From 6920eedfab7a6697f080ada40064bbbe93182bdf Mon Sep 17 00:00:00 2001
From: Roberto Dip <dip.jesusr@gmail.com>
Date: Fri, 30 Aug 2024 09:46:33 -0300
Subject: [PATCH] unreleased fixes for MABM (#21704)

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Manual QA for all new/changed functionality
---
 cmd/fleet/serve.go       | 2 ++
 ee/server/service/mdm.go | 9 ++++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go
index 5be28feedd..bcdaab9567 100644
--- a/cmd/fleet/serve.go
+++ b/cmd/fleet/serve.go
@@ -583,6 +583,8 @@ the way that the Fleet server works.
 					// backfilled
 					tok := &fleet.ABMToken{
 						EncryptedToken: appleBM.EncryptedToken,
+						// 2000-01-01 is our "zero value" for time
+						RenewAt: time.Date(2000, time.January, 1, 0, 0, 0, 0, time.UTC),
 					}
 					_, err = ds.InsertABMToken(context.Background(), tok)
 					if err != nil {
diff --git a/ee/server/service/mdm.go b/ee/server/service/mdm.go
index c4dd4bbadf..9aeaddd67b 100644
--- a/ee/server/service/mdm.go
+++ b/ee/server/service/mdm.go
@@ -1271,10 +1271,13 @@ func (svc *Service) UpdateABMTokenTeams(ctx context.Context, tokenID uint, macOS
 	// validate the team IDs
 
 	token.MacOSTeam = fleet.ABMTokenTeam{Name: fleet.TeamNameNoTeam}
+	token.MacOSDefaultTeamID = nil
 	token.IOSTeam = fleet.ABMTokenTeam{Name: fleet.TeamNameNoTeam}
+	token.IOSDefaultTeamID = nil
 	token.IPadOSTeam = fleet.ABMTokenTeam{Name: fleet.TeamNameNoTeam}
+	token.IPadOSDefaultTeamID = nil
 
-	if macOSTeamID != nil {
+	if macOSTeamID != nil && *macOSTeamID != 0 {
 		macOSTeam, err := svc.ds.Team(ctx, *macOSTeamID)
 		if err != nil {
 			return nil, &fleet.BadRequestError{
@@ -1288,7 +1291,7 @@ func (svc *Service) UpdateABMTokenTeams(ctx context.Context, tokenID uint, macOS
 		token.MacOSDefaultTeamID = macOSTeamID
 	}
 
-	if iOSTeamID != nil {
+	if iOSTeamID != nil && *iOSTeamID != 0 {
 		iOSTeam, err := svc.ds.Team(ctx, *iOSTeamID)
 		if err != nil {
 			return nil, &fleet.BadRequestError{
@@ -1301,7 +1304,7 @@ func (svc *Service) UpdateABMTokenTeams(ctx context.Context, tokenID uint, macOS
 		token.IOSDefaultTeamID = iOSTeamID
 	}
 
-	if iPadOSTeamID != nil {
+	if iPadOSTeamID != nil && *iPadOSTeamID != 0 {
 		iPadOSTeam, err := svc.ds.Team(ctx, *iPadOSTeamID)
 		if err != nil {
 			return nil, &fleet.BadRequestError{