets/f328d547-ed06-4c30-ac22-5df7bb32240a" /> <img width="985" height="814" alt="Screenshot 2026-03-03 at 11 00 06 AM" src="https://github.com/user-attachments/assets/bb55da11-ea3f-40c7-bd98-652880d9e8f9" /> ## Policies On the FE, the same component is used to display the targets for Live Policies, so just making sure that I didn't introduce any regression. ### Global technician user, all fleets policy Can select all fleets. <img width="1130" height="858" alt="Screenshot 2026-03-03 at 11 13 40 AM" src="https://github.com/user-attachments/assets/8d9d97c4-9946-4c4c-9a8a-d79c65d9cb33" /> ### Team user with team policy Created user: - **Technician** on **Servers**. - **Observer** on **Servers (canary)**. <img width="745" height="770" alt="Screenshot 2026-03-03 at 11 18 11 AM" src="https://github.com/user-attachments/assets/56973c34-49bb-4007-9fac-09cf5315bdff" /> Can only select **Servers** as a target: <img width="999" height="754" alt="Screenshot 2026-03-03 at 11 18 56 AM" src="https://github.com/user-attachments/assets/82d14a8f-46e1-41f5-9355-d717477c85d8" /> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2026-03-05 18:12:04 +00:00
render(
<SelectTargets
{...defaultProps}
isObserverCanRunQuery
queryTeamId={1}
/>
);
await waitFor(() => {
expect(getTeamButton("Unassigned")).toBeDisabled();
expect(getTeamButton("Team Alpha")).toBeEnabled();
expect(getTeamButton("Team Beta")).toBeDisabled();
});
});
it("enables all teams for a global observer_can_run query (no team_id)", async () => {
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: globalObserver,
isPremiumTier: true,
isOnGlobalTeam: true,
},
},
});
render(
<SelectTargets
{...defaultProps}
isObserverCanRunQuery
queryTeamId={null}
/>
);
await waitFor(() => {
expect(getTeamButton("Unassigned")).toBeEnabled();
expect(getTeamButton("Team Alpha")).toBeEnabled();
expect(getTeamButton("Team Beta")).toBeEnabled();
});
});
});
describe("helper text visibility", () => {
it("shows helper text when some fleets are disabled", async () => {
const plainObserver = createMockUser({
global_role: "observer",
teams: [],
});
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: plainObserver,
isPremiumTier: true,
isOnGlobalTeam: true,
},
},
});
render(
<SelectTargets
{...defaultProps}
isObserverCanRunQuery={false}
queryTeamId={1}
/>
);
await waitFor(() => {
expect(
screen.getByText("Results limited to fleets you can access.")
).toBeInTheDocument();
});
});
it("does not show helper text when no fleets are disabled", async () => {
const globalAdmin = createMockUser({
global_role: "admin",
teams: [],
});
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: globalAdmin,
isPremiumTier: true,
isOnGlobalTeam: true,
},
},
});
render(
<SelectTargets
{...defaultProps}
isObserverCanRunQuery={false}
queryTeamId={1}
/>
);
// Wait for teams to render to confirm loading is done before asserting absence
await waitFor(() => {
expect(getTeamButton("Team Alpha")).toBeInTheDocument();
});
expect(
screen.queryByText("Results limited to fleets you can access.")
).not.toBeInTheDocument();
});
});
describe("global observer+", () => {
const globalObserverPlus = createMockUser({
global_role: "observer_plus",
teams: [],
});
it("enables all teams for global observer+ even on live policies", async () => {
const render = createCustomRenderer({
withBackendMock: true,
context: {
app: {
currentUser: globalObserverPlus,
isPremiumTier: true,
isOnGlobalTeam: true,
},
},
});
render(
<SelectTargets
{...defaultProps}
isLivePolicy
isObserverCanRunQuery={false}
/>
);
await waitFor(() => {
expect(getTeamButton("Unassigned")).toBeEnabled();
expect(getTeamButton("Team Alpha")).toBeEnabled();
expect(getTeamButton("Team Beta")).toBeEnabled();
});
});
});
});